✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Chinese APT UNC6201 Exploits Dell RecoverPoint Zero-Day Vulnerability
In mid-2024, the Chinese state-sponsored threat group UNC6201 exploited a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines. This flaw, stemming from hardcoded administrator credentials in Apache Tomcat, allowed unauthenticated remote attackers to gain full system access and establish root-level persistence. The attackers deployed malware such as Brickstorm and later Grimbolt, facilitating long-term espionage and data exfiltration. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure. The prolonged undetected exploitation highlights the necessity for robust vulnerability management and continuous monitoring to detect and mitigate such sophisticated attacks. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai))
5 months ago
Kill Chain
Poland's Crackdown on Phobos Ransomware: A 2026 Update
In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of 'Operation Aether,' an international effort coordinated by Europol targeting Phobos ransomware infrastructure and affiliates. During the operation, law enforcement seized computers and mobile phones containing stolen credentials, credit card numbers, and server access data, which could be used to facilitate ransomware attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/poland-arrests-suspect-linked-to-phobos-ransomware-operation/?utm_source=openai)) This arrest underscores the ongoing global efforts to dismantle ransomware operations and highlights the persistent threat posed by groups like Phobos. Organizations are reminded to bolster their cybersecurity defenses, particularly around Remote Desktop Protocol (RDP) configurations, to mitigate the risk of such attacks.
5 months ago
Kill Chain
Intruder 2026: Unveiling Exposed Secrets in JavaScript Bundles
In December 2025, Intruder's research team conducted a comprehensive scan of 5 million applications, uncovering over 42,000 exposed tokens hidden within JavaScript bundles. These tokens included sensitive credentials such as code repository access tokens and project management API keys, many of which were active and provided unauthorized access to critical systems. The exposure was attributed to limitations in traditional security tools, which often fail to detect secrets embedded in front-end code, particularly within single-page applications. This incident underscores the urgent need for enhanced secrets detection methods that can effectively identify and mitigate such vulnerabilities in modern web applications.
5 months ago
Kill Chain
Chinese Hackers Exploit Dell Zero-Day Vulnerability in 2024
In mid-2024, the Chinese state-sponsored hacking group UNC6201 began exploiting a critical vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines, a solution integral to VMware virtual machine backup and recovery. This hardcoded credential flaw allowed unauthenticated remote attackers to gain unauthorized access to the underlying operating system, achieving root-level persistence. Once inside, UNC6201 deployed advanced malware, including the Grimbolt backdoor, and utilized novel techniques like creating hidden network interfaces ('Ghost NICs') on VMware ESXi servers to move stealthily across networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))This incident underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure through zero-day vulnerabilities. The exploitation of such flaws highlights the necessity for organizations to maintain rigorous patch management and continuous monitoring to detect and mitigate sophisticated cyber threats.
5 months ago
Kill Chain
Critical Vulnerabilities in Popular VSCode Extensions Expose Developers to Attacks
In February 2026, critical vulnerabilities were discovered in several widely-used Visual Studio Code (VSCode) extensions, including Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview. These extensions, collectively downloaded over 128 million times, contained flaws that could be exploited to steal local files and execute remote code. The vulnerabilities were identified by Ox Security, which attempted disclosure since June 2025 without receiving responses from the maintainers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/flaws-in-popular-vscode-extensions-expose-developers-to-attacks/?utm_source=openai)) This incident underscores the escalating risks associated with third-party development tools and the necessity for rigorous security assessments of IDE extensions. The widespread adoption of these vulnerable extensions highlights the potential for significant supply chain attacks targeting developers and organizations.
5 months ago
Kill Chain
Microsoft Uncovers AI Recommendation Poisoning Threat
In February 2026, Microsoft disclosed a new cyber threat termed 'AI Recommendation Poisoning,' where businesses embed hidden instructions within 'Summarize with AI' buttons on their websites. When users click these buttons, the AI assistant's memory is manipulated via URL prompt parameters to favor certain companies or products in future recommendations. Over a 60-day period, Microsoft identified over 50 unique prompts from 31 companies across 14 industries, raising concerns about the integrity of AI-driven insights. This technique mirrors traditional search engine optimization (SEO) manipulation but targets AI systems directly, potentially leading to biased recommendations in critical areas such as health, finance, and security without user awareness. The emergence of AI Recommendation Poisoning underscores the evolving landscape of cyber threats targeting artificial intelligence systems. As AI becomes increasingly integrated into decision-making processes, ensuring the neutrality and reliability of AI outputs is paramount. Organizations must implement robust security measures to detect and prevent such manipulations to maintain trust in AI-driven recommendations.
5 months ago
Kill Chain
AI Assistants Abused as Command-and-Control Proxies in Recent Cyberattacks
In February 2026, cybersecurity researchers disclosed a novel attack technique where AI assistants with web browsing capabilities, such as Microsoft Copilot and xAI Grok, were exploited as covert command-and-control (C2) proxies. This method, termed 'AI as a C2 proxy' by Check Point Research, allows attackers to blend malicious traffic with legitimate enterprise communications, thereby evading detection. The attack leverages anonymous web access combined with browsing and summarization prompts to create a bidirectional channel for data exfiltration and command execution. This development underscores the evolving threat landscape, where AI systems are not only tools for enhancing productivity but also potential vectors for sophisticated cyberattacks. The ability to abuse AI assistants as C2 proxies highlights the need for organizations to reassess their security postures, especially concerning the integration and use of AI technologies within their networks.
5 months ago
Kill Chain
Whisper Leak: Unveiling Side-Channel Vulnerabilities in LLMs
In November 2025, researchers Geoff McDonald and Jonathan Bar Or identified a side-channel vulnerability in Large Language Models (LLMs) termed 'Whisper Leak.' This attack exploits patterns in encrypted network traffic—specifically packet sizes and timing—to infer user prompt topics during LLM interactions. Despite TLS encryption, these metadata patterns allow adversaries to classify conversation topics with high accuracy, posing significant privacy risks. The study demonstrated the attack's effectiveness across 28 popular LLMs, achieving near-perfect classification rates and high precision even in scenarios with extreme class imbalance. ([microsoft.com](https://www.microsoft.com/en-us/research/publication/whisper-leak-a-side-channel-attack-on-large-language-models/?utm_source=openai)) The discovery of Whisper Leak underscores the urgent need for LLM providers to address metadata leakage vulnerabilities. As LLMs are increasingly deployed in sensitive domains such as healthcare and legal services, ensuring robust privacy protections is paramount. The researchers evaluated mitigation strategies like random padding, token batching, and packet injection; however, none provided complete protection, highlighting the complexity of securing LLM communications against side-channel attacks. ([microsoft.com](https://www.microsoft.com/en-us/research/publication/whisper-leak-a-side-channel-attack-on-large-language-models/?utm_source=openai))
5 months ago
Kill Chain
Salesloft Drift Breach 2025: A Wake-Up Call for SaaS Security
In August 2025, Salesloft's Drift application suffered a significant security breach when attackers exploited compromised OAuth tokens to access and exfiltrate data from over 700 organizations' Salesforce instances. The breach exposed sensitive information, including customer contact details, support case data, and, in some cases, credentials such as AWS access keys and passwords. Prominent companies like Cloudflare, Zscaler, and Palo Alto Networks were among those affected. The attackers, identified as the group "Scattered Lapsus$ Hunters," demanded nearly $1 billion in ransom to prevent the public release of the stolen data. This incident underscores the critical vulnerabilities associated with third-party integrations and the importance of robust security measures to protect against supply chain attacks.
5 months ago
Kill Chain
Understanding the 2026 ClickFix DNS PowerShell Attack
In February 2026, a new variant of the ClickFix social engineering attack emerged, exploiting DNS queries to deliver malicious payloads. Attackers deceived users into executing an 'nslookup' command via the Windows Run dialog, which queried an attacker-controlled DNS server. The server responded with a DNS record containing a malicious PowerShell script, leading to the installation of malware, including the remote access trojan ModeloRAT. This method allowed attackers to blend malicious activities within normal DNS traffic, evading traditional detection mechanisms. This incident underscores the evolving sophistication of social engineering attacks, highlighting the need for heightened awareness and advanced security measures. The use of DNS as a delivery mechanism signifies a shift in attacker tactics, emphasizing the importance of monitoring DNS traffic and educating users about the risks of executing unsolicited commands.
5 months ago
Kill Chain
ShinyHunters Expose 600K Canada Goose Customer Records in 2026 Data Breach
In February 2026, the cybercriminal group ShinyHunters claimed responsibility for exfiltrating over 600,000 customer records from Canada Goose, a luxury outerwear brand. The compromised data includes personal information such as names, email addresses, phone numbers, billing and shipping addresses, IP addresses, and order histories. Additionally, partial payment card information, including card brands and the last four digits of card numbers, was exposed. Canada Goose has stated that the dataset appears to relate to past customer transactions and that there is no evidence of a breach of its own systems. The company is currently reviewing the dataset to assess its accuracy and scope. This incident underscores the persistent threat posed by data extortion groups like ShinyHunters, who have been linked to numerous high-profile breaches targeting e-commerce platforms and cloud environments. Organizations are urged to enhance their cybersecurity measures, particularly in securing customer data and monitoring third-party service providers, to mitigate the risk of such attacks.
5 months ago
Kill Chain
Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-2441
In February 2026, Google addressed a high-severity zero-day vulnerability in Chrome, identified as CVE-2026-2441. This use-after-free flaw in the browser's CSS component allowed attackers to execute arbitrary code by enticing users to visit malicious websites. The vulnerability was actively exploited in the wild, prompting Google to release emergency updates for Windows, macOS, and Linux platforms. Users were urged to update their browsers immediately to mitigate potential risks. This incident underscores the persistent threat posed by zero-day vulnerabilities in widely used software. The rapid exploitation of such flaws highlights the need for continuous vigilance and prompt patching to protect against emerging cyber threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports