✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Fortinet's 2026 Authentication Bypass Vulnerability: A Critical Security Alert
In January 2026, Fortinet disclosed a critical authentication bypass vulnerability (CVE-2026-24858) affecting multiple products, including FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. This flaw allowed attackers with a FortiCloud account and a registered device to gain unauthorized access to other devices registered to different accounts, provided FortiCloud SSO authentication was enabled. Exploitation of this vulnerability led to unauthorized firewall configuration changes, creation of rogue administrator accounts, and potential data exfiltration. Fortinet responded by disabling FortiCloud SSO on January 26, 2026, and subsequently released patches to address the issue. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, urging immediate remediation. This incident underscores the critical importance of timely patch management and vigilant monitoring of authentication mechanisms to prevent unauthorized access and potential data breaches.
6 months ago
Kill Chain
Energy Sector Faces Sophisticated AiTM Phishing and BEC Attack in 2026
In January 2026, a sophisticated adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaign targeted multiple organizations within the energy sector. Attackers exploited SharePoint's file-sharing services to distribute phishing payloads, leading to the compromise of numerous user accounts. The campaign involved creating malicious inbox rules to maintain persistence and evade detection, subsequently launching large-scale phishing attacks both internally and externally. This operation underscores the evolving complexity of AiTM campaigns and highlights the necessity for organizations to implement comprehensive remediation strategies beyond standard identity compromise responses. The incident serves as a critical reminder of the importance of robust security measures, including the revocation of active session cookies and the removal of unauthorized inbox rules, to effectively mitigate such threats.
6 months ago
Kill Chain
Moltbot AI Agent Security Breach: A Wake-Up Call for AI Security
In January 2026, the open-source AI assistant Moltbot, formerly known as Clawdbot, faced significant cybersecurity scrutiny due to its extensive access to user systems. Security researchers discovered hundreds of exposed or poorly secured Moltbot control panels accessible on the public internet, revealing private data such as API keys and allowing unauthorized command execution. Additionally, vulnerabilities like susceptibility to prompt injection attacks and AI hallucinations were identified, raising concerns about the potential for data breaches and system compromises. These findings underscore the critical need for robust security measures in the deployment of AI agents to prevent unauthorized access and data exposure. This incident highlights the growing risks associated with AI agents as they become more integrated into organizational processes. The ease of access and control they offer can inadvertently introduce significant security vulnerabilities if not properly managed. As AI technologies continue to evolve and see wider adoption, it is imperative for organizations to implement stringent security protocols and continuous monitoring to safeguard against emerging threats posed by AI agents.
6 months ago
Kill Chain
Critical LLM Vulnerability: System Prompt Extraction via Form Fields
In January 2026, security researchers identified a critical vulnerability in Large Language Models (LLMs) integrated into AI assistants. Despite implementing architectural constraints to restrict chatbots to templated responses, attackers exploited the models' ability to populate form fields, enabling the extraction of system prompts. This method allowed unauthorized access to sensitive information, bypassing traditional output restrictions. The incident underscores the evolving nature of prompt injection attacks and the necessity for comprehensive security measures in AI deployments. As AI integration becomes more prevalent, understanding and mitigating such vulnerabilities is crucial to maintaining data integrity and user trust.
6 months ago
Kill Chain
Meta AI's 2024 Chatbot Vulnerability Exposes User Data
In December 2024, a critical vulnerability was discovered in Meta AI's chatbot platform, allowing unauthorized users to access private prompts and AI-generated responses of other users. The flaw involved manipulating unique identifiers in the browser's network traffic, enabling access to others' chatbot interactions without proper permission checks. Meta was notified on December 26, 2024, and patched the vulnerability by January 24, 2025. There was no evidence of the flaw being exploited in the wild. This incident underscores the importance of securing AI chatbot platforms against unauthorized access, especially as they handle sensitive user data. Organizations must implement robust authorization mechanisms and regularly audit their systems to prevent similar vulnerabilities.
6 months ago
Kill Chain
Vivaldi Webmail Phishing Attack Exploits Google Presentations - January 2026
In January 2026, a phishing campaign targeted Vivaldi Webmail users by exploiting Google Presentations to bypass security measures. Attackers sent emails containing links to Google Slides presentations, which, when accessed, redirected users to fraudulent login pages designed to harvest credentials. This method effectively circumvented traditional phishing detection mechanisms by leveraging trusted platforms. The incident underscores a growing trend where cybercriminals abuse legitimate services to execute phishing attacks, highlighting the need for enhanced vigilance and adaptive security strategies to counteract evolving threats.
6 months ago
Kill Chain
Introducing Julius: Enhancing AI Security with LLM Service Fingerprinting
In January 2026, Praetorian released Julius, an open-source tool designed to identify and fingerprint Large Language Model (LLM) services across corporate networks. Julius enables security teams to detect various LLM services, such as Ollama, LiteLLM, and Open WebUI, by analyzing endpoints and extracting information about the models in use. This tool addresses the growing challenge of unmanaged and potentially insecure LLM deployments within organizations, which can be exploited by attackers for unauthorized access, data exfiltration, or lateral movement within networks. The release of Julius is particularly timely given the increasing integration of LLMs into enterprise environments and the associated security risks. Recent incidents have highlighted vulnerabilities in LLM applications, including prompt injection attacks and data leakage, underscoring the need for robust detection and monitoring tools like Julius to enhance organizational security postures.
6 months ago
Kill Chain
ServiceNow's 'BodySnatcher' Vulnerability: A Wake-Up Call for AI Security
In October 2025, ServiceNow identified and patched a critical vulnerability, CVE-2025-12420, in its AI Platform. Dubbed 'BodySnatcher,' this flaw allowed unauthenticated attackers to impersonate legitimate users, potentially granting unauthorized access to sensitive enterprise data. The vulnerability affected components such as Now Assist AI Agents and the Virtual Agent API, with ServiceNow deploying security updates to hosted instances and providing patches for self-hosted customers. ([techradar.com](https://www.techradar.com/pro/security/servicenow-patches-critical-security-flaw-which-could-allow-user-impersonation?utm_source=openai)) This incident underscores the growing security challenges associated with AI-driven platforms. Organizations are urged to promptly apply security updates and review their AI system configurations to mitigate similar risks. ([techradar.com](https://www.techradar.com/pro/security/servicenow-patches-critical-security-flaw-which-could-allow-user-impersonation?utm_source=openai))
6 months ago
Kill Chain
Critical Zero-Day Vulnerabilities in Ivanti EPMM Exploited
In January 2026, Ivanti disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340, each with a CVSS score of 9.8. These code injection flaws allow unauthenticated remote attackers to execute arbitrary code on affected systems, potentially leading to unauthorized access to sensitive data and system configurations. Ivanti confirmed active exploitation of these vulnerabilities in a limited number of customer environments at the time of disclosure. ([crn.com](https://www.crn.com/news/security/2026/ivanti-critical-mobile-management-vulnerabilities-seeing-exploitation?utm_source=openai)) The exploitation of these vulnerabilities underscores the persistent threat posed by zero-day attacks targeting enterprise management systems. Organizations are urged to apply the available patches promptly to mitigate the risk of unauthorized access and potential data breaches. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/?utm_source=openai))
6 months ago
Kill Chain
Equifax 2017 Data Breach: Lessons in Cybersecurity
Between May and July 2017, Equifax, a major credit reporting agency, experienced a significant data breach due to unpatched vulnerabilities in their Apache Struts framework. Attackers exploited these weaknesses to access sensitive personal information, including names, Social Security numbers, birth dates, addresses, and, in some cases, driver's license numbers of approximately 147.9 million Americans. The breach also affected millions of individuals in the UK and Canada. Equifax discovered the intrusion on July 29, 2017, but did not publicly disclose it until September 7, 2017. The incident led to widespread criticism, legal actions, and regulatory scrutiny, culminating in a settlement of up to $700 million to address the fallout and implement corrective measures. ([en.wikipedia.org](https://en.wikipedia.org/wiki/2017_Equifax_data_breach?utm_source=openai)) This breach underscores the critical importance of timely software updates and robust cybersecurity practices. The exploitation of known vulnerabilities highlights the necessity for organizations to maintain vigilant patch management and comprehensive security protocols to protect sensitive consumer data.
6 months ago
Kill Chain
Google's 2026 Disruption of IPIDEA Proxy Network
In January 2026, Google’s Threat Intelligence Group (GTIG) disrupted IPIDEA, a China-based residential proxy network that covertly enrolled millions of consumer devices into its infrastructure. By embedding malicious software development kits (SDKs) into various applications, IPIDEA transformed devices into proxy nodes without user consent, facilitating cybercriminal activities such as password spraying and unauthorized access to cloud environments. Google’s intervention, which included legal actions to seize control domains and collaboration with partners like Cloudflare and Lumen’s Black Lotus Labs, resulted in a significant reduction of IPIDEA’s operational capacity, removing millions of devices from the network. ([blog.google](https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/gtig-ipidea-disrupted/?utm_source=openai)) This incident underscores the escalating misuse of residential proxy networks by cybercriminals and state-sponsored actors. The proliferation of such networks highlights the urgent need for enhanced vigilance among developers and consumers regarding the integration and use of third-party SDKs, as well as the importance of industry-wide collaboration to dismantle malicious infrastructures.
6 months ago
Kill Chain
Microsoft Announces Deprecation of NTLM Authentication Protocol
In June 2024, Microsoft announced the deprecation of the NTLM authentication protocol, ceasing its active development and urging organizations to transition to more secure alternatives like Kerberos. This decision was driven by NTLM's inherent security vulnerabilities, including susceptibility to relay attacks and lack of support for modern cryptographic methods. The deprecation process began in early 2025, with phased reductions in support throughout the year, aiming for complete removal by the end of 2027. Organizations relying on NTLM are advised to assess their authentication mechanisms and plan migrations to more secure protocols to mitigate potential security risks. ([threatdown.com](https://www.threatdown.com/blog/microsoft-calls-time-on-ntlm-so-should-you/?utm_source=openai)) The deprecation of NTLM underscores a broader industry shift towards enhancing authentication security. As cyber threats evolve, legacy protocols like NTLM become prime targets due to their known weaknesses. This move aligns with Microsoft's Secure Future Initiative, emphasizing the importance of adopting robust authentication methods to safeguard against emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2024/12/mitigating-ntlm-relay-attacks-by-default?utm_source=openai))
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports