✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Entra ID Applications Requesting Unexpected Permissions: A 2026 Security Alert
In early 2026, security researchers identified a significant vulnerability within Microsoft Entra ID, where certain applications were requesting unexpected and overly permissive access permissions. This issue arose due to misconfigurations in application consent settings, allowing applications to prompt users for extensive permissions without adequate oversight. Exploiting this flaw, threat actors could gain unauthorized access to sensitive organizational data, leading to potential data breaches and compliance violations. This incident underscores the critical importance of stringent application consent policies and regular audits of permission settings. As organizations increasingly adopt cloud-based identity solutions, ensuring that applications request only the necessary permissions is vital to maintaining security and compliance.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises 600 FortiGate Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor compromised over 600 FortiGate firewalls across 55 countries. Utilizing generative AI tools, the attacker scanned for exposed management interfaces on ports such as 443 and 10443, and employed brute-force methods to gain access using weak credentials. Once inside, AI-generated scripts were used to extract and decrypt sensitive data, including SSL-VPN and administrative credentials, firewall policies, and network architectures. The attacker further infiltrated networks using recovered credentials and deployed AI-generated reconnaissance tools. Analysis of these tools revealed signs of AI-assisted coding, such as poor error handling and inefficient code structures. ([techradar.com](https://www.techradar.com/pro/security/russian-hacker-uses-multiple-ai-tools-to-break-hundreds-of-firewalls?utm_source=openai)) This incident underscores the growing accessibility of sophisticated cyberattack capabilities through AI tools, enabling even low-skilled actors to execute large-scale breaches. The reliance on AI for various attack phases, from reconnaissance to exploitation, highlights a significant shift in the cyber threat landscape, emphasizing the need for robust security measures and continuous monitoring to mitigate such AI-assisted threats.
5 months ago
Kill Chain
MuddyWater's Operation Olalampo: A 2026 Cyberespionage Campaign in MENA
In early 2026, the Iranian state-sponsored threat actor MuddyWater launched a cyberespionage campaign, dubbed Operation Olalampo, targeting organizations across the Middle East and North Africa (MENA) region. The campaign began on January 26, 2026, and involved spear-phishing emails with malicious Microsoft Office attachments. Once opened, these documents executed macros that deployed new malware families, including GhostFetch, CHAR, and HTTP_VIP, providing the attackers with remote control over compromised systems. ([thehackernews.com](https://thehackernews.com/2026/02/muddywater-targets-mena-organizations.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors like MuddyWater, who are developing and deploying sophisticated malware to infiltrate critical infrastructure. The use of advanced implants and backdoors highlights the need for organizations to enhance their cybersecurity measures to detect and mitigate such threats effectively.
5 months ago
Kill Chain
ATM Jackpotting Attacks Surge in 2025, Resulting in Over $20 Million in Losses
In 2025, the United States experienced a significant surge in ATM "jackpotting" attacks, with over 700 incidents reported, resulting in losses exceeding $20 million. ([thehackernews.com](https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html?utm_source=openai)) These attacks involve criminals gaining physical access to ATMs, often using generic keys to open the machines. Once inside, they install or replace hard drives with malware, such as the Ploutus family, which exploits the eXtensions for Financial Services (XFS) API to dispense cash without bank authorization. ([livemint.com](https://www.livemint.com/news/world/fbi-warns-of-rising-atm-jackpotting-cases-reports-20-million-in-losses-in-2025-5-indicators-to-detect-foul-play-11771729139858.html?utm_source=openai)) This alarming trend underscores the evolving tactics of cybercriminals targeting financial institutions. The FBI has issued warnings and recommended mitigation strategies, including enhancing physical security measures, regularly updating ATM software, and monitoring for unauthorized access, to combat this growing threat. ([thehackernews.com](https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html?utm_source=openai))
5 months ago
Kill Chain
CEO Deepfake Scam 2019: A Wake-Up Call for Corporate Security
In March 2019, a UK-based energy firm's CEO was deceived by a deepfake audio impersonation of his German parent company's chief executive. The fraudster, using AI-generated voice technology, instructed the CEO to transfer €220,000 (approximately $243,000) to a Hungarian supplier's account. Believing the request was legitimate, the CEO complied. Subsequent attempts for additional transfers raised suspicions, leading to the discovery of the scam. The initial funds were moved from Hungary to Mexico and then dispersed to other locations, making recovery challenging. ([forbes.com](https://www.forbes.com/sites/jessedamiani/2019/09/03/a-voice-deepfake-was-used-to-scam-a-ceo-out-of-243000/?utm_source=openai)) This incident underscores the escalating threat of AI-driven deepfake technologies in corporate fraud. As these tools become more sophisticated and accessible, organizations face increased risks of impersonation attacks targeting financial transactions and sensitive information. The event highlights the urgent need for enhanced security measures and employee training to detect and prevent such advanced social engineering tactics.
5 months ago
Kill Chain
CrowdStrike 2025 Global Threat Report: Attackers Moving Through Networks in Under 30 Minutes
In 2025, cyberattacks accelerated significantly, with the average breakout time—the duration for attackers to move from initial intrusion to other network systems—dropping to 29 minutes, a 65% increase in speed from the previous year. Notably, the fastest recorded breakout time was 27 seconds. This rapid progression was facilitated by attackers refining their techniques, leveraging social engineering to access high-privilege systems swiftly, and exploiting gaps across cloud, identity, enterprise, and unmanaged network devices. Consequently, defenders faced increased challenges, including burnout and stress, leading to potential mistakes. Additionally, CrowdStrike identified 281 threat groups by the end of 2025, including 24 new threats named throughout the year, highlighting the expanding and evolving threat landscape. The urgency of this issue is underscored by the 37% year-over-year increase in cloud-focused attacks, with a staggering 266% surge in such activities from nation-state threat groups. Furthermore, 82% of attacks detected in 2025 were malware-free, indicating a shift towards hands-on-keyboard operations and the abuse of legitimate tools and credentials. This trend emphasizes the need for organizations to enhance their security measures, focusing on rapid detection and response capabilities to mitigate the risks posed by increasingly sophisticated and swift cyber adversaries.
5 months ago
Kill Chain
Roundcube Webmail Vulnerabilities: Immediate Action Required
In June and December 2025, two critical vulnerabilities were identified in Roundcube Webmail: CVE-2025-49113, a remote code execution flaw, and CVE-2025-68461, a cross-site scripting vulnerability. These flaws allowed attackers to execute arbitrary code and inject malicious scripts, respectively, compromising the security of affected systems. Despite patches being released promptly, threat actors rapidly developed exploits, leading to active exploitation of these vulnerabilities. The exploitation of these vulnerabilities underscores the persistent threat posed by unpatched software in widely used applications. Organizations must prioritize timely updates and robust security measures to mitigate such risks. ([securityweek.com](https://www.securityweek.com/recent-roundcube-webmail-vulnerability-exploited-in-attacks/?utm_source=openai))
5 months ago
Kill Chain
Optimizely's 2026 Data Breach: A Case Study in Vishing Attacks
In February 2026, Optimizely, a New York-based ad tech company, experienced a data breach initiated through a sophisticated voice phishing (vishing) attack. The attackers, identified as the ShinyHunters group, impersonated internal IT staff to deceive employees into divulging single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. This social engineering tactic granted unauthorized access to Optimizely's systems, leading to the exfiltration of basic business contact information. The breach was confined to certain internal business systems, records in the customer relationship management (CRM) platform, and a limited set of internal documents used for back-office operations. There is no evidence that sensitive customer data or personal information beyond basic business contact information was accessed. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ad-tech-firm-optimizely-confirms-data-breach-after-vishing-attack/?utm_source=openai)) This incident underscores a significant escalation in the operations of the ShinyHunters group, which has been actively targeting organizations through vishing attacks to compromise SSO credentials. The group's tactics have evolved to include harassment of victim personnel and other aggressive measures. ([itpro.com](https://www.itpro.com/security/google-issues-warning-over-shinyhunters-branded-vishing-campaigns?utm_source=openai))
5 months ago
Kill Chain
PromptSpy AI Malware: Unveiling the Future of Android Cyber Threats
In February 2026, cybersecurity researchers identified 'PromptSpy,' the first known Android malware leveraging generative AI at runtime. This sophisticated malware utilizes Google's Gemini model to adapt its persistence mechanisms across various devices, enhancing its ability to evade detection. PromptSpy's discovery marks a significant evolution in mobile threats, demonstrating the integration of AI to dynamically modify malicious behavior during execution. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-android-malware-to-use-generative-ai-at-runtime/?utm_source=openai)) The emergence of AI-driven malware like PromptSpy underscores a critical shift in cyber threats, where adversaries harness advanced technologies to create more resilient and adaptive attack vectors. This development necessitates a reevaluation of current security measures to effectively counteract AI-enhanced malicious activities.
5 months ago
Kill Chain
SANDWORM_MODE: A New Era of Supply Chain Attacks Targeting Developers
In February 2026, a sophisticated supply chain attack, dubbed SANDWORM_MODE, targeted the npm ecosystem by distributing at least 19 malicious packages. These packages were designed to harvest sensitive information, including system data, access tokens, environment secrets, and API keys from developer environments. The malware propagated by exploiting compromised npm and GitHub accounts, enabling widespread credential theft and unauthorized access to development infrastructures. Notably, the attack introduced a module that infiltrated AI coding assistants, extracting API keys from nine large language model providers and injecting malicious servers into tool configurations. This incident underscores the escalating complexity and reach of supply chain attacks, particularly those leveraging trusted open-source repositories. The integration of AI toolchain manipulation highlights a concerning evolution in attacker tactics, emphasizing the need for enhanced vigilance and security measures within development environments.
5 months ago
Kill Chain
APT28's Operation MacroMaze: A New Wave of Cyber Espionage
Between September 2025 and January 2026, the Russian state-sponsored threat actor APT28 conducted Operation MacroMaze, targeting entities in Western and Central Europe. The campaign utilized spear-phishing emails containing malicious Word documents with embedded macros. These macros exploited legitimate services like webhook[.]site for command-and-control and data exfiltration, employing techniques such as headless browser execution and keyboard simulation to evade detection. ([thehackernews.com](https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html?utm_source=openai)) This incident underscores the evolving tactics of APT28, highlighting their ability to adapt and leverage basic tools in sophisticated ways. The use of legitimate services for malicious purposes poses significant challenges for detection and mitigation, emphasizing the need for robust cybersecurity measures and continuous monitoring.
5 months ago
Kill Chain
Unveiling the Malicious JPEG Infostealer Campaign of February 2026
In February 2026, a sophisticated malware campaign was identified, leveraging steganographic techniques to embed malicious code within JPEG image files. Unsuspecting users were tricked into downloading these seemingly benign images, which, upon execution, initiated a multi-stage infection process. The primary payload was an infostealer designed to extract sensitive data, including browser credentials and system information, while maintaining communication with a command-and-control server. This method allowed attackers to exfiltrate data stealthily, minimizing detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals, who are increasingly employing advanced obfuscation methods like steganography to bypass security defenses. The use of common file formats, such as JPEGs, as carriers for malware highlights the need for enhanced vigilance and the adoption of comprehensive security solutions capable of detecting such covert threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports