✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
ACR Stealer 2026: Unveiling the ClickFix Intrusion Chains
Between late April and mid-June 2026, Microsoft Defender Experts observed a surge in ACR Stealer activity targeting enterprise environments. Attackers employed 'ClickFix' social engineering tactics to deceive users into executing malicious commands, leading to the theft of browser credentials, authentication tokens, and sensitive documents. The campaigns utilized two primary intrusion chains: one leveraging WebDAV for payload delivery with Python-based loaders and blockchain-backed command-and-control mechanisms, and another employing MSHTA-initiated PowerShell scripts with steganographic techniques for in-memory payload execution. These sophisticated methods enabled attackers to evade detection and maintain persistence within compromised systems. The significance of this incident lies in the advanced techniques used to bypass traditional security measures, highlighting the evolving nature of cyber threats. Organizations must remain vigilant against such deceptive tactics and enhance their security protocols to detect and mitigate similar attacks effectively.
1 week ago
Kill Chain
AI-Driven Cyberattacks: Key Insights from Unit 42's 2026 Report
In 2025, Unit 42 responded to over 750 major cyber incidents across various industries and countries. The 2026 Global Incident Response Report highlights that adversaries are leveraging AI to accelerate attack timelines, with data exfiltration occurring up to four times faster than in previous years. Identity weaknesses were exploited in nearly 90% of investigations, and 87% of intrusions involved multiple attack surfaces, including endpoints, networks, cloud services, SaaS platforms, and identity systems. ([paloaltonetworks.com](https://www.paloaltonetworks.com/blog/2026/02/unit-42-global-ir-report/?utm_source=openai)) This trend underscores the urgent need for organizations to enhance their cybersecurity posture by addressing identity vulnerabilities, improving visibility across attack surfaces, and implementing AI-driven defense mechanisms to counteract the speed and complexity of modern cyber threats.
1 week ago
Kill Chain
Indictment of Russian Nationals for Bulletproof Hosting Services Facilitating Cyberattacks
In July 2026, U.S. federal prosecutors unsealed an indictment against three Russian nationals—Alexander Alexandrovich Volosovik, Yulia Vladimirovna Pankova, and Kirill Andreevich Zatolokin—accusing them of operating bulletproof hosting services through their companies, Media Land and ML.Cloud. These services allegedly facilitated cyberattacks on critical infrastructure across 21 U.S. states and several countries, resulting in over $62 million in damages. The indictment details how the accused provided infrastructure and technical support to cybercriminals, enabling malware distribution, ransomware attacks, and other illicit activities. ([cyberscoop.com](https://cyberscoop.com/russian-nationals-medialand-mlcloud-indicted-bulletproof-hosting/?utm_source=openai)) This case underscores the persistent threat posed by bulletproof hosting providers, which offer cybercriminals resilient infrastructure to conduct attacks with impunity. The indictment highlights the necessity for international cooperation in dismantling such networks and protecting critical infrastructure from cyber threats. ([cyberscoop.com](https://cyberscoop.com/russian-nationals-medialand-mlcloud-indicted-bulletproof-hosting/?utm_source=openai))
1 week ago
Kill Chain
Scattered Spider's 2024 Cyberattack on Transport for London: A Case Study
Between August 31 and September 3, 2024, the cybercriminal group Scattered Spider executed a sophisticated cyberattack on Transport for London (TfL). Utilizing social engineering techniques, they infiltrated TfL's network, leading to significant disruptions in technical services, including the Oyster payment system and third-party APIs. The attack necessitated a mass password reset for all 28,000 TfL employees and resulted in financial losses estimated at £29 million. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/cyber-criminals-who-hacked-into-transport-for-londons-computer-network-are-convicted?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups employing advanced social engineering tactics to target critical infrastructure. Organizations must enhance their cybersecurity measures, particularly in employee training and network security protocols, to mitigate such risks.
1 week ago
Kill Chain
Spirals Ransomware Attack on South Asian IT Firm in June 2026
In June 2026, an IT services firm in South Asia fell victim to a rapid and sophisticated ransomware attack orchestrated by a previously unknown group deploying the 'Spirals' ransomware. The attackers gained initial access through a publicly exposed Internet Information Services (IIS) server, where they uploaded an ASP.NET web shell. Within a three-hour window, they established persistent access, disabled security software, extracted credentials, and moved laterally across the network. Less than 24 hours after the initial breach, the Spirals ransomware was deployed, encrypting files and exfiltrating sensitive data. The attackers threatened to publish the stolen data within six days unless a ransom was paid. This incident underscores the evolving threat landscape, where cybercriminals are executing attacks with unprecedented speed and efficiency. Organizations must reassess their security postures, particularly concerning publicly accessible services and rapid response capabilities, to mitigate such swift and damaging intrusions.
1 week ago
Kill Chain
Russian Hackers Exploit WebEx and Zoom Installers to Deploy Starland RAT
In June 2025, the Russian threat actor UAT-11795 initiated a campaign targeting users primarily in the United States, with additional victims in Germany, Romania, and Venezuela. The attackers distributed trojanized installers of legitimate software, including WebEx and Zoom, to deploy the Starland RAT malware. This backdoor enabled the exfiltration of browser data, cryptocurrency wallet assets, system details, and Active Directory information. The malware also facilitated remote command execution, screenshot capture, and the deployment of additional payloads such as CastleStealer and Remcos RAT. This incident underscores the increasing sophistication of supply chain attacks, where trusted software is weaponized to infiltrate systems. The use of trojanized installers highlights the critical need for organizations to enforce strict software sourcing policies and to educate users on the risks of downloading software from unofficial sources.
1 week ago
Kill Chain
Urgent: CISA Mandates Patching of Critical Oracle EBS Vulnerability Amid Active Exploitation
In May 2026, Oracle disclosed a critical vulnerability (CVE-2026-46817) in the File Transmission component of its E-Business Suite's Oracle Payments module, affecting versions 12.2.3 through 12.2.15. This flaw allows unauthenticated attackers with HTTP network access to fully compromise the Oracle Payments system. Despite the release of a security patch, by late June 2026, threat intelligence firm Defused observed active exploitation of this vulnerability in the wild. Consequently, on July 15, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46817 to its Known Exploited Vulnerabilities Catalog and mandated federal agencies to apply the patch by July 18, 2026. This incident underscores the critical importance of timely patch management, especially for vulnerabilities with high CVSS scores and active exploitation. Organizations are urged to assess their exposure to CVE-2026-46817 and ensure that all affected systems are promptly updated to mitigate potential risks.
1 week ago
Kill Chain
OkoBot Malware: A New Threat to Cryptocurrency Security
In July 2026, cybersecurity researchers identified OkoBot, a sophisticated malware framework comprising over 20 modules designed to steal cryptocurrency wallet seed phrases, credentials, and other sensitive data. OkoBot infiltrates systems through deceptive ClickFix attacks and malicious GitHub repositories masquerading as legitimate software tools. Once installed, it deploys various payloads, including browser injectors and keyloggers, to harvest user information and monitor activities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/?utm_source=openai)) The emergence of OkoBot underscores a growing trend of targeted attacks on cryptocurrency users, highlighting the need for enhanced vigilance and robust security measures within the crypto community. As the malware continues to evolve, staying informed about such threats is crucial for safeguarding digital assets.
1 week ago
Kill Chain
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In July 2026, a critical vulnerability was discovered in Anthropic's Claude for Chrome browser extension. This flaw allowed malicious extensions to simulate user interactions, triggering predefined AI actions without user consent. Exploiting this, attackers could access connected services such as Gmail, Google Docs, Google Calendar, and Salesforce, leading to unauthorized data access and potential data exfiltration. The vulnerability stemmed from the extension's failure to verify the origin of click events, accepting synthetic events generated by other extensions as legitimate user actions. This incident underscores the growing risks associated with browser extensions and their integration with AI-powered services. As organizations increasingly adopt such tools to enhance productivity, ensuring robust security measures and thorough validation of user interactions becomes imperative to prevent unauthorized access and data breaches.
1 week ago
Kill Chain
ClickLock: The New macOS Malware Exploiting User Trust
In July 2026, cybersecurity researchers identified a new macOS malware named ClickLock, which employs social engineering tactics to deceive users into revealing their system login passwords. The malware initiates by presenting a fake Cloudflare 'human verification' prompt, leading users to execute a command in the Terminal. This action triggers the download of malicious modules that disable keyboard interrupts and suppress system notifications. Subsequently, ClickLock displays a counterfeit macOS password dialog, coercing users into entering their credentials. Upon obtaining the password, the malware exfiltrates sensitive data, including login credentials, cryptocurrency assets, and browser information, to the attackers via Telegram. Additionally, it installs a persistent backdoor, granting ongoing remote access to the compromised systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/?utm_source=openai)) The emergence of ClickLock underscores a growing trend in macOS-targeted malware leveraging sophisticated social engineering techniques. This incident highlights the necessity for heightened user awareness and the implementation of robust security measures to counteract such deceptive attacks.
1 week ago
Kill Chain
Scattered Spider Hackers Sentenced for 2024 TfL Cyberattack
Between August 31 and September 3, 2024, Transport for London (TfL) experienced a significant cyberattack orchestrated by the Scattered Spider hacking group. The attackers, Thalha Jubair and Owen Flowers, exploited social engineering techniques to infiltrate TfL's network, leading to the compromise of personal data belonging to approximately 10 million customers. The breach resulted in substantial operational disruptions, including the inoperability of 148 systems and the necessity for all 27,000 employees to reset their passwords in person. The financial impact was severe, with losses and recovery costs totaling £29 million. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/cyber-criminals-who-hacked-into-transport-for-londons-computer-network-are-convicted?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cybercriminal groups employing advanced social engineering tactics. Organizations must prioritize robust cybersecurity measures, including comprehensive employee training and the implementation of phishing-resistant multi-factor authentication, to mitigate the risks associated with such attacks.
1 week ago
Kill Chain
Outdated UEFI Bootloaders Pose Security Risks
In July 2026, researchers identified 11 outdated UEFI shim bootloaders, all signed by Microsoft, that remained trusted components within the Secure Boot framework. These bootloaders, versions 0.9 and earlier, lacked modern security protections and could be exploited by attackers to bypass Secure Boot, allowing the execution of malicious code during the boot process and establishing persistent access below the operating system level. Microsoft addressed the issue by revoking these vulnerable bootloaders in June 2026 through Secure Boot revocation updates. However, systems that have not applied these updates remain susceptible to boot-level attacks, as the revoked shims continue to be trusted on unpatched machines. This incident underscores the critical importance of timely firmware updates and the need for organizations to maintain vigilance over the security of their boot processes to prevent potential exploits.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports