Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Banking/Mortgage

Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.

625 threat reports
Page 5 of 53
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Banking/Mortgage Threat Reports

Showing 49–60 / 625 reports
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Banking/Mortgage1 month ago

Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks

In September 2026, Ukraine's CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute LunexStealer malware through fake Cloudflare verification pages. The UAC-0277 threat cluster used ClickFix techniques and EtherHiding methods to selectively target Windows users arriving from search engines, delivering MSI packages that install sophisticated information-stealing capabilities including the LUNARAXE browser extension and NAIVEMESS file system access component. This campaign represents the growing sophistication of social engineering attacks that exploit trusted security interfaces like Cloudflare to bypass user suspicion and deliver advanced persistent threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
Financial Services1 month ago

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Enterprise AI deployments are creating unprecedented attack surfaces that extend far beyond the AI model itself, encompassing the entire application stack including tools, data pipelines, APIs, identity systems, and cloud infrastructure. Unlike traditional applications with predictable logic, AI systems introduce probabilistic behavior and natural language processing that can be manipulated through prompt injection attacks to execute unauthorized actions across internal systems. These attacks can chain together to compromise service accounts, bypass tenant isolation, and expose sensitive data across multiple customer environments. The integration of AI into core business workflows has fundamentally altered the enterprise security landscape, requiring organizations to rethink their approach to threat modeling and security testing. Current security practices that focus solely on model safety or traditional application security miss critical vulnerabilities in the interconnected AI ecosystem, leaving organizations exposed to sophisticated attack chains that can traverse from user-facing chatbots to critical backend infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control
PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control
Information Technology/IT1 month ago

PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control

Since April 2024, the PoeLLM malware has compromised over 3,400 servers by exploiting AI services and using an innovative command-and-control mechanism hidden within a poem posted on GitHub. The threat actor, believed to be Italian-speaking, uses four specific words from the poem that map to IP addresses through a hard-coded dictionary, allowing dynamic C2 infrastructure changes without updating the malware itself. This botnet primarily focuses on cryptocurrency mining and exploit scanning while creating a network of AI-enabled proxies for potential downstream attacks. The technique demonstrates how threat actors are adapting to exploit the growing AI infrastructure landscape while using creative obfuscation methods to evade detection. The GitHub poem approach represents a new evolution in C2 resilience, as the infrastructure remains invisible to network monitoring tools unless the malware code is directly analyzed, highlighting the increasing sophistication of botnet operators.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign
Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign
Banking/Mortgage1 month ago

Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign

The U.S. Department of Justice arrested Anibal Alexander Canelon Aguirre, alleged developer of Ploutus ATM malware and leader of a criminal organization linked to the Tren de Aragua Venezuelan gang. Between February 2024 and December 2025, Canelon Aguirre and accomplices conducted jackpotting attacks against ATMs across 47 states, stealing over $5.4 million from 63 bank ATMs and 54 credit union machines. The sophisticated malware included anti-analysis features and self-deletion capabilities to evade detection. Financial losses exceeded $100,000 per incident, with stolen funds laundered and transferred to TdA accounts internationally. This case represents the largest coordinated ATM jackpotting campaign in U.S. history, highlighting the growing sophistication of transnational cybercrime organizations and their ability to monetize physical infrastructure attacks at scale across multiple jurisdictions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
Banking/Mortgage1 month ago

AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything

In October 2026, South Korea's Financial Services Commission launched emergency investigations after AI-powered cyberattacks targeted multiple major financial institutions. Shinhan Bank suffered a breach affecting 25,000 customers, while Kookmin Bank lost credit card information for 119,000 clients, and Hana Bank experienced a limited compromise of its sales-support system. Evidence suggests attackers used ARTEX AI, an open-source penetration testing framework that automates vulnerability discovery and attack-path planning, marking one of the first confirmed uses of AI agents in large-scale financial sector breaches. This incident represents a critical inflection point as threat actors begin weaponizing AI automation tools for sophisticated attacks against high-value targets. The use of autonomous AI agents for reconnaissance and exploitation signals a new era of accelerated, intelligent cyber warfare that traditional security controls struggle to counter.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
The AI Attack Revolution: How Machine-Speed Threats Are Redefining Cybersecurity
The AI Attack Revolution: How Machine-Speed Threats Are Redefining Cybersecurity
Financial Services1 month ago

The AI Attack Revolution: How Machine-Speed Threats Are Redefining Cybersecurity

AI-powered cyberattacks are fundamentally transforming the threat landscape, with attackers leveraging large language models to dramatically accelerate vulnerability exploitation from weeks to mere hours. The 2026 Black Hat USA conference highlighted how threat actors are using AI automation to create relentless attack campaigns that operate at machine speed, never requiring rest or breaks like human adversaries. Organizations are struggling to keep pace as AI enables rapid patch analysis, automated exploitation development, and comprehensive attack surface mapping that traditionally took weeks to complete. The Hugging Face breach demonstrated how AI agents can compress familiar attack timelines while maintaining sophisticated tactics, forcing security teams to fundamentally rethink their defensive strategies and response capabilities. This shift represents a critical inflection point in cybersecurity, as 85% of organizations are increasing offensive security spending to combat AI-enhanced threats, while only 25% maintain complete visibility into their attack surfaces in real-time.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
Banking/Mortgage1 month ago

RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats

RemoteThreat, a new offensive cybersecurity startup founded by Chris Thompson and Shawn Jones, emerged from stealth in 2025 with $7 million in pre-seed funding to revolutionize red team penetration testing. The platform leverages AI to help organizations test their defenses against increasingly sophisticated threats, moving beyond traditional three-week assessment models to provide scalable, real-time security validation. RemoteThreat builds custom tooling from scratch for each engagement, bypassing Tier 1 EDR solutions to simulate how nation-state actors and advanced ransomware groups operate in real environments. This development reflects the urgent evolution of offensive security testing as frontier AI models enable both defenders and attackers to operate at unprecedented speed and sophistication, fundamentally changing how organizations must approach cybersecurity validation.

Threat report

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign
Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign
Banking/Mortgage1 month ago

Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign

The U.S. Treasury Department sanctioned eight members of Venezuelan gang Tren de Aragua in October 2026 for their role in sophisticated ATM jackpotting attacks that have stolen $40.73 million from U.S. financial institutions across over 1,500 incidents. Led by Anibal Alexander Canelon Aguirre ("Prometheus"), the criminal network deployed malware including Ploutus, ATMii, and GreenDispenser to force ATMs to dispense cash, then laundered proceeds through cryptocurrency addresses receiving $6.1 million in total inflows. The Treasury also designated seven TRON blockchain addresses linked to the operation, highlighting the gang's use of cryptocurrency for money laundering. This incident demonstrates the evolving threat landscape where traditional organized crime groups increasingly leverage sophisticated malware and cryptocurrency infrastructure to target critical financial infrastructure, requiring enhanced egress security controls and blockchain transaction monitoring.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Banking/Mortgage1 month ago

Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure

In October 2026, researchers discovered a critical vulnerability (CVE-2026-18397) in Thales Group's SConnect browser extension, a hardware authentication middleware used by over 1 million users to access highly sensitive government and financial systems including SWIFT banking networks. The vulnerability allows attackers to perform drive-by remote code execution attacks in 6-10 seconds through malicious websites or iframes, bypassing cryptographic security checks due to improper RSA signature validation and buffer handling. The flaw enabled attackers to load malicious DLLs and achieve complete system compromise on systems used for global financial transfers and government operations. This incident highlights the growing risks in authentication middleware as organizations increasingly rely on hardware-based MFA for critical infrastructure. With SConnect reaching end-of-life status and the emergence of AI-assisted exploit development, legacy authentication systems face unprecedented threats that could impact global financial stability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls
Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls
Banking/Mortgage1 month ago

Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls

Google announced new security measures in Android 17 that restrict AccessibilityService API access to verified applications when Advanced Protection is enabled, addressing widespread abuse by banking trojans and spyware. The Android AccessibilityService API, designed to assist users with disabilities, has been exploited by malicious actors to perform unauthorized fund transfers, log keystrokes, and steal sensitive data without requiring root access. This restriction represents a significant security enhancement alongside other Android 17 features including intrusion logging, USB protection, and enhanced authentication controls. This development highlights the ongoing evolution of mobile security threats where legitimate accessibility features become weaponized attack vectors. As financial malware and sophisticated spyware increasingly target mobile platforms, platform-level security controls become critical for protecting users from social engineering attacks that abuse system-level permissions.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AI Transforms Cyber Warfare: October 2026 Multi-Vector Campaign Analysis
AI Transforms Cyber Warfare: October 2026 Multi-Vector Campaign Analysis
Banking/Mortgage1 month ago

AI Transforms Cyber Warfare: October 2026 Multi-Vector Campaign Analysis

In October 2026, multiple sophisticated cybersecurity incidents demonstrated how AI is fundamentally reshaping threat landscapes. Key incidents included AI-powered zero-day chaining attacks against the Dutch Institute for Vulnerability Disclosure (DIVD) using Zammad vulnerabilities CVE-2026-102489 and CVE-2026-102490, enabling automated root access within seconds. Additional campaigns involved Tren de Aragua's $40.73 million ATM jackpotting operation, cache key injection vulnerabilities enabling web cache poisoning, and the exposure of 543,699 valid credentials in GitHub repositories despite existing security measures. These incidents highlight the accelerating threat environment where AI tools are lowering attack barriers while simultaneously increasing vulnerability discovery rates. Google's Threat Intelligence Group reported vulnerability disclosures doubled from 5,045 to over 10,000 monthly, with AI-assisted approaches finding proportionally more high-risk flaws leading to remote code execution.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Financial Services1 month ago

Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities

In September 2026, cryptocurrency exchange Bitget suffered a devastating $387.5 million theft when North Korean threat actors exploited a zero-day vulnerability in third-party security products. The attackers gained access to high-level internal credentials through compromised security appliances, beginning their infiltration as early as August 31, 2026. Using a customized tool specifically designed for Bitget's wallet system, the threat actors executed unauthorized withdrawals across 11 blockchains, bypassing existing risk controls and affecting assets including XRP, ETH, USDT, and others. This incident highlights the growing sophistication of supply chain attacks targeting cryptocurrency exchanges, with North Korean APT groups increasingly exploiting third-party vendor vulnerabilities to access high-value targets. The attack demonstrates the critical need for enhanced vendor risk management and zero-trust architectures as cryptocurrency platforms become prime targets for nation-state actors seeking to fund illicit activities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports