✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.
4 months ago
Kill Chain
CrystalX RAT: A New Era of Multifunctional Malware-as-a-Service
In early 2026, a new malware-as-a-service (MaaS) known as CrystalX RAT emerged, offering a comprehensive suite of malicious capabilities including remote access, data theft, keylogging, and clipboard hijacking. Promoted through private Telegram channels and YouTube, CrystalX RAT features a user-friendly control panel and an automated builder tool that supports customization options such as geoblocking and anti-analysis features. Notably, it also includes prankware functionalities designed to disrupt user activities, such as altering display orientation and remapping mouse buttons. The malware's infostealer component targets Chromium-based browsers and desktop applications like Steam, Discord, and Telegram, while its remote access module allows for command execution, file manipulation, and real-time control via VNC. ([securelist.com](https://securelist.com/crystalx-rat-with-prankware-features/119283/?utm_source=openai)) The emergence of CrystalX RAT underscores a growing trend in the cybercriminal ecosystem towards offering multifunctional MaaS platforms that lower the barrier to entry for threat actors. Its combination of traditional malware capabilities with prankware features highlights the evolving nature of cyber threats, emphasizing the need for robust cybersecurity measures and user awareness to mitigate such risks.
4 months ago
Kill Chain
UNC1069's Compromise of Axios npm Package: A 2026 Supply Chain Attack
In late March 2026, the widely used JavaScript library Axios, with approximately 100 million weekly downloads, was compromised in a supply chain attack attributed to the North Korean threat group UNC1069. The attackers gained control of a maintainer's npm account and published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency named 'plain-crypto-js'. This dependency executed a post-installation script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious versions were available for about three hours before removal, but the potential impact is significant due to Axios's extensive use across various projects. ([thehackernews.com](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html?utm_source=openai)) This incident underscores the growing trend of sophisticated supply chain attacks targeting open-source software, emphasizing the need for enhanced security measures in software development and distribution processes. Organizations are urged to audit their dependency trees, implement strict access controls, and monitor for unusual activities to mitigate such risks.
4 months ago
Kill Chain
CrystalX RAT: The 2026 Malware-as-a-Service Blending Espionage and Prankware
In March 2026, cybersecurity researchers identified an active campaign distributing CrystalX RAT, a novel malware offered as Malware-as-a-Service (MaaS) through private Telegram channels. This Remote Access Trojan (RAT) distinguishes itself by combining traditional espionage capabilities—such as spyware, keylogging, and remote control—with stealer functions and unique prankware features designed to disrupt and annoy victims. The malware's control panel allows third-party actors to build customized implants with options like geoblocking, anti-analysis mechanisms, and various malicious functionalities. Initial infection vectors remain unclear, but the campaign has already affected dozens of victims, primarily in Russia, with potential for global spread due to the service's lack of regional restrictions. The ongoing development and active promotion of CrystalX RAT suggest a significant risk of increased infections in the near future.
4 months ago
Kill Chain
Volt Typhoon 2024: A Case Study in Living Off the Land Cyber Attacks
In 2024, the Chinese state-sponsored hacker group known as Volt Typhoon executed a sophisticated Living Off the Land (LOTL) attack targeting critical infrastructure in the United States. By exploiting legitimate system tools and processes, they infiltrated networks without deploying traditional malware, thereby evading standard detection mechanisms. This approach allowed them to conduct prolonged surveillance and data exfiltration, significantly compromising national security and operational integrity. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3669159/combatting-cyber-threat-actors-perpetrating-living-off-the-land-intrusions/?utm_source=openai)) The incident underscores a growing trend among nation-state actors to utilize LOTL techniques, which leverage trusted system utilities to carry out malicious activities. This method not only complicates detection but also challenges traditional cybersecurity defenses, necessitating a shift towards behavior-based monitoring and advanced threat detection strategies.
4 months ago
Kill Chain
Casbaneiro Phishing Campaign Targets Latin America and Europe
In March 2026, a sophisticated phishing campaign orchestrated by the Brazilian cybercrime group Augmented Marauder targeted Spanish-speaking users across Latin America and Europe. The attackers distributed emails with court summons-themed messages containing password-protected PDF attachments. These PDFs directed recipients to malicious links, initiating a multi-stage infection chain that deployed the Horabot malware, which subsequently delivered the Casbaneiro banking trojan. This campaign leveraged dynamic PDF generation and exploited both email and WhatsApp platforms to propagate the malware, resulting in significant financial and data losses for affected organizations. This incident underscores the evolving tactics of cybercriminals who are increasingly using multi-pronged attack vectors and dynamic content to bypass traditional security measures. The use of legitimate communication channels like WhatsApp for malware distribution highlights the need for organizations to implement comprehensive security strategies that address both email and messaging platforms.
4 months ago
Kill Chain
Chrome 2026 Dawn Use-After-Free Vulnerability
In April 2026, Google identified and patched a high-severity zero-day vulnerability, CVE-2026-5281, in its Chrome browser. This use-after-free flaw in Dawn, Chrome's implementation of the WebGPU standard, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to versions 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. ([thehackernews.com](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html?utm_source=openai)) This incident underscores the increasing frequency of zero-day vulnerabilities targeting widely used software. It highlights the critical need for organizations to maintain up-to-date systems and implement robust security measures to mitigate the risks associated with such exploits.
4 months ago
Kill Chain
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass
In late February 2026, Microsoft identified a sophisticated malware campaign leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. Upon execution, these scripts initiate a multi-stage infection chain, utilizing renamed Windows utilities to download additional payloads from trusted cloud services like AWS, Tencent Cloud, and Backblaze B2. The malware employs User Account Control (UAC) bypass techniques to escalate privileges, establish persistence, and deploy tools such as AnyDesk for remote access, enabling attackers to exfiltrate data or deploy further malware. This campaign underscores the evolving tactics of threat actors who exploit legitimate tools and platforms to evade detection and maintain control over compromised systems. Organizations must remain vigilant against such social engineering attacks and implement robust security measures to mitigate these threats.
4 months ago
Kill Chain
CERT-UA Impersonation Campaign: UAC-0255's AGEWHEEZE Malware Attack
In late March 2026, the threat actor group UAC-0255 launched a phishing campaign impersonating the Computer Emergency Response Team of Ukraine (CERT-UA). The attackers sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm, urging recipients to install the 'specialized software.' The ZIP file ('CERT_UA_protection_tool.zip') is designed to download malware packaged as security software from the agency. The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address 'incidents@cert-ua[.]tech.'
4 months ago
Kill Chain
Magecart E-Skimmer Infections Reach Record Highs in 2025
In 2025, Magecart e-skimming attacks surged, compromising over 23 million online transactions across more than 10,500 unique infections. These attacks involved injecting malicious JavaScript into e-commerce checkout pages to steal payment data. The proliferation of full-stack e-skimmer kits and Malware-as-a-Service offerings enabled less technically skilled threat actors to execute large-scale compromises, significantly impacting the security of online merchants and consumers. ([recordedfuture.com](https://www.recordedfuture.com/resources/guides/annual-payment-fraud-intelligence-report-2025?utm_source=openai)) The industrialization of the fraud ecosystem, characterized by standardized attack tools and services, has lowered the barrier to entry for cybercriminals. This trend underscores the urgent need for financial institutions and e-commerce platforms to adopt proactive, intelligence-driven defenses to mitigate the escalating threat of payment fraud. ([recordedfuture.com](https://www.recordedfuture.com/resources/guides/annual-payment-fraud-intelligence-report-2025?utm_source=openai))
4 months ago
Kill Chain
Excessive Permissions in Google Vertex AI: A 2026 Security Wake-Up Call
In March 2026, Palo Alto Networks' Unit 42 identified a critical security vulnerability in Google Cloud's Vertex AI platform. The issue stemmed from the platform's default service accounts, known as Per-Project, Per-Product Service Agents (P4SA), which were granted excessive permissions by default. This misconfiguration allowed attackers to exploit AI agents deployed on Vertex AI, enabling unauthorized access to sensitive data and internal cloud infrastructure. By extracting the service account credentials, malicious actors could escalate privileges, access proprietary container images, and potentially compromise Google's internal storage buckets. ([darkreading.com](https://www.darkreading.com/cyber-risk/googles-vertex-ai-over-privilege-problem?utm_source=openai)) This incident underscores the growing security challenges associated with AI deployments in cloud environments. As organizations increasingly integrate AI agents into their workflows, ensuring proper configuration and adherence to the principle of least privilege becomes paramount to prevent similar vulnerabilities and safeguard sensitive information.
4 months ago
Kill Chain
UNC1069's 2026 Supply Chain Attack on Axios: A Wake-Up Call for Open-Source Security
In late March 2026, the widely-used JavaScript library Axios was compromised through a sophisticated supply chain attack. Attackers gained access to the npm account of a lead maintainer and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before being removed, but the potential impact was significant due to Axios's extensive use in the developer community. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting open-source ecosystems. The attribution to North Korean threat actor UNC1069 highlights the increasing involvement of state-sponsored groups in such attacks, emphasizing the need for enhanced security measures in software development pipelines. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/north-korean-hackers-behind-axios-npm.html?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports