✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
DKnife: The Linux Toolkit Hijacking Router Traffic for Espionage
In February 2026, cybersecurity researchers uncovered 'DKnife,' a sophisticated Linux-based toolkit active since 2019, designed to hijack router traffic for espionage and malware delivery. DKnife comprises seven modules enabling deep packet inspection, traffic manipulation, credential harvesting, and malware deployment, including the ShadowPad and DarkNimbus backdoors. The toolkit specifically targets Chinese services and exhibits Simplified Chinese language artifacts, indicating a China-nexus threat actor. DKnife's capabilities include DNS hijacking, intercepting Android app updates, and monitoring user activities on platforms like WeChat and Signal. As of January 2026, its command-and-control servers remain active. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/dknife-linux-toolkit-hijacks-router-traffic-to-spy-deliver-malware/?utm_source=openai))
5 months ago
Kill Chain
Anthropic's Claude Opus 4.6: A Game-Changer in AI-Driven Cybersecurity
In February 2026, Anthropic's AI model, Claude Opus 4.6, identified over 500 previously unknown high-severity vulnerabilities in widely used open-source libraries, including Ghostscript, OpenSC, and CGIF. The model autonomously discovered these flaws without specific instructions, demonstrating advanced code analysis capabilities. The vulnerabilities ranged from system crashes to memory corruption issues, all of which have since been patched by the respective maintainers. This incident underscores the growing role of AI in cybersecurity, highlighting both its potential to enhance defense mechanisms and the necessity for robust safeguards against misuse. The discovery also emphasizes the critical need for continuous monitoring and rapid patching of open-source software to maintain security integrity.
5 months ago
Kill Chain
dYdX Supply Chain Attack Exposes Cryptocurrency Wallets to Theft
In early February 2026, dYdX, a decentralized cryptocurrency exchange, experienced a significant supply chain attack. Malicious actors compromised legitimate npm and PyPI packages—@dydxprotocol/v4-client-js and dydx-v4-client, respectively—by publishing infected versions using legitimate developer credentials. These compromised packages were designed to steal wallet credentials and, in the case of the PyPI package, deploy a remote access trojan (RAT) for executing arbitrary commands on affected systems. The attack underscores the vulnerabilities inherent in software supply chains and the potential for widespread impact when trusted distribution channels are exploited. This incident highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels, following similar attacks in 2022 and 2024. The coordinated cross-ecosystem deployment and sophisticated obfuscation techniques suggest that threat actors had direct access to publishing infrastructure, emphasizing the need for enhanced security measures in software development and distribution processes.
5 months ago
Kill Chain
Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities
Between January 2024 and February 2026, the cyber espionage group TGR-STA-1030, assessed to be state-aligned and operating out of Asia, compromised at least 70 government and critical infrastructure organizations across 37 countries. The group employed phishing emails and exploited known software vulnerabilities to gain initial access, subsequently deploying tools like the Diaoyu Loader and the ShadowGuard rootkit to maintain persistence and exfiltrate sensitive data. Notable targets included national law enforcement agencies, ministries of finance, and departments focusing on trade and diplomacy. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/?utm_source=openai)) This incident underscores the escalating sophistication and reach of state-sponsored cyber espionage activities, highlighting the urgent need for enhanced cybersecurity measures and international cooperation to protect critical infrastructure and sensitive governmental data.
5 months ago
Kill Chain
CISA's 2026 Directive: Strengthening Federal Network Security by Removing Unsupported Edge Devices
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-02, mandating Federal Civilian Executive Branch agencies to identify and remove unsupported edge devices—such as routers, firewalls, and switches—that no longer receive security updates. This directive aims to mitigate risks posed by state-sponsored threat actors exploiting these vulnerable devices to gain unauthorized access to federal networks. Agencies are required to update, catalog, and decommission these devices within specified timeframes, culminating in the establishment of a continuous lifecycle management process within 24 months. This initiative underscores the critical need for proactive asset management and the elimination of technical debt to enhance national cybersecurity resilience.
5 months ago
Kill Chain
Moltbook's 2026 Security Breach: A Cautionary Tale of Cloud Misconfiguration
In late January 2026, Moltbook, an AI-exclusive social platform, suffered a significant security breach due to a misconfigured Supabase database. This vulnerability exposed sensitive data, including 1.5 million AI agent API tokens, 35,000 email addresses, and private messages. The misconfiguration allowed unauthorized access and modification of agent records, leading to potential impersonation and data manipulation. Promptly addressing the issue, Moltbook resolved the vulnerability within hours of disclosure. ([techradar.com](https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured?utm_source=openai)) This incident underscores the critical importance of robust security configurations in cloud-based platforms, especially those handling sensitive user data. It highlights the risks associated with rapid deployment of AI-driven services without comprehensive security assessments, emphasizing the need for stringent access controls and regular security audits to prevent similar breaches.
5 months ago
Kill Chain
Shai-Hulud: Unveiling the 2025 npm Supply Chain Attack
In September 2025, the Shai-Hulud malware campaign emerged as a significant supply chain attack targeting the npm ecosystem. The self-replicating worm compromised over 180 npm packages within 48 hours, including those maintained by prominent organizations like CrowdStrike. By exploiting post-install scripts, the malware harvested developer credentials, including npm tokens, GitHub personal access tokens, and cloud service keys. It established persistence through malicious GitHub Actions workflows, enabling further propagation by republishing infected versions across the victim maintainer's other packages. This attack underscored the vulnerabilities inherent in open-source supply chains and the potential for widespread impact when trusted developer pipelines are exploited. ([protoslabs.io](https://www.protoslabs.io/resources/deep-dive-shai-hulud-the-self-replicating-npm-supply-chain-worm?utm_source=openai)) The Shai-Hulud incident highlights a growing trend of sophisticated supply chain attacks that leverage automation and trusted relationships within the developer ecosystem. The rapid escalation and scale of this campaign serve as a stark reminder of the critical need for enhanced security measures, including stringent access controls, continuous monitoring, and the adoption of zero-trust principles to safeguard against such pervasive threats. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/shai-hulud-malware-campaign-dubbed-the-largest-and-most-dangerous-npm-supply-chain-compromise-in-history-hundreds-of-javascript-packages-affected?utm_source=openai))
5 months ago
Kill Chain
EnCase Driver Exploited for EDR Evasion in 2026
In early 2026, cybersecurity researchers identified a significant security vulnerability involving the EnCase forensic tool's driver. Despite its digital certificate having expired years prior, Windows systems continued to load the driver due to inadequate security checks. This oversight allowed threat actors to exploit the driver, effectively disabling Endpoint Detection and Response (EDR) systems and evading detection mechanisms. The exploitation of this driver underscores a critical gap in driver validation processes, enabling attackers to gain elevated privileges and execute malicious activities undetected. This incident highlights the persistent and evolving nature of EDR evasion techniques employed by cyber adversaries. The use of signed yet vulnerable drivers to bypass security measures is a growing trend, emphasizing the need for organizations to implement robust driver validation and monitoring processes to mitigate such risks.
5 months ago
Kill Chain
Critical OS Command Injection Vulnerability in React Native CLI's Metro Development Server
In November 2025, a critical vulnerability (CVE-2025-11953) was identified in the React Native Community CLI's Metro Development Server. This flaw allowed unauthenticated attackers to execute arbitrary commands on the host system by sending specially crafted POST requests to the server's '/open-url' endpoint. The vulnerability affected versions 4.8.0 through 20.0.0-alpha.2 and was patched in version 20.0.0. Developers were advised to update their installations promptly or restrict the server's network exposure to mitigate the risk. ([research.jfrog.com](https://research.jfrog.com/vulnerabilities/react-native-cli-command-injection-jfsa-2025-001495618/?utm_source=openai)) The incident underscores the importance of securing development tools and environments, as vulnerabilities in such tools can serve as entry points for attackers. It also highlights the need for developers to stay vigilant about applying security patches and configuring development servers securely to prevent unauthorized access.
5 months ago
Kill Chain
Betterment's 2026 Data Breach: A Social Engineering Wake-Up Call
In January 2026, Betterment, a prominent fintech firm, experienced a data breach resulting from a social engineering attack targeting third-party platforms used for marketing and operations. Unauthorized access was gained on January 9, allowing attackers to obtain personal information—including names, email addresses, postal addresses, phone numbers, and dates of birth—of approximately 1.4 million customers. The attackers exploited this access to send fraudulent cryptocurrency-related messages, falsely promising to triple users' crypto investments if they transferred funds to attacker-controlled wallets. Betterment detected the breach on the same day, revoked unauthorized access, and initiated a comprehensive investigation with cybersecurity experts. Importantly, no customer accounts, passwords, or login credentials were compromised during the incident. ([techcrunch.com](https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/?utm_source=openai)) This incident underscores the escalating threat of social engineering attacks within the fintech sector, particularly those targeting third-party service integrations. The breach highlights the critical need for robust security measures, employee training, and vigilant monitoring of external platforms to prevent unauthorized access and protect sensitive customer information.
5 months ago
Kill Chain
Infy APT 2026: Iranian State-Sponsored Cyber Espionage Resurfaces
In early 2026, the Iranian state-sponsored Advanced Persistent Threat (APT) group known as Infy, or 'Prince of Persia,' resumed operations following a period of inactivity during Iran's internet blackout in January. The group deployed updated versions of their malware tools, Foudre and Tonnerre, to target entities across Iran, Iraq, Turkey, India, Canada, and Europe. Notably, Infy utilized a new command-and-control (C2) infrastructure, incorporating both HTTP and Telegram for communication, and exploited a 1-day vulnerability in WinRAR to deliver their payloads. This resurgence underscores Infy's continued commitment to cyber espionage activities aligned with Tehran's strategic interests. ([thehackernews.com](https://thehackernews.com/2026/02/infy-hackers-resume-operations-with-new.html?utm_source=openai)) The re-emergence of Infy highlights the persistent threat posed by state-sponsored cyber actors who continuously evolve their tactics to evade detection. Organizations, especially those in the targeted regions, must remain vigilant and enhance their cybersecurity measures to defend against such sophisticated threats.
5 months ago
Kill Chain
GitHub Codespaces RCE Vulnerability: What Developers Need to Know
In early February 2026, security researchers identified multiple attack vectors within GitHub Codespaces that allow remote code execution (RCE) when users open malicious repositories or pull requests. The vulnerability exploits how Visual Studio Code-integrated configuration files are automatically processed, enabling attackers to execute arbitrary commands, exfiltrate GitHub tokens, and access sensitive resources without explicit user approval. Microsoft has currently deemed this behavior as 'by design,' and no CVE has been assigned. ([scworld.com](https://www.scworld.com/news/vs-code-config-files-abused-to-launch-rces-via-github-codespaces?utm_source=openai)) This incident underscores the growing trend of attackers leveraging trusted development environments to execute malicious code, highlighting the need for enhanced security measures and user awareness in cloud-based development platforms.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports