✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026
In January 2026, Fortinet confirmed the existence of a critical authentication bypass (CVE-2025-59718) affecting its FortiCloud SSO feature, leaving fully patched devices vulnerable to compromise. Attackers exploited a patch bypass to gain administrative access, quickly creating VPN-enabled accounts and exfiltrating firewall configurations. Despite an earlier advisory, threat actors continued to exploit an unaddressed attack path, with the campaign becoming automated and impacting organizations globally. Evidence included unauthorized logins and suspect account creation, prompting urgent investigation and forensic response from network teams. This breach illustrates the growing risk posed by incomplete patches and the relentless pursuit by attackers of residual vulnerabilities, particularly in widely deployed network security products. It underscores the critical need for continuous monitoring, rapid patch validation, and limiting administrative access to sensitive management interfaces.
6 months ago
Kill Chain
CISA Confirms Active Exploitation of Enterprise Supply Chain Vulnerabilities in 2026
In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of four critical vulnerabilities in enterprise software spanning supply chain, SD-WAN orchestration, front-end tooling, and webmail platforms. Attackers capitalized on flaws such as authentication bypasses in Versa Concerto, a supply-chain compromise in the eslint-config-prettier npm package, and local file inclusion in Zimbra's Webmail UI, bypassing access controls and risking the exposure of sensitive data and credentials. The vulnerabilities affected a range of organizations using these widely distributed platforms, underscoring the risks posed by third-party and open-source dependencies in software supply chains. This incident highlights a growing trend where attackers leverage chained vulnerabilities and software supply chain weaknesses to achieve lateral movement, privilege escalation, and large-scale data exfiltration. As regulatory scrutiny increases and adversaries target both enterprise and developer ecosystems, rapid patch management and improved visibility into third-party code become urgent mandates for security leaders.
6 months ago
Kill Chain
Malicious AI Extensions in VSCode Marketplace Steal Developer Data, Impacting 1.5 Million Users
In January 2026, researchers at Koi Security discovered that two AI-powered Visual Studio Code (VSCode) Marketplace extensions—ChatGPT – 中文版 and ChatMoss (CodeMoss)—were secretly exfiltrating developer files and sensitive data to China-based servers. Together, these malicious extensions had been installed 1.5 million times and collected data using real-time file monitoring, workspace file harvesting, and covert user profiling via embedded commercial analytics SDKs. The compromised extensions transmitted not only source code but potentially included API keys, configuration, and credential files without user consent, representing a major supply-chain compromise in the software development ecosystem. This incident highlights the persistent risks developers face from supply chain attacks through third-party plugins. As AI-driven code assistants surge in popularity, attackers are increasingly exploiting trusted extension marketplaces to deploy sophisticated data-stealing campaigns, raising urgent concerns for software security, compliance, and marketplace governance.
6 months ago
Kill Chain
AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)
In January 2026, Intruder Security revealed an application security vulnerability in their intentionally vulnerable honeypot, stemming from AI-generated code that mishandled client-supplied IP headers. The AI-assisted system incorrectly trusted IP values in HTTP headers without enforcing a trust boundary, allowing attackers to inject payloads or spoof source IP information. This oversight, undetected by common static analysis tools, resulted in attacker-controlled inputs influencing system logic, posing potential risks for local file disclosure or server-side request forgery had the vulnerable code path been used differently. While the actual impact remained low due to the isolated nature of the honeypot, the incident highlights significant gaps in current AI-assisted development and security review processes. This event underscores the growing prevalence of AI-generated vulnerabilities and the limitations of automated security tools in identifying nuanced flaws. As enterprises increasingly rely on AI-driven coding and automation, such oversights are likely to become more common, emphasizing the need for robust validation and updated security governance.
6 months ago
Kill Chain
US ATM Jackpotting 2024: Venezuelan Hackers Steal Hundreds of Thousands Using Malware
In early 2024, federal prosecutors in South Carolina uncovered a sophisticated ATM jackpotting scheme perpetrated by two Venezuelan nationals. Employing financial malware, the attackers compromised U.S. bank ATM networks and extracted hundreds of thousands of dollars in cash. The scheme involved the unauthorized installation of malware on ATM machines, which enabled the criminals to override withdrawal limits and rapidly dispense large sums of money. Following their arrest, both individuals were convicted and will be deported after serving their sentences, highlighting significant vulnerabilities in ATM security and network segmentation. This incident reflects a growing trend in financial crime, where cybercriminals target banking infrastructure using advanced malware and physical access techniques. Regulators and banks are increasingly focused on hardening ATM systems and tightening controls to prevent similar attacks as cyber-enabled fraud remains a persistent and evolving threat.
6 months ago
Kill Chain
Microsoft Uncovers 2026 Multi-Stage BEC Attack Targeting Energy Sector
In January 2026, Microsoft identified a sophisticated multi-stage business email compromise (BEC) attack targeting several prominent energy sector organizations. The attackers leveraged adversary-in-the-middle (AitM) phishing tactics, abusing SharePoint file-sharing services to distribute malicious payloads and gaining user trust with legitimate-looking links. Once initial access was achieved, the threat actors established persistent access by creating malicious inbox rules, allowing them to hijack email conversations, evade user detection, and execute fraudulent transactions. The campaign underscores the evolving nature of BEC schemes and their business impact, with potential exposure of sensitive data and financial losses. This incident exemplifies a significant escalation in the complexity and persistence of phishing-driven BEC campaigns affecting critical infrastructure. As regulatory scrutiny increases and attackers continually evolve tactics, this case highlights the urgent need for modern defenses against advanced social engineering and privileged access abuse.
6 months ago
Kill Chain
Fortinet Zero-Day SSO Bypass Targets Fully Patched Firewalls in 2026
In January 2026, Fortinet confirmed that attackers actively exploited a new authentication bypass vulnerability affecting FortiCloud SSO on fully patched FortiGate firewalls. Despite organizations applying the latest security updates, adversaries used an undisclosed flaw to circumvent authentication protections, gaining unauthorized administrative access to network infrastructure. The incidents were detected within 24 hours of the latest firmware deployment, leading to compromised management interfaces and potentially broad security implications for affected enterprises utilizing FortiCloud SSO for remote management and single sign-on. This breach underscores a persistent challenge in cloud-managed network security: even well-maintained, up-to-date systems may be vulnerable to zero-day exploits. The event highlights increased attacker focus on SSO and management plane weaknesses, as well as the importance of layered defenses, rapid detection, and coordinated response in modern enterprise security architecture.
6 months ago
Kill Chain
CISA Flags Four Actively Exploited Vulnerabilities: 2026 Software Risk Alert
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to include four new software flaws confirmed as actively exploited in the wild. Among these, CVE-2025-68645 in the Synacor Zimbra Collaboration Suite enables remote file inclusion through a PHP vulnerability, presenting severe risks of remote code execution and unauthorized access. Attackers have been leveraging these vulnerabilities to infiltrate enterprise and government infrastructures, resulting in the exposure of sensitive data and disruption of critical collaboration services. This incident exemplifies the accelerating pattern of opportunistic exploitation by cybercriminals and state-backed actors who quickly weaponize disclosed vulnerabilities. It highlights the urgent need for timely patching, robust segmentation, traffic monitoring controls, and adherence to regulatory frameworks such as HIPAA, PCI DSS, and NIST to effectively mitigate operational risk.
6 months ago
Kill Chain
How Stolen Credentials Enabled Stealthy LogMeIn RMM Attacks in 2026
In January 2026, researchers reported a campaign where attackers leveraged phishing emails to steal valid user credentials, allowing them to deploy legitimate LogMeIn Remote Monitoring and Management (RMM) software for covert, persistent access to corporate systems. By utilizing IT tools typically trusted by administrators rather than custom malware, the adversaries successfully bypassed traditional security measures and gained unrestricted access to sensitive business environments. The campaign underscores the increasing sophistication of credential-based attacks and the risks posed by the misuse of legitimate remote access tools. This incident is vital in the current cybersecurity landscape as it exemplifies the growing threat of identity-driven attacks and the exploitation of trusted IT software. Organizations face mounting regulatory and operational pressure to enforce zero trust principles and segment internal traffic, as traditional perimeter defenses and malware-centric detection are increasingly ineffective against modern attacker tactics.
6 months ago
Kill Chain
VMware vCenter Vulnerability (CVE-2024-37079) Actively Exploited—CISA Issues Immediate Directive
In January 2026, CISA added CVE-2024-37079, a critical out-of-bounds write vulnerability in Broadcom VMware vCenter Server, to its Known Exploited Vulnerabilities (KEV) Catalog due to verified evidence of active exploitation. This flaw enables attackers to execute arbitrary code or cause denial-of-service on affected vCenter deployments, potentially leading to unauthorized access, lateral movement, or data exfiltration. The vulnerability presents a heightened risk to federal agencies and enterprises relying on VMware infrastructure, as attackers frequently target such foundational management servers. The incident underscores escalating threats against widely used virtual infrastructure platforms, with attackers exploiting newly disclosed vulnerabilities before patch adoption. CISA’s rapid update to the KEV Catalog reaffirms urgent regulatory expectations for vulnerability management and highlights the broader necessity for real-time patching and enhanced segmentation to mitigate exploitation risk.
6 months ago
Kill Chain
Fortinet Firewalls Compromised: 2024 Malicious Configuration Attack Exposes Networks
In early 2024, threat actors exploited unpatched and even fully patched Fortinet FortiGate firewalls, deploying malicious automation to illicitly access and exfiltrate firewall configuration files. Attackers leveraged vulnerabilities or misconfigurations to automate the compromise of a significant number of devices globally, granting them access to sensitive internal network details, VPN credentials, and administrative information. The targeted manipulation of device configurations allowed for persistent access and posed a risk of lateral movement deeper into enterprise environments. Impacted organizations faced potential exposure of encrypted traffic configurations and gateway policies, undermining both security posture and compliance. This incident is especially relevant as network infrastructure compromises grow more frequent and sophisticated, with attackers rapidly shifting tactics to automate attacks and bypass traditional perimeter defenses. The breach highlights the ongoing challenges organizations face in protecting network infrastructure against highly motivated and well-resourced threat actors.
6 months ago
Kill Chain
AI Agents Breach Simulated Enterprise via Open-Source Tools: Claude Sonnet 4.5 Equifax-Style Attack
In January 2026, researchers demonstrated that the latest Anthropic Claude Sonnet 4.5 AI model could autonomously breach simulated enterprise networks using only standard, open-source tools without custom malware or frameworks. During testing, the AI model rapidly identified and exploited an unpatched, publicized vulnerability to exfiltrate sensitive (simulated) personal data, mimicking tactics similar to the original Equifax breach. This exercise revealed how advanced AI agents now lower the technical barriers for rapid, multistage cyberattacks, enabling them to recognize and exploit vulnerabilities far faster than manual attackers. This incident underscores the accelerating risk posed by AI-powered offensive cyber capabilities. The proliferation of autonomous cyber agents marks a turning point, driving urgent regulatory, corporate, and operational focus on timely patch management, zero trust architectures, and advanced detection to stay ahead of next-generation threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports