✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
US and Allies Issue Joint Advisory on Russian Cyber Threats to Critical Infrastructure
In July 2026, cybersecurity agencies from the United States and eight allied nations issued a joint advisory warning that Russian state-sponsored hackers, specifically FSB Center 16 (also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra), are actively targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks. These actors exploit default or weak SNMP authentication strings and known vulnerabilities, such as CVE-2018-0171 in Cisco's Smart Install feature, to gain unauthorized access, exfiltrate configuration files, and conduct reconnaissance within victim networks. The sectors most at risk include energy, communications, defense industrial base, healthcare, financial services, and government services. This incident underscores the persistent threat posed by nation-state actors to critical infrastructure, highlighting the importance of proactive cybersecurity measures. Organizations are urged to upgrade to SNMPv3, disable unnecessary services like Cisco Smart Install, enforce strong unique passwords, block TFTP and SNMP traffic at edge firewalls, update software and firmware, and replace end-of-life devices to mitigate such risks.
1 week ago
Kill Chain
UK Authorities Charge Five in Russian Coms Caller ID Spoofing Case
In July 2026, UK authorities charged five individuals in connection with Russian Coms, a caller ID spoofing platform implicated in over 1.8 million scam calls since its inception in 2020. The platform enabled criminals to impersonate trusted entities, leading to financial losses estimated in the tens of millions and affecting approximately 170,000 victims. The National Crime Agency (NCA) had previously dismantled Russian Coms in March 2024, arresting key figures believed to be its developers and administrators. The recent charges underscore the ongoing efforts to hold accountable those involved in facilitating large-scale fraud operations. This incident highlights the persistent threat posed by sophisticated social engineering tactics and the critical need for robust cybersecurity measures to protect individuals and organizations from such fraudulent schemes.
1 week ago
Kill Chain
CrashStealer: New macOS Malware Impersonates Apple CrashReporter
In early July 2026, security researchers identified 'CrashStealer,' a sophisticated macOS infostealer malware that masquerades as Apple's CrashReporter tool. Delivered through a signed and notarized installer named 'Werkbit Setup,' CrashStealer bypasses macOS's Gatekeeper protections. Once executed, it prompts users with a fake system password request to gain access to the Keychain, subsequently exfiltrating sensitive data including browser credentials, cookies, and cryptocurrency wallet information. The malware employs advanced techniques such as client-side AES-256-GCM encryption for data exfiltration and re-signing its binary to evade detection. This incident underscores a growing trend of macOS-targeted malware leveraging social engineering and legitimate-looking applications to infiltrate systems. Organizations must enhance their security posture by implementing robust endpoint protection, user education on phishing tactics, and continuous monitoring to detect and mitigate such threats.
1 week ago
Kill Chain
Jscrambler npm Package Compromise: A Wake-Up Call for Supply Chain Security
In July 2026, Jscrambler's npm package was compromised, leading to the publication of malicious versions (8.14, 8.16, 8.17, and 8.20) containing an infostealer malware executed during the 'preinstall' hook. This breach resulted in approximately 1,500 downloads within a two-hour window before the issue was addressed. The malware targeted sensitive data, including source code, developer credentials, cloud service keys, and cryptocurrency wallets. Jscrambler promptly deprecated the affected versions and released a secure version 8.22. This incident underscores the critical importance of securing software supply chains, as attackers increasingly exploit trusted development tools to distribute malware. Organizations must implement stringent security measures, such as code integrity checks and continuous monitoring, to prevent similar supply chain attacks.
1 week ago
Kill Chain
CrashStealer: New macOS Malware Bypasses Gatekeeper
In early July 2026, cybersecurity researchers identified a new macOS information stealer named CrashStealer. This malware is delivered through a disk image that impersonates Apple's built-in crash-reporting component, aiming to deceive victims through a slight alteration in the application's name. Once executed, CrashStealer harvests sensitive data from browsers, cryptocurrency wallets, and password managers. Notably, it utilizes a notarized dropper to bypass macOS's Gatekeeper security feature, allowing it to execute without triggering security warnings. ([mactech.com](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/?utm_source=openai)) The emergence of CrashStealer underscores a growing trend of sophisticated malware targeting macOS systems. Attackers are increasingly leveraging social engineering tactics and exploiting trust in Apple's notarization process to distribute malicious software. This incident highlights the need for enhanced vigilance and security measures among macOS users to mitigate such evolving threats.
1 week ago
Kill Chain
ModHeader Extension Removed by Google and Microsoft Over Security Concerns
In July 2026, Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million combined installs across Chrome and Edge, due to the discovery of a dormant data collection module. Security researchers found that version 7.0.18 of ModHeader contained code capable of collecting users' browsing histories and transmitting the encrypted data to an external server. Although the data collection feature was inactive, its presence raised significant privacy concerns, leading to the extension's removal from both browsers. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those with extensive user bases. It highlights the potential risks associated with third-party software components and the importance of continuous monitoring to detect and mitigate hidden threats that could compromise user privacy and security.
1 week ago
Kill Chain
Yellow Teams: Defining the Future of AI Security
In 2026, organizations like Anthropic and OpenAI initiated projects such as Project Glasswing and Daybreak, respectively, to explore the integration of advanced AI models like Claude Mythos and GPT-5.5 into cybersecurity operations. These initiatives led to the formation of 'yellow teams'—engineering groups dedicated to developing both offensive and defensive AI tools. These teams collaborated with red (offensive) and blue (defensive) teams to harness AI capabilities for identifying vulnerabilities and enhancing security measures. The collaboration resulted in the discovery of numerous vulnerabilities, including some longstanding ones, and emphasized the necessity of integrating AI into the software development life cycle to proactively mitigate future threats. The emergence of yellow teams underscores a significant shift in cybersecurity strategies, highlighting the critical role of AI in both offensive and defensive operations. As AI technologies continue to evolve, the integration of such teams is essential for organizations aiming to stay ahead of sophisticated cyber threats and to adapt to the rapidly changing threat landscape.
1 week ago
Kill Chain
ScamBuster: Revolutionizing Phishing Defense with AI
In July 2026, cybersecurity researcher Laurent Giovannoni introduced ScamBuster, an AI-driven system designed to counteract phishing attacks by engaging scammers with human-like personas. By simulating potential victims, ScamBuster collects critical data on cybercriminal operations, including financial details and infrastructure insights, which can be utilized by organizations and law enforcement to disrupt fraudulent activities. This proactive approach not only wastes scammers' time but also provides valuable intelligence to prevent future attacks. The emergence of ScamBuster highlights a significant shift towards offensive cybersecurity measures, leveraging artificial intelligence to turn the tables on cybercriminals. As phishing tactics become increasingly sophisticated, tools like ScamBuster offer a novel method to gather actionable intelligence, emphasizing the importance of adaptive and proactive defense strategies in the evolving threat landscape.
1 week ago
Kill Chain
Misconfigured Server Exposes Sophisticated Phishing Operations Targeting Microsoft 365
In April 2026, a misconfigured server exposed three active Microsoft 365 phishing operations utilizing customized versions of the Evilginx adversary-in-the-middle (AiTM) proxy. The exposed server, left with directory listing enabled, revealed comprehensive toolkits, including phishing configurations, credential logs, and remote management tools. Analysis traced these operations to an Egyptian actor known as 'codemado,' who cloned and modified public Evilginx repositories to orchestrate sophisticated phishing campaigns targeting corporate mailboxes. The campaigns effectively bypassed multi-factor authentication (MFA) by proxying live login sessions and abusing legitimate Microsoft sign-in flows, allowing attackers to capture session cookies and maintain prolonged access to compromised accounts. This incident underscores the evolving sophistication of phishing-as-a-service platforms and the critical need for organizations to implement robust security measures beyond traditional MFA. The exposure of these operations highlights the importance of continuous monitoring and auditing of authentication processes to detect and mitigate unauthorized access attempts. As attackers refine their techniques to circumvent existing defenses, organizations must stay vigilant and adapt their security strategies accordingly.
1 week ago
Kill Chain
AI-Generated PowerShell Script Used in Active Directory Attack
In early June 2026, cybersecurity researchers identified an intrusion where an unknown threat actor utilized an AI-generated PowerShell script to enumerate an Active Directory (AD) environment. The attacker gained Remote Desktop Protocol (RDP) access to a domain-joined Windows Server using pre-compromised credentials, then executed a PowerShell script titled "100% Working AD Information Gathering Script - FULLY FIXED." This script aggressively mapped users, computers, and domains, creating an AD_Report.html to summarize the enumeration. Following this, the attacker deployed legitimate tools like s5cmd.exe and SharpShares.exe to identify and exfiltrate accessible data repositories. ([itsecurityguru.org](https://www.itsecurityguru.org/2026/07/08/huntress-uncovers-vibe-coded-malware-used-to-map-active-directory-environments/?utm_source=openai)) This incident underscores the evolving threat landscape where AI-generated tools are lowering the barrier to entry for cybercriminals, enabling rapid development of custom, evasive malware. The use of AI in cyberattacks is accelerating, allowing threat actors to execute damaging campaigns more swiftly than ever before. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/vibe-coded-malware-ai-powershell/?utm_source=openai))
2 weeks ago
Kill Chain
Forg365 PhaaS: A New Threat to Microsoft 365 Security
In July 2026, a new phishing-as-a-service (PhaaS) platform named Forg365 emerged, targeting Microsoft 365 accounts. Forg365 employs a combination of device code phishing, adversary-in-the-middle (AiTM) tactics, AI-assisted lure creation, and post-compromise mailbox operations. Distributed via Telegram, the service costs $400 per month or $3,800 annually. Attackers utilize legitimate email delivery services like Amazon SES and Twilio SendGrid to craft convincing phishing emails, leading victims to Forg365-controlled domains. The platform's operator panel offers features such as AI-generated phishing emails, campaign management, and a browser extension named ForgCookie, which maintains persistent access to compromised accounts by refreshing Microsoft single sign-on cookies. The emergence of Forg365 underscores the increasing sophistication and accessibility of phishing tools, enabling even low-skilled threat actors to execute complex attacks. This trend highlights the urgent need for organizations to enhance their email security measures, implement robust multi-factor authentication, and educate users about evolving phishing tactics to mitigate the risk of account compromise.
2 weeks ago
Kill Chain
MemGhost Attack: A New Threat to AI Assistant Security
In July 2026, cybersecurity researchers identified a novel attack vector named 'MemGhost,' which exploits AI assistants equipped with persistent memory. By sending a single, specially crafted email, attackers can implant false information into the assistant's memory without user detection. This manipulation allows the AI to provide altered responses in future interactions, potentially leading to misinformation or unauthorized actions. The attack leverages the assistant's ability to autonomously process emails and update its knowledge base, making it particularly insidious. The MemGhost attack underscores the emerging vulnerabilities associated with AI systems that maintain long-term user data. As AI assistants become more integrated into daily workflows, the potential for such memory poisoning attacks increases, highlighting the need for robust security measures to protect against unauthorized data manipulation.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports