The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Sneaky 2FA Kit Innovates with BitB Pop-up Phishing: MFA Bypass at Scale
In November 2025, security researchers reported on the evolving Sneaky 2FA Phishing-as-a-Service (PhaaS) kit, which now features sophisticated Browser-in-the-Browser (BitB) pop-ups that convincingly mimic legitimate browser address bars. These enhancements enable threat actors, including low-skilled attackers, to deploy highly realistic phishing attacks at scale and bypass multi-factor authentication (MFA) protections. Victims, typically employees of enterprises and large organizations, are tricked into entering credentials and 2FA codes into deceptive portals, facilitating account compromise and potential unauthorized access to sensitive business assets. This incident highlights a troubling trend of phishing toolkits increasing in sophistication, making advanced attacks accessible to broader criminal audiences. Organizations are now facing growing regulatory and operational pressure to update authentication, identity protection, and detection controls amid a wave of phishing leveraging MFA bypass and deceptive visual TTPs.
8 months ago
Kill Chain
North Korean Identity Laundering & IT Worker Scheme Disrupts 136 US Companies – 2024
Between 2019 and 2024, a coordinated North Korean scheme enabled state-backed operatives to access U.S. company systems and launder stolen funds. Facilitated by both domestic and foreign conspirators, including Oleksandr Didenko, Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, and Erick Ntekereze Prince, the operation leveraged stolen and forged American identities to secure remote IT jobs, deploying laptop farms and remote access software to evade detection. The group collectively compromised over 136 U.S. companies, funneled more than $2.2 million to North Korea's regime, and participated in cryptocurrency heists attributed to APT38. The case signals a pronounced jump in sophisticated, identity-driven attacks by nation-state threat actors targeting both the technology sector and U.S. critical infrastructure. As similar TTPs proliferate, the incident underscores the urgent need for robust identity verification, zero trust segmentation, and ongoing monitoring to counter evolving supply chain threats.
8 months ago
Kill Chain
Police Disrupts Global Rhadamanthys, VenomRAT & Elysium Malware Servers in Landmark 2024 Operation
In May 2024, a coordinated international operation involving law enforcement agencies from nine countries dismantled 1,025 servers associated with the Rhadamanthys infostealer, VenomRAT, and Elysium botnet malware operations. The infrastructure takedown was part of Operation Endgame, which targeted malware botnets used to steal data, deliver ransomware, and facilitate cyberattacks globally. By disrupting these networks, authorities severely impaired the threat actors' ability to conduct ongoing credential, financial, and personal data theft campaigns against businesses and individuals across multiple regions. This incident highlights the escalating efforts among global law enforcement to target and disable cybercriminal infrastructure at scale. The takedown reflects a trend towards greater intelligence-sharing and direct action, signaling that even complex, distributed botnet operations can be disrupted through multinational cooperation.
8 months ago
Kill Chain
Operation Endgame 2025: Law Enforcement Disrupts Rhadamanthys, Venom RAT, and Elysium Botnet
Between November 10 and 13, 2025, international law enforcement agencies led by Europol and Eurojust conducted Operation Endgame, a sweeping crackdown targeting malicious cyber infrastructures. The operation succeeded in dismantling key components of the Rhadamanthys Stealer, Venom RAT, and Elysium botnet, disrupting networks that facilitated global credential theft, remote access, and command-and-control activities. The coordinated seizures involved simultaneous server takedowns across multiple countries and the arrest of key individuals behind these malware operations, significantly diminishing the power and reach of these cybercriminal networks. This incident highlights an increasing trend of robust international cooperation in targeting advanced malware and botnet ecosystems. The disruption of these criminal infrastructures sends a strong message to threat actors, demonstrating both the technical capabilities and resolve of law enforcement to combat cybercrime at scale.
8 months ago
Kill Chain
Malicious ‘Safery’ Chrome Extension Steals Ethereum: Anatomy of a 2025 Infostealer Attack
In November 2025, cybersecurity researchers identified a malicious Chrome extension named "Safery: Ethereum Wallet," which masqueraded as a legitimate cryptocurrency management tool but was designed to steal users' Ethereum wallet seed phrases. The extension was covertly uploaded to the Chrome Web Store, targeting unsuspecting cryptocurrency holders by promising enhanced security and flexible settings. After users entered their wallet credentials, the extension exfiltrated sensitive seed phrases via transactions on the Sui blockchain, effectively enabling attackers to compromise and drain user wallets. The incident rapidly gained attention due to its stealthy distribution and use of decentralized channels for data exfiltration. This breach underscores a growing trend of sophisticated infostealers leveraging browser extensions and blockchain-based exfiltration routes to exploit gaps in endpoint and cloud application security. The persistent evolution of phishing and credential theft tactics increases regulatory pressure and demands more robust zero trust and egress policy enforcement across digital ecosystems.
8 months ago
Kill Chain
Google Targets Smishing Triad: 2025 Lawsuit Disrupts Phishing-as-a-Service Operations
In November 2025, Google filed a landmark lawsuit in the Southern District of New York targeting the so-called "Smishing Triad," a China-based phishing-as-a-service group responsible for operating the Lighthouse phishing kit. This kit empowers cybercriminals to impersonate over 400 brands and conduct high-volume SMS attacks, luring victims worldwide into divulging payment information and one-time passcodes. Attackers leveraged the compromised data to enroll payment cards in mobile wallets on Apple and Google devices, allowing them to transact and cash out at scale. Google identified over a million victims in 120 countries, with Smishing Triad operators rotating up to 25,000 phishing domains in an eight-day window. The case highlights an increasing sophistication and industrialization of mobile phishing schemes, where threat actors utilize automation, rapid domain turnover, and collaboration across specialized roles. Legal escalation by a major tech company reflects growing efforts to disrupt cross-border cybercrime ecosystems that evade technical and regulatory countermeasures.
8 months ago
Kill Chain
Coyote & Maverick Banking Trojans: 2024 Banking Attacks Sweep Brazil
In 2024, cybersecurity researchers observed a surge in banking Trojan activity in Brazil, notably from two malware strains named Coyote and Maverick. These Trojans specifically target financial institutions and individual banking customers by using advanced phishing campaigns, malicious email attachments, and fake banking apps to infiltrate devices. Once installed, they deploy credential-stealing modules, monitor browser activity, and intercept authentication data, often leveraging encrypted and east-west network traffic to evade security controls. Maverick is engineered to self-terminate if it detects a target located outside Brazil, indicating a strong geo-targeting component. The campaign’s impact includes stolen banking credentials, financial fraud, and operational disruption for affected users and banks in the region. The continued advancement and targeted nature of these Brazilian banking Trojans demonstrate a significant evolution in threat actor sophistication, especially toward region-specific attacks. Organizations need to heighten their defenses and monitor emerging tactics as financially motivated cybercrime rises across Latin America.
8 months ago
Kill Chain
Operation Endgame 2024: Global Law Enforcement Strikes Down Major Malware Networks
In November 2024, a coalition of law enforcement agencies from 11 countries coordinated Operation Endgame, a major crackdown disrupting some of the most prolific malware networks globally. The operation targeted Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet—malware that collectively infected hundreds of thousands of computers and enabled the theft of millions of credentials. Authorities arrested the principal VenomRAT suspect in Greece, searched 11 sites across Europe, and dismantled more than 1,000 criminal servers and 20 illicit domains. With assistance from 30-plus cybersecurity companies, the operation also notified thousands of victims and exposed users of these illicit services, mitigating ongoing criminal campaigns. Operation Endgame underscores the rapidly evolving, cross-border nature of malware infrastructure and the growing need for coordinated responses by both public and private sectors. As attackers innovate and leverage distributed networks to evade law enforcement, regular collaborative enforcement actions and heightened detection capability are now critical to cybersecurity defenses worldwide.
8 months ago
Kill Chain
DanaBot Returns: Windows Banking Trojan Resurges After Global Takedown
In early 2024, the notorious DanaBot banking Trojan resurfaced after a six-month hiatus following major international law enforcement crackdowns under Operation Endgame in May 2023. This new version targets Windows systems through phishing campaigns, using malicious email attachments to gain initial access. Once deployed, DanaBot leverages modular capabilities for credential theft, lateral movement, and potential data exfiltration, threatening organizations and individuals with financial losses and malware proliferation. The resurgence highlights the continuously evolving tactics of threat actors in the financial malware ecosystem despite decisive takedown efforts. DanaBot's return signals the persistent threat posed by adaptive malware campaigns, with attackers quickly retooling to evade detection and capitalize on lapses in endpoint security. This incident stresses the importance of modern inbound threat detection measures and rapid response to evolving banking malware tactics.
8 months ago
Kill Chain
2025 Microsoft Kernel Zero-Day: Privilege Escalation Risks & Response
In November 2025, Microsoft disclosed and patched 63 security flaws across its platforms, including a Windows Kernel zero-day vulnerability (CVE-2025-XXXX) that was exploited in the wild prior to the update. Attackers leveraged this privilege escalation flaw to gain elevated access on targeted devices, enabling them to bypass security controls, move laterally, and potentially deploy additional malicious payloads. While the majority of these vulnerabilities were rated as important, four—including the actively exploited zero-day—were rated critical, underlining the heightened risk for organizations that were slow to apply updates. The prompt response in releasing patches aimed to minimize further exploitation and potential operational disruptions for Microsoft enterprise customers globally. This incident highlights increasing attacker focus on privilege escalation flaws within widely-used platforms, particularly those with a large installed base like Windows. The ongoing exploitation of zero-days demonstrates the urgency of timely patch management, robust endpoint defenses, and threat detection as adversaries accelerate the weaponization of newly discovered vulnerabilities.
8 months ago
Kill Chain
Fantasy Hub Android Trojan Turns Telegram into a Hotspot for Mobile Hackers
In November 2025, cybersecurity researchers uncovered a new Android remote access trojan (RAT) named Fantasy Hub, distributed via Russian-speaking Telegram channels under a Malware-as-a-Service (MaaS) model. This sophisticated threat enabled cybercriminals to remotely control infected devices, steal sensitive data such as SMS messages, contacts, call logs, images, and videos, and intercept or reply to communications. By leveraging Telegram's anonymity, the operators accelerated widespread infections, targeting individuals and organizations across multiple regions. The attack resulted in extensive data exfiltration, privacy breaches, and elevated risks of further compromise through device-level espionage and lateral movement. The Fantasy Hub incident is particularly notable for exemplifying the growing commoditization of mobile malware and the use of mainstream encrypted messaging apps for criminal operations. Its discovery highlights the urgent need for organizations to enforce robust mobile security, review east-west security policies, and remain vigilant as mobile-focused threats and malware-as-a-service proliferate.
8 months ago
Kill Chain
Maverick Malware Exploits WhatsApp to Target Brazil's Largest Banks
In November 2025, cybersecurity researchers identified a new banking malware called Maverick targeting users in Brazil via malicious WhatsApp messages. Leveraging similarities to the known Coyote strain, Maverick is written in .NET and specifically attacks customers of major Brazilian banks. The malware deceives users into installing it, then hijacks browser sessions, intercepts banking credentials, and enables real-time monitoring of financial transactions to facilitate fraud. This attack underscores the growing sophistication of financially-motivated threats exploiting popular messaging platforms as infection vectors, while leveraging encrypted communications to bypass traditional security controls. This incident is indicative of a rising trend in banking malware that utilizes encrypted and social engineering channels, challenging established security models. It highlights the need for organizations—particularly in financial services—to adopt advanced detection, segmentation, and encrypted traffic monitoring to reduce the impact of evolving threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports