✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Understanding the Coruna iOS Exploit Kit: Implications and Protections
In early 2026, Google’s Threat Intelligence Group identified 'Coruna,' a sophisticated iOS exploit kit targeting devices running iOS versions 13.0 through 17.2.1. The kit comprises five full exploit chains utilizing 23 vulnerabilities, enabling attackers to execute remote code and escalate privileges. Initially observed in February 2025 within a surveillance vendor's operations, Coruna was subsequently employed by Russian espionage groups in mid-2025 and later by financially motivated Chinese cybercriminals by December 2025. The exploit kit facilitates the deployment of malware capable of exfiltrating sensitive data, including cryptocurrency wallets and personal information. ([thehackernews.com](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html?utm_source=openai)) The emergence of Coruna underscores a concerning trend where advanced cyber tools, potentially developed by nation-states, proliferate into the hands of various threat actors. This incident highlights the critical need for organizations and individuals to maintain up-to-date software and implement robust security measures to mitigate the risks posed by such sophisticated exploits. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
4 months ago
Kill Chain
Iranian Cyber Retaliation in March 2026: A Wake-Up Call for Critical Infrastructure Security
In March 2026, following coordinated US-Israeli military strikes on Iran, Iranian state-sponsored cyber actors launched retaliatory cyber operations targeting critical infrastructure across the Middle East and the United States. These operations included Distributed Denial-of-Service (DDoS) attacks, phishing campaigns, and attempts to compromise surveillance systems. Notably, a malicious replica of the Israeli Home Front Command's RedAlert application was distributed to deliver surveillance malware, and internet-connected surveillance cameras in multiple countries were targeted to support operational planning and battle damage assessment. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/?utm_source=openai)) The escalation underscores the persistent cyber threat posed by Iranian actors, who have demonstrated the capability to exploit geopolitical tensions to conduct disruptive cyber activities. Organizations, especially those in critical infrastructure sectors, should remain vigilant and enhance their cybersecurity measures to mitigate potential risks associated with such state-sponsored cyber operations.
4 months ago
Kill Chain
Understanding the 2026 Google Workspace OAuth Attack
In March 2026, a sophisticated phishing campaign exploited OAuth redirection mechanisms to compromise Google Workspace accounts. Attackers crafted malicious OAuth applications that, when users attempted to authenticate, redirected them from trusted identity providers to attacker-controlled sites, leading to malware downloads. This method allowed adversaries to bypass traditional phishing defenses by leveraging legitimate authentication flows. The incident underscores the evolving tactics of threat actors who exploit standard protocol behaviors to gain unauthorized access, highlighting the need for organizations to implement stringent OAuth governance and cross-domain detection strategies.
4 months ago
Kill Chain
Qualcomm Android Zero-Day Exploited in 2026
In March 2026, Google disclosed a high-severity vulnerability, CVE-2026-21385, affecting Qualcomm's open-source display driver used in Android devices. This integer overflow flaw leads to memory corruption when processing user-supplied data without proper buffer size validation. The vulnerability was reported to Qualcomm on December 18, 2025, and patches were included in the March 2026 Android security update. Google noted indications of limited, targeted exploitation of this zero-day vulnerability in the wild. The March 2026 Android security bulletin addressed a total of 129 vulnerabilities, including this actively exploited flaw. The presence of an actively exploited zero-day vulnerability underscores the critical need for timely security updates. Organizations and individuals should prioritize applying the March 2026 security patch to mitigate potential risks associated with this and other vulnerabilities addressed in the update.
5 months ago
Kill Chain
Silver Dragon 2026: Unveiling APT41's Covert Cyberespionage Tactics
In mid-2024, the Chinese state-sponsored group Silver Dragon, associated with APT41, initiated cyberespionage campaigns targeting government organizations across Southeast Asia and Europe. The group gained initial access through exploiting public-facing servers and phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacked legitimate Windows services, allowing their malware to blend seamlessly with normal system activities. They deployed custom tools like GearDoor, which utilized Google Drive for covert command-and-control communications, SSHcmd for remote access, and SliverScreen for capturing user activity screenshots. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who are increasingly leveraging trusted cloud services and legitimate system processes to evade detection. The use of such sophisticated methods highlights the need for organizations to enhance their cybersecurity measures and remain vigilant against advanced persistent threats. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))
5 months ago
Kill Chain
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))
5 months ago
Kill Chain
Coruna Exploit Kit: Unveiling the First Mass-Scale iOS Attack
In early 2026, security researchers uncovered the 'Coruna' exploit kit, a sophisticated suite of hacking tools capable of compromising iPhones running older iOS versions. Initially identified in February 2025 during a surveillance vendor's attempt to deploy spyware on behalf of a government client, Coruna was later observed in attacks targeting Ukrainian users by a Russian espionage group and subsequently by financially motivated hackers in China. The exploit kit chains together multiple vulnerabilities, allowing attackers to bypass iOS defenses and gain full control over targeted devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of advanced cyber tools originally developed for government use. Similar to the EternalBlue exploit that fueled the WannaCry and NotPetya attacks in 2017, Coruna's widespread availability has enabled various threat actors to conduct mass-scale attacks on iOS devices, affecting at least 42,000 devices to date.
5 months ago
Kill Chain
Perplexity Comet Browser's 'PleaseFix' Vulnerabilities Expose Critical Security Flaws
In March 2026, Zenity Labs disclosed critical vulnerabilities in Perplexity's AI-powered Comet browser, collectively termed 'PleaseFix.' These flaws allowed attackers to exploit indirect prompt injections, enabling unauthorized access to local files and credential theft without user interaction. By embedding malicious prompts in trusted content, such as calendar invites, attackers could manipulate the AI agent to perform unauthorized actions, including exfiltrating sensitive data and compromising password managers like 1Password. Perplexity addressed these vulnerabilities following responsible disclosure, implementing fixes to prevent autonomous access to local file systems and unauthorized credential manipulation. This incident underscores the inherent security challenges in agentic AI systems, highlighting the need for robust safeguards against prompt injection attacks and the importance of continuous monitoring and updating of AI-driven applications to mitigate emerging threats.
5 months ago
Kill Chain
CyberStrikeAI: The AI Tool Empowering Hackers in 2026
In early 2026, cybersecurity researchers identified that threat actors had adopted CyberStrikeAI, an open-source AI-native security testing platform, to automate and enhance their cyberattacks. This tool integrates over 100 security tools with an intelligent orchestration engine, enabling end-to-end automation from vulnerability discovery to attack-chain analysis. Notably, the same infrastructure used in a campaign that breached over 500 Fortinet FortiGate firewalls was observed running CyberStrikeAI, indicating its role in facilitating these attacks. The adoption of AI-powered tools like CyberStrikeAI by cybercriminals signifies a shift towards more sophisticated and automated attack methodologies. This trend underscores the urgent need for organizations to bolster their defenses against AI-driven threats, as traditional security measures may become increasingly inadequate.
5 months ago
Kill Chain
Android 2026 Security Update Addresses Exploited Qualcomm Zero-Day
In March 2026, Google released a security update addressing 129 vulnerabilities in Android devices, notably including CVE-2026-21385—a high-severity zero-day flaw in Qualcomm's display component. This integer overflow vulnerability allows local attackers to cause memory corruption, potentially leading to unauthorized control over affected devices. The flaw impacts 234 Qualcomm chipsets, and there are indications of its limited, targeted exploitation in the wild. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) The active exploitation of CVE-2026-21385 underscores the persistent threat posed by zero-day vulnerabilities in widely used hardware components. Organizations must prioritize timely patch management and maintain robust security protocols to mitigate risks associated with such vulnerabilities.
5 months ago
Kill Chain
Cloud Imperium Games Data Breach: A Wake-Up Call for the Gaming Industry
In January 2026, Cloud Imperium Games (CIG), the developer behind 'Star Citizen,' experienced a sophisticated cyberattack resulting in unauthorized access to backup systems containing user data. The breach, discovered on January 21, exposed personal information including names, contact details, usernames, and dates of birth. Notably, financial information and passwords remained secure. CIG addressed the intrusion promptly, implementing enhanced security measures to prevent further incidents. ([theregister.com](https://www.theregister.com/2026/03/03/brit_games_studio_cloud_imperium/?utm_source=openai)) This incident underscores the critical importance of timely breach disclosure and robust data protection practices in the gaming industry. The delayed notification has raised concerns about transparency and user trust, highlighting the need for companies to adhere to regulatory requirements and maintain open communication with their user base. ([scworld.com](https://www.scworld.com/brief/cloud-imperium-faces-backlash-over-delayed-data-breach-disclosure?utm_source=openai))
5 months ago
Kill Chain
AWS Data Centers in Middle East Damaged by Drone Strikes
In early March 2026, Amazon Web Services (AWS) experienced significant disruptions after drone strikes targeted its data centers in the Middle East. Two facilities in the United Arab Emirates (UAE) were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks resulted in structural damage, power outages, and water damage due to fire suppression efforts, leading to elevated error rates and degraded availability for services such as Amazon EC2, Amazon S3, and Amazon DynamoDB. AWS is collaborating with local authorities to restore services, but recovery is expected to be prolonged due to the extent of the physical damage. This incident underscores the vulnerability of critical cloud infrastructure to physical attacks, especially in regions experiencing geopolitical tensions. Organizations relying on cloud services are reminded of the importance of robust disaster recovery plans and the need to consider geographic redundancy to mitigate risks associated with localized disruptions.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports