The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Hackers Deploy 'khunt' Toolkit via SQL Injection in Oracle Database
In July 2026, attackers exploited a SQL injection vulnerability in a public-facing Java application running Apache Tomcat to gain unauthorized access to an Oracle database. They installed the 'khunt' post-exploitation toolkit directly within the database as a Java object, enabling them to execute system commands, steal credentials, and manage files. This method allowed the attackers to operate with SYSTEM-level permissions on the Windows server hosting the database, facilitating potential data exfiltration and further network compromise. This incident underscores the critical need for organizations to sanitize all user-supplied input and restrict database account privileges, especially in public-facing applications. The use of embedded Java Virtual Machines within databases as a vector for post-exploitation activities highlights an emerging threat landscape that security teams must address proactively.
1 month ago
Kill Chain
Snowflake Data Breach 2024: A Wake-Up Call for Cloud Security
Between February and October 2024, cybercriminals exploited stolen credentials to access Snowflake customer accounts lacking multi-factor authentication (MFA). This led to unauthorized access to sensitive data from at least 165 organizations, including AT&T, Ticketmaster, and Santander. The attackers, notably Connor Riley Moucka and John Erin Binns, utilized infostealer malware to harvest login information, resulting in the theft of terabytes of data and extortion of millions of dollars from affected companies. The incident underscores the critical importance of implementing robust security measures, such as MFA, to protect cloud-based data. As cloud services become increasingly integral to business operations, organizations must prioritize stringent access controls and continuous monitoring to mitigate the risk of similar breaches.
1 month ago
Kill Chain
Cybercriminals Exploit Cloud Platforms for Phishing in 2026
In 2026, threat actors increasingly exploited legitimate cloud services to host phishing sites, leveraging platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This approach allowed attackers to bypass traditional security measures, as phishing pages hosted on reputable domains appeared trustworthy to victims. The use of these platforms enabled the rapid deployment of multi-stage adversary-in-the-middle (AitM) attacks, effectively capturing multi-factor authentication (MFA) sessions and compromising user accounts. This trend underscores a significant shift in cybercriminal tactics, highlighting the need for enhanced detection mechanisms that go beyond domain reputation. The widespread abuse of trusted cloud services for phishing campaigns necessitates a reevaluation of current security strategies to effectively counteract these sophisticated threats.
1 month ago
Kill Chain
COLDCARD Wallet RNG Flaw Results in Massive Bitcoin Theft
In late July 2026, a critical vulnerability in COLDCARD hardware wallets was exploited, leading to the theft of approximately $88.6 million in Bitcoin from thousands of users. The flaw, identified in the wallet's random number generator (RNG), resulted in predictable seed phrases, allowing attackers to reconstruct private keys and access funds. The attack unfolded in multiple waves, with the first occurring on July 30, 2026, draining over 1,083 BTC from 1,196 addresses within 41 minutes. Subsequent waves increased the total to 1,367 BTC stolen from 4,585 addresses. The attackers prioritized high-value wallets, with one victim losing $1.8 million. This incident underscores the critical importance of secure RNG implementations in cryptocurrency hardware wallets. The exploitation of deterministic RNGs highlights a significant vulnerability, emphasizing the need for rigorous security audits and prompt firmware updates to protect digital assets.
1 month ago
Kill Chain
Researchers Uncover 84 Critical Flaws in 4G and 5G Core Networks
In July 2026, researchers from Singapore's Nanyang Technological University disclosed 84 security vulnerabilities in 4G and 5G core networks, collectively termed implicit trust errors (iTrue). These flaws, found in open-source LTE/5G core implementations, stem from unchecked trust between core network functions, enabling attackers to execute denial-of-service (DoS) attacks and session hijacking by exploiting signaling interfaces like GTP-C and PFCP. The vulnerabilities affect widely used open-source LTE/5G cores, including Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF. The study highlights the risks associated with cloud-native deployments, where traditional physical isolation is replaced by software-defined architectures, increasing the attack surface. The researchers developed an LLM-assisted system, iFinder, to identify these vulnerabilities, emphasizing the need for rigorous validation and resource checks in core network components to prevent such exploits.
1 month ago
Kill Chain
Unveiling the 'Flying Eagle' Mobile RAT Threat in China - 2026
In July 2026, Chinese cybercriminals utilized the 'Flying Eagle' malware-as-a-service (MaaS) platform to distribute sophisticated mobile Remote Access Trojans (RATs). These RATs were embedded in counterfeit applications mimicking legitimate services, leading to widespread financial data theft and unauthorized access to sensitive user information. The campaign's scale and the advanced capabilities of the malware underscore a significant escalation in mobile cyber threats. This incident highlights the growing trend of MaaS platforms enabling less skilled threat actors to execute complex attacks, increasing the frequency and sophistication of mobile malware campaigns. Organizations must enhance their mobile security measures and user education to mitigate these evolving threats.
1 month ago
Kill Chain
Southeast Asian Cybercriminal Syndicates' Global Expansion in 2025
In 2025, Southeast Asian cybercriminal syndicates evolved into sophisticated transnational networks, leveraging advanced technologies such as artificial intelligence, encrypted messaging platforms, and cryptocurrencies to conduct large-scale cyber-enabled fraud. These operations resulted in estimated losses between $88.3 billion and $114.1 billion across East Asia, Southeast Asia, Australia, and New Zealand. The syndicates' activities encompassed a range of illicit markets, including human trafficking, drug smuggling, and illegal online gambling, facilitated by a shared financial and operational infrastructure. ([jurist.org](https://www.jurist.org/news/2026/07/un-report-exposes-explosive-growth-of-southeast-asian-crime-syndicates/?utm_source=openai)) The rapid expansion and technological advancement of these criminal networks underscore the urgent need for enhanced international cooperation and adaptive law enforcement strategies. Their ability to exploit emerging technologies and jurisdictional loopholes poses a significant threat to global economic stability and security. ([breitbart.com](https://www.breitbart.com/crime/2026/07/22/u-n-report-transnational-gangs-use-drugs-cybercrime-and-slavery-to-loot-southeast-asia/amp/?utm_source=openai))
1 month ago
Kill Chain
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts
In July 2026, South Korean authorities and security firms disclosed a state-sponsored campaign that compromised trusted domestic websites to exploit vulnerabilities in the financial-security software AnySign4PC. Attackers used these sites to deliver SIGNBT or COPPERHEDGE backdoors to visitors without prompts or user-initiated downloads. The Korea Internet & Security Agency (KISA) identified AnySign4PC versions 1.1.4.4 through 1.1.4.6 as vulnerable, recommending an upgrade to version 1.1.5.0. AhnLab reported related attacks at 72 organizations and identified 15 legitimate websites used as watering holes, with overlaps to previous Gunra ransomware attacks. This incident underscores the persistent threat of supply chain attacks targeting widely used software. Organizations must remain vigilant, ensuring timely updates and monitoring for unauthorized access to prevent similar exploits.
1 month ago
Kill Chain
Ghanaian National Sentenced for $10M Romance Scam
In July 2026, Derrick Van Yeboah, a 41-year-old Ghanaian national, was sentenced to 85 months in prison for orchestrating romance scams that defrauded victims of over $10 million. Operating from February 2015 to October 2024, Van Yeboah impersonated romantic partners online, targeting primarily older and vulnerable individuals. He was a high-ranking member of a Ghana-based criminal organization responsible for stealing more than $100 million through romance scams and business email compromises. This case underscores the persistent threat of online romance scams, which exploit individuals' trust and emotional vulnerabilities. The substantial financial losses and emotional devastation experienced by victims highlight the need for increased awareness and vigilance in online interactions.
1 month ago
Kill Chain
Flying Eagle Android RAT Source Code Leak Exposes 170 Servers
In July 2026, security researchers discovered that the source code for the Flying Eagle Android Remote Access Trojan (RAT) had been leaked and was circulating in criminal Telegram channels. This leak led to the identification of 170 servers hosting control panels and certificates associated with the malware. The Flying Eagle RAT was distributed through a counterfeit '公安一网通办' Public Security service application targeting Android users in China. Once installed, the malware granted attackers extensive control over infected devices, enabling unauthorized access to sensitive information and potential financial theft. The proliferation of the Flying Eagle RAT underscores a growing trend of sophisticated Android malware campaigns leveraging social engineering tactics and exploiting trust in official-looking applications. This incident highlights the critical need for robust mobile security measures and user education to prevent similar attacks in the future.
1 month ago
Kill Chain
Claude AI Uncovers Critical Cryptographic Vulnerabilities
In July 2026, Anthropic's Claude Mythos AI identified significant vulnerabilities in cryptographic algorithms. The AI discovered an end-to-end key-recovery attack against HAWK-256, a post-quantum digital signature scheme, by exploiting a previously unused symmetry in its lattice structure. This attack reduced the expected work factor from 2^64 to 2^38 operations, effectively halving the scheme's key strength. Additionally, Claude Mythos achieved a 200- to 800-fold speedup in attacking a seven-round version of AES-128 by eliminating a 256-way guessing step in an existing meet-in-the-middle attack. These findings were confirmed by external cryptographers and shared with the U.S. government and tech partners prior to public disclosure. These discoveries underscore the growing capability of AI in identifying cryptographic weaknesses that have eluded human experts for years. While current full-strength AES-128 remains secure, the rapid advancement of AI in cryptanalysis suggests a need to reassess and strengthen existing encryption standards to preempt potential future vulnerabilities.
1 month ago
Kill Chain
Over 24,000 BMC Interfaces Expose IPMI Password Hashes: A Critical Security Alert
In July 2026, cybersecurity researchers identified over 36,000 Baseboard Management Controller (BMC) interfaces exposing the Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of these, 24,650 interfaces disclosed password-derived authentication hashes before login due to a vulnerability inherent in the IPMI v2.0 specification (CVE-2013-4786). This flaw allows remote attackers to obtain password hashes and conduct offline password guessing attacks, potentially compromising server management systems. The widespread exposure of BMCs with default or weak passwords, especially in modern AI data centers hosting multiple tenants, underscores a significant security risk. Attackers exploiting this vulnerability can gain persistent access, bypass traditional security controls, and threaten the integrity of shared infrastructure, highlighting the urgent need for enhanced security measures in server management protocols.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports