✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Anthropic's Claude Mythos AI Uncovers Thousands of Zero-Day Vulnerabilities
In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos Preview, which autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. Notably, the model discovered a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg's H.264 codec. Due to the potential risks associated with these findings, Anthropic restricted access to the model, collaborating with over 50 organizations, including tech giants like Amazon, Google, and Microsoft, under Project Glasswing to address and patch these vulnerabilities. This incident underscores the dual-edged nature of AI in cybersecurity, highlighting its potential to both uncover and exploit critical software flaws. The rapid advancements in AI capabilities necessitate a reevaluation of security protocols and the development of robust safeguards to prevent misuse. Organizations must stay vigilant and adapt to the evolving threat landscape shaped by AI-driven tools.
3 months ago
Kill Chain
FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts
In April 2026, the FBI Atlanta Field Office, in collaboration with the Indonesian National Police, dismantled a sophisticated global phishing operation centered around the W3LL phishing kit. This toolkit enabled cybercriminals to create counterfeit login pages, deceiving victims into divulging their credentials. Priced at approximately $500, the kit facilitated the theft of thousands of account credentials and was linked to over $20 million in attempted fraud. Authorities detained the alleged developer, identified as G.L., and seized key domains associated with the operation. The W3LL phishing kit was a comprehensive cybercrime platform that allowed criminals to impersonate legitimate login pages, capturing usernames, passwords, and session data. This capability enabled attackers to bypass multi-factor authentication and maintain unauthorized access to accounts. The operation also included an online marketplace, W3LLSTORE, which facilitated the sale of over 25,000 compromised accounts between 2019 and 2023. Even after W3LLSTORE's shutdown in 2023, the phishing activities continued through encrypted messaging platforms, targeting more than 17,000 victims worldwide between 2023 and 2024.
3 months ago
Kill Chain
JanelaRAT Malware: A Growing Threat to Latin American Banks in 2025
In 2025, Latin American financial institutions, particularly in Brazil and Mexico, faced a significant surge in cyber threats, notably from the JanelaRAT malware. This sophisticated malware, a modified variant of the BX RAT trojan, was designed to steal financial and cryptocurrency data by capturing window titles, tracking mouse inputs, logging keystrokes, taking screenshots, and collecting system metadata. The attackers employed DLL side-loading techniques to evade detection, leveraging legitimate executables to load the malicious payload. The campaign's focus on Latin American banks underscores the region's growing vulnerability to targeted cyber attacks. ([thehackernews.com](https://thehackernews.com/2023/08/new-financial-malware-janelarat-targets.html?utm_source=openai)) The rise of JanelaRAT coincided with a broader increase in cyber threats across Latin America. Reports indicated a 155% increase in social engineering scams and a 225% rise in malware attacks in 2025. ([biocatch.com](https://www.biocatch.com/press-release/latin-american-banks-see-155-increase-in-scam-attempts?hs_amp=true&utm_source=openai)) This trend highlights the evolving tactics of cybercriminals who are increasingly targeting financial institutions in the region, emphasizing the urgent need for enhanced cybersecurity measures and cross-institution collaboration to mitigate these threats.
3 months ago
Kill Chain
Lumma Stealer Disruption: A Landmark Victory Against Infostealer Malware
In May 2025, a coordinated effort by the U.S. Department of Justice and Microsoft led to the disruption of Lumma Stealer, a prolific infostealer malware operating under a malware-as-a-service model since late 2022. Lumma Stealer was responsible for exfiltrating sensitive data, including browser credentials and cryptocurrency wallets, from numerous organizations worldwide. The takedown involved seizing over 2,300 malicious domains and dismantling the malware's command-and-control infrastructure, significantly hindering its operations. ([malwarebytes.com](https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted?utm_source=openai)) This disruption underscores the growing threat posed by infostealer malware and highlights the importance of collaborative efforts between law enforcement and private sector entities in combating cybercrime. Organizations are urged to enhance their cybersecurity measures to protect against similar threats, as the infostealer landscape continues to evolve with new variants and distribution methods. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/?msockid=3d81ed128ed2696826fafba28f5168a7&utm_source=openai))
3 months ago
Kill Chain
SentinelOne's AI EDR Thwarts Zero-Day Supply Chain Attack Involving Anthropic's Claude AI
In March 2026, SentinelOne's AI-driven Endpoint Detection and Response (EDR) system autonomously identified and halted a zero-day supply chain attack involving a trojanized version of LiteLLM, a widely used proxy for LLM API calls. The compromised package, updated by Anthropic's Claude AI coding assistant without human intervention, attempted to execute malicious Python code across multiple customer environments. SentinelOne's Singularity Platform detected and blocked the payload before execution, preventing data theft, persistence, Kubernetes lateral movement, and encrypted exfiltration within hours of the attack's initiation. This incident underscores the escalating sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. The rapid detection and mitigation by autonomous security systems highlight the necessity for organizations to adopt AI-native defenses capable of operating at machine speed to counteract evolving cyber threats.
3 months ago
Kill Chain
ArcaneDoor 2024: Unveiling the Cisco ASA Zero-Day Exploitation
In early 2024, a sophisticated cyber espionage campaign, dubbed 'ArcaneDoor,' targeted Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers exploited zero-day vulnerabilities—CVE-2024-20353 and CVE-2024-20359—to implant malware, execute arbitrary code, and potentially exfiltrate data. The campaign primarily affected government entities, leveraging the compromised devices as persistent footholds within networks. ([techtarget.com](https://www.techtarget.com/searchsecurity/news/366582137/Cisco-zero-day-flaws-in-ASA-FTD-software-under-attack?utm_source=openai)) This incident underscores the critical need for organizations to promptly apply security patches and maintain up-to-date systems. The exploitation of edge devices highlights a growing trend where attackers focus on perimeter infrastructure to gain initial access, emphasizing the importance of comprehensive security strategies that encompass both endpoint and network defenses.
3 months ago
Kill Chain
APT41's 2026 Cloud Credential Theft: A Wake-Up Call for Cloud Security
In early 2026, the Chinese state-sponsored threat group APT41 launched a sophisticated campaign targeting Linux-based cloud environments across AWS, Google Cloud Platform, Microsoft Azure, and Alibaba Cloud. Utilizing an undetectable ELF backdoor, the group harvested cloud credentials and metadata, enabling unauthorized access and potential data exfiltration. The malware employed typosquatting techniques and covert command-and-control channels over SMTP port 25, effectively evading traditional detection mechanisms. This incident underscores the evolving tactics of APT41, highlighting their focus on cloud infrastructure and the challenges in detecting such advanced persistent threats. Organizations must enhance their cloud security measures, monitor for anomalous activities, and implement robust detection strategies to mitigate similar threats.
3 months ago
Kill Chain
FreePBX 2026: INJ3CTOR3's EncystPHP Web Shell Exploitation
In early 2026, over 900 Sangoma FreePBX instances were compromised through the exploitation of a post-authentication command injection vulnerability, CVE-2025-64328. This flaw allowed attackers, notably the INJ3CTOR3 group, to deploy the EncystPHP web shell, enabling remote command execution and persistent access. The majority of affected systems were located in the United States, with significant numbers also in Brazil, Canada, Germany, and France. The exploitation led to unauthorized outbound calls and potential lateral movement within networks. This incident underscores the critical importance of promptly applying security patches and restricting administrative access to trusted networks. The widespread nature of these attacks highlights the ongoing threat to VoIP infrastructures and the necessity for organizations to implement robust security measures to protect against such vulnerabilities.
3 months ago
Kill Chain
GitHub's 2025 Open Source Vulnerability Report: Key Insights
In 2025, GitHub's Advisory Database reported 4,101 reviewed advisories, marking the lowest count since 2021. This decline is attributed to a reduction in backfilling older vulnerabilities, while newly reported vulnerabilities increased by 19% year-over-year. Notably, npm malware advisories surged by 69%, driven by large-scale campaigns like SHA1-Hulud. Additionally, there was a significant rise in vulnerabilities related to resource exhaustion, unsafe deserialization, and server-side request forgery. These trends underscore the evolving threat landscape in open-source software. ([github.blog](https://github.blog/security/supply-chain-security/a-year-of-open-source-vulnerability-trends-cves-advisories-and-malware/?utm_source=openai)) The current relevance of this incident lies in the persistent and growing threats targeting open-source ecosystems. The increase in new vulnerabilities and sophisticated malware campaigns highlights the need for continuous vigilance and proactive security measures among developers and organizations relying on open-source components.
3 months ago
Kill Chain
Marimo 2026 Pre-Auth RCE Vulnerability Exploited
In April 2026, a critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2026-39987, was discovered in Marimo, a popular open-source Python notebook platform. This flaw allowed unauthenticated attackers to gain full PTY shell access via the /terminal/ws WebSocket endpoint, enabling arbitrary system command execution. Exploitation was observed within 10 hours of public disclosure, with attackers swiftly leveraging the vulnerability to exfiltrate sensitive information. The issue affected all Marimo versions up to 0.20.4 and was addressed in version 0.23.0. ([thehackernews.com](https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html?utm_source=openai)) The rapid exploitation of CVE-2026-39987 underscores the critical need for immediate patching and vigilant monitoring of open-source tools. This incident highlights the growing trend of attackers targeting vulnerabilities in widely-used development platforms, emphasizing the importance of proactive security measures in software development environments.
3 months ago
Kill Chain
Adobe Acrobat Reader CVE-2026-34621: Critical Prototype Pollution Vulnerability
In April 2026, Adobe released emergency updates to address a critical vulnerability (CVE-2026-34621) in Acrobat Reader, which had been actively exploited since at least December 2025. This 'Prototype Pollution' flaw allowed attackers to execute arbitrary code on affected systems when users opened malicious PDF files. The vulnerability impacted versions 24.001.30356, 26.001.21367, and earlier, across both Windows and macOS platforms. Successful exploitation could lead to full system compromise, including data theft and unauthorized control over the device. The incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. Organizations are reminded to maintain robust patch management practices and to exercise caution when handling unsolicited documents, especially those received via email or social channels.
3 months ago
Kill Chain
Operation Atlantic 2026: A Landmark in Combating Cryptocurrency Fraud
In March 2026, Operation Atlantic, a collaborative effort led by the UK's National Crime Agency (NCA) alongside the U.S. Secret Service, Ontario Provincial Police, and Ontario Securities Commission, targeted cryptocurrency fraud across the UK, Canada, and the United States. The operation identified over 20,000 victims and froze more than $12 million in suspected criminal proceeds obtained through 'approval phishing' scams, where victims were deceived into granting access to their cryptocurrency wallets. Additionally, the operation uncovered over $45 million in stolen cryptocurrency linked to global fraud schemes. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/fraudsters-targeting-cryptocurrency-stopped-and-12-million-frozen-in-nca-led-operation-atlantic?utm_source=openai)) This incident underscores the escalating threat of sophisticated phishing attacks in the cryptocurrency sector, highlighting the necessity for enhanced security measures and international cooperation to protect digital assets. The success of Operation Atlantic demonstrates the effectiveness of public-private partnerships in combating cybercrime and sets a precedent for future collaborative efforts to safeguard investors and maintain trust in the cryptocurrency market.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports