The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Capital Markets/Hedge Fund/Private Equity
Breach intelligence, attack campaigns, and threat reports targeting the Capital Markets/Hedge Fund/Private Equity sector.
Explore Other Sectors
Capital Markets/Hedge Fund/Private Equity Threat Reports
ShinyHunters & Helix Gangs Weaponize Passkey Themes in Microsoft 365 Attacks
Since May 2026, threat actors linked to ShinyHunters, Helix, and other extortion gangs have been conducting sophisticated passkey-themed phishing campaigns targeting corporate Microsoft 365 accounts. The attacks begin with extensive pre-attack reconnaissance, followed by social engineering calls impersonating IT help desks to trick employees into urgently updating passkey or MFA configurations. Victims are directed to adversary-in-the-middle phishing sites or device-code authentication flows, allowing attackers to capture credentials and session tokens. Once inside Microsoft cloud environments, attackers perform systematic reconnaissance using Microsoft Graph APIs, establish persistence through MFA method registration, and conduct automated data exfiltration from SharePoint, OneDrive, and Exchange over periods spanning hours to days while avoiding detection. The attacks demonstrate the evolving threat landscape where modern authentication methods like passkeys are weaponized as social engineering lures, highlighting the critical need for phishing-resistant MFA implementations and enhanced cloud security controls in enterprise environments.
1 week ago
Kill Chain
U.S. Lawmakers Push for Sanctions Against Indian Hack-for-Hire Networks
Bipartisan lawmakers have urged the U.S. Treasury Department to sanction three India-based hack-for-hire groups - Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot - that have conducted over 15 years of targeted espionage against American citizens, businesses, and legal representatives. These cyber mercenary operations have reportedly stolen data from thousands of Americans while operating on behalf of foreign governments including Qatar, targeting critics of Qatar's World Cup bid and even family members of former House Intelligence Chairman Mike Rogers. The groups have also engaged in aggressive legal campaigns to censor media reporting on their activities, effectively allowing foreign entities to suppress information about cyber threats targeting U.S. interests. This incident highlights the growing threat of nation-state sponsored cyber mercenary operations that blur the lines between criminal hacking groups and state-sponsored espionage. As geopolitical tensions increase and digital espionage becomes more commercialized, these hybrid threat actors represent a significant challenge to traditional cybersecurity defenses and diplomatic responses.
2 weeks ago
Kill Chain
JSCeal Malware: Advanced Session Hijacking Bypasses Google Authentication
JSCeal, a sophisticated compiled V8 JavaScript malware, has been actively targeting cryptocurrency traders since late 2024 through malvertising campaigns on Facebook and Google. The malware uses fake TradingView installers distributed via counterfeit trading sites to harvest credentials, steal browser data, and conduct session replay attacks that bypass Google authentication using stolen cookies. Check Point Research revealed that JSCeal employs advanced obfuscation techniques including RC4-protected strings and control-flow flattening, while maintaining surveillance capabilities through keylogging and screenshot capture. The threat actors behind JSCeal, linked to WEEVILPROXY and MeadowLocust clusters, have expanded their operations across 12 countries in 25 languages, primarily targeting Asia Pacific and Latin America regions. This incident highlights the growing sophistication of browser-based malware campaigns that exploit legitimate advertising platforms to distribute advanced credential harvesting tools, representing a significant escalation in session hijacking techniques that can bypass modern authentication mechanisms.
2 weeks ago
Kill Chain
Phantom Deal Campaign Exploits M&A Processes in Sophisticated Enterprise Fraud
The 'Phantom Deal' campaign represents a sophisticated evolution of advance fee scams targeting large enterprises through fake merger and acquisition proposals. Threat actors conducted extensive reconnaissance on companies like Gen (Norton/Avast parent company), impersonating executives via WhatsApp and creating fraudulent documentation from legitimate firms like PwC. The attackers attempted to trick employees into authorizing substantial financial transfers, with one attempt involving €626,735.45, by leveraging detailed corporate intelligence and social engineering tactics that exploited M&A processes and confidentiality requirements. This campaign highlights the growing sophistication of business email compromise attacks as threat actors increasingly target high-value corporate transactions. With M&A activity remaining robust and remote work normalizing digital-only communications, similar social engineering campaigns pose escalating risks to enterprise financial controls and decision-making processes.
2 weeks ago
Kill Chain
Cosmos EVM Vulnerability: How Poor Disclosure Processes Led to $5.7M in Losses
Between August 20-25, 2026, attackers exploited a critical balance-handling flaw (GHSA-7g4w-cg88-2cq2) in the Cosmos EVM module to drain funds from six blockchains, stealing approximately $5.72 million. The vulnerability was initially reported through Cosmos Labs' bug bounty program on April 25, 2026, but was incorrectly assessed as posing no risk to live networks. By August 13, Cosmos Labs confirmed all Cosmos EVM chains were affected regardless of decimal configuration, yet proceeded with a public silent patch process instead of private distribution to affected networks. The flaw allowed attackers to manipulate vesting account balances through unchecked arithmetic operations, causing balance wrapping to approximately 2^256 and enabling unauthorized fund drainage. This incident highlights critical gaps in vulnerability disclosure processes and supply chain security management, particularly relevant as blockchain infrastructure becomes increasingly interconnected and organizations struggle with coordinated security updates across distributed networks.
- Banking/Mortgage
- Capital Markets/Hedge Fund/Private Equity
- Investment Management/Hedge Fund/Private Equity
3 weeks ago
Kill Chain
SafePal Data Breach: Lessons in Securing Third-Party Integrations
In August 2026, SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers. The breach, which occurred between March 2, 2025, and April 11, 2026, exposed customers' names, email addresses, shipping addresses, phone numbers, and purchase information. The company identified an authorization flaw in a third-party order-tracking plugin as the attack vector, allowing unauthorized access to customer order details. While no wallet seed phrases, private keys, or payment information were compromised, the exposed data increases the risk of targeted phishing and social engineering attacks against affected individuals. This incident underscores the critical importance of securing third-party integrations within e-commerce systems, especially for companies handling sensitive customer information. The breach highlights the evolving tactics of cybercriminals targeting the cryptocurrency sector, emphasizing the need for continuous security assessments and robust incident response strategies.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Capital Markets/Hedge Fund/Private Equity
1 month ago
Kill Chain
New macOS Malware Campaign Drains Cryptocurrency Wallets via 'ClickFix' Attacks
In August 2026, a sophisticated macOS malware campaign was identified, leveraging 'ClickFix' social engineering techniques to distribute a Go-based infostealer. This malware targets sensitive user data, including browser-stored passwords, Apple iCloud Keychain data, and cryptocurrency wallets. The attack initiates when users are deceived into executing a command in the Terminal, leading to the download of a shell script that profiles the system and fetches a Mach-O payload compatible with the device's architecture. The payload then exfiltrates the harvested data to a remote server controlled by the attackers. Notably, the malware includes a 'DRAIN' function capable of siphoning funds from various cryptocurrency wallets, such as Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP, by transferring a portion or the entirety of the funds to attacker-controlled accounts. The infrastructure supporting these malicious activities has been traced back to Aeza Group, a Russian bulletproof hosting provider previously sanctioned by the U.S., U.K., and Australia for facilitating cybercriminal operations. This incident underscores the evolving threat landscape targeting macOS users, highlighting the need for heightened vigilance against social engineering tactics and the importance of robust security measures to protect sensitive information and digital assets.
1 month ago
Kill Chain
UNC6671's 2026 Cyberattacks on Hedge Funds: A Wake-Up Call
In August 2026, a series of cyberattacks targeted prominent hedge funds and private-equity firms, including Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel. The attackers, identified as UNC6671 and associated with the BlackFile group, employed sophisticated voice phishing (vishing) techniques to impersonate corporate IT helpdesks. By directing employees to fraudulent login pages, they captured credentials and session cookies, enabling unauthorized access to corporate systems. This breach led to significant data exfiltration and subsequent extortion attempts, with ransom demands reaching up to $3 million, though settlements often averaged around $750,000. This incident underscores a concerning trend in cyber threats, where attackers leverage social engineering to bypass traditional security measures. The financial sector's increasing reliance on cloud-based services and single sign-on (SSO) platforms presents new vulnerabilities, emphasizing the need for enhanced employee training and robust security protocols to mitigate such risks.
1 month ago
Kill Chain
ClickFix Campaign Deploys Go-Based Infostealer on macOS to Steal Cryptocurrency
In August 2026, a sophisticated ClickFix campaign targeted macOS users, deploying a Go-based infostealer designed to exfiltrate sensitive data, including browser-stored passwords, Apple Keychain information, and cryptocurrency assets. The attack initiated through deceptive emails directing users to execute commands in the Terminal, leading to the download of a Bash script that gathered system information and retrieved a Mach-O payload tailored to the victim's processor architecture. The malware established persistence by masquerading as a legitimate macOS process and circumvented security alerts by removing quarantine attributes. Notably, it could intercept and modify cryptocurrency transactions, diverting a configurable percentage of funds to the attacker, affecting assets like Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. This incident underscores the evolving threat landscape where attackers employ advanced social engineering techniques to bypass traditional security measures. The use of Go-based malware highlights a trend towards cross-platform capabilities, increasing the potential reach and impact of such attacks. Organizations must remain vigilant, educating users on the risks of executing unverified commands and enhancing endpoint detection mechanisms to identify and mitigate such sophisticated threats.
- Capital Markets/Hedge Fund/Private Equity
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
1 month ago
Kill Chain
Unitel Cyberattack Disrupts Services Ahead of IPO
On July 28, 2026, Unitel, Angola's leading telecommunications provider, experienced a significant cyberattack targeting its technological infrastructure. Detected at approximately 2:20 AM local time, the attack disrupted voice, mobile data, and internet services nationwide, affecting over 21 million customers. The incident occurred just one day before Unitel's scheduled listing on the Angola Debt and Securities Exchange (BODIVA), following a public offering of a 15% stake in the company. In response, Unitel activated its response and containment mechanisms, mobilizing technical and cybersecurity teams to mitigate the effects and restore services. As of the latest reports, services remain affected, with ongoing efforts to fully stabilize and normalize the network. ([businessday.co.za](https://www.businessday.co.za/world/international-companies/2026-07-28-cyberattack-hits-angolas-unitel-a-day-before-its-listing/?utm_source=openai)) This incident underscores the escalating threat landscape facing critical infrastructure sectors, particularly telecommunications. The timing of the attack, coinciding with Unitel's IPO, highlights the potential for cyber adversaries to exploit significant corporate events. Organizations must prioritize robust cybersecurity measures and incident response strategies to safeguard against such disruptions, especially during pivotal business milestones.
1 month ago
Kill Chain
Coldcard Hardware Wallet Flaw Results in Massive Bitcoin Theft
In July 2026, a critical vulnerability in Coldcard hardware wallets led to the theft of approximately $70.2 million in Bitcoin. The flaw, introduced in a March 2021 firmware update, caused the devices to use a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware random number generator (RNG) for seed generation. This oversight allowed attackers to predict wallet seeds by analyzing device-specific information and prior RNG states, enabling unauthorized access to funds. Coinkite, the manufacturer, released emergency firmware updates on July 31, 2026, but emphasized that updating the firmware does not secure existing seeds. Users were advised to generate new seeds using the patched firmware and transfer their assets accordingly. This incident underscores the critical importance of robust entropy sources in cryptographic systems and highlights the potential risks associated with firmware updates that inadvertently introduce vulnerabilities.
- Investment Banking/Venture
- Investment Management/Hedge Fund/Private Equity
- Capital Markets/Hedge Fund/Private Equity
1 month ago
Kill Chain
DPRK-Linked macOS Malvertising Campaign Targets Cryptocurrency Users
In July 2026, North Korean threat actors launched a sophisticated macOS malvertising campaign targeting cryptocurrency users. The attack involved redirecting victims to fake web pages that displayed full-screen, non-existent update sequences. These deceptive pages prompted users to execute malicious commands via the Terminal app, leading to the installation of malware designed to steal data from 157 cryptocurrency wallets and deploy a malicious Chrome extension. The campaign utilized blockchain-hosted command-and-control (C2) infrastructure, extracting live server addresses from Ethereum smart contracts, a technique known as EtherHiding. This approach enhances the malware's resilience against takedown efforts. This incident underscores the evolving tactics of state-sponsored cyber actors, particularly in leveraging advanced social engineering and blockchain technologies to target the cryptocurrency sector. The use of EtherHiding and sophisticated malvertising techniques highlights the need for heightened vigilance and robust security measures among macOS users and cryptocurrency stakeholders.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports