✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
In July 2026, cybersecurity firm ReliaQuest identified a campaign where attackers compromised Wi-Fi devices in hotels and conference centers to hijack DNS settings. This manipulation redirected users attempting to access legitimate Microsoft 365 login pages to attacker-controlled phishing sites, leading to credential theft. The campaign, active since at least June 2026, affected various sectors, including financial services, healthcare, and retail, across multiple countries such as the U.S., India, and Saudi Arabia. The attackers exploited weakly protected management interfaces or unpatched vulnerabilities in Wi-Fi gateways to gain administrative access and alter DNS configurations. This method allowed them to intercept sensitive business information and communications without direct access to the victims' devices. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai)) This incident underscores the evolving tactics of threat actors, who are increasingly targeting network infrastructure to bypass traditional endpoint security measures. The use of DNS hijacking to facilitate adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including those in transient environments like hotels and conference centers. Implementing robust security practices, such as using always-on, full-tunnel VPNs and encrypted DNS, is crucial to mitigate such threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai))
2 days ago
Kill Chain
Chick-fil-A Data Breach 2026: Credential Stuffing Attack Compromises Customer Accounts
In June 2026, Chick-fil-A experienced a credential stuffing attack targeting its website and mobile application. Between June 17 and June 19, unauthorized parties used previously compromised credentials to access Chick-fil-A One loyalty accounts. The breach exposed sensitive customer information, including names, email addresses, membership numbers, mobile pay numbers, partial payment card digits, and potentially birth dates, phone numbers, and addresses. In total, 13,322 individuals were affected across multiple states. Chick-fil-A responded by logging out impacted accounts, removing stored payment methods, restoring account balances, and issuing additional rewards to affected customers. This incident underscores the persistent threat of credential stuffing attacks, which exploit reused or compromised credentials to gain unauthorized access to user accounts. The recurrence of such attacks highlights the critical need for organizations to implement robust security measures, including mandatory multi-factor authentication and proactive monitoring, to protect customer data and maintain trust.
2 days ago
Kill Chain
Hermes AI Agent's Role in Thai Finance Ministry Cyberattack
In July 2026, threat intelligence firm Hunt.io and security researcher Bob Diachenko uncovered a cyberattack targeting Thailand's Ministry of Finance. The attackers utilized the open-source Hermes AI agent in its unattended 'YOLO' mode to automate post-exploitation activities. Evidence from exposed web directories indicated that multiple systems within the ministry's network were compromised. The attack involved deploying web shells, exploiting internal services such as Hadoop and Apache Ambari, and attempting to access personnel records dating back to 2012. Despite these findings, the Ministry of Finance has not confirmed the breach. This incident underscores the escalating use of autonomous AI agents in cyberattacks, highlighting the need for enhanced security measures against AI-driven threats. The ability of AI agents to operate independently and execute complex attack sequences poses significant challenges for traditional cybersecurity defenses.
2 days ago
Kill Chain
BlueNoroff's 2026 Zoom Phishing Campaign: A Wake-Up Call for Crypto Firms
In July 2026, the North Korean state-sponsored group BlueNoroff launched a sophisticated phishing campaign targeting cryptocurrency organizations. The attackers utilized typosquatted Zoom and Microsoft Teams domains to impersonate legitimate videoconferencing platforms. By hijacking trusted Telegram accounts, they invited high-ranking employees to fake meetings, where victims were prompted to grant webcam access. This access allowed the attackers to profile victims' cryptocurrency wallets before delivering malware, enabling selective targeting of high-value individuals. This incident underscores the evolving tactics of threat actors who exploit trust in widely used communication platforms. The integration of social engineering with advanced reconnaissance techniques highlights the need for heightened vigilance and robust security measures within the cryptocurrency sector.
2 days ago
Kill Chain
Interlock Ransomware's 2026 Exploitation of Cisco FMC Zero-Day Vulnerability
In early 2026, the Interlock ransomware group exploited a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) software, allowing unauthenticated remote code execution as root. This exploitation began on January 26, 2026, 36 days prior to Cisco's public disclosure on March 4, 2026. The attackers leveraged this vulnerability to gain initial access, deploying custom malware and remote access tools to establish persistence, conduct reconnaissance, and ultimately deploy ransomware across various sectors, including education, healthcare, and manufacturing. The campaign demonstrated a high level of sophistication, utilizing fileless implants and memory-resident webshells to evade detection. ([aws.amazon.com](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/?utm_source=openai)) This incident underscores the increasing trend of ransomware groups exploiting zero-day vulnerabilities to infiltrate enterprise networks. The rapid exploitation of CVE-2026-20131 highlights the critical need for organizations to implement proactive vulnerability management, continuous monitoring, and robust incident response strategies to mitigate the risks associated with such advanced persistent threats.
2 days ago
Kill Chain
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage
In July 2026, cybersecurity researchers uncovered HollowGraph, a sophisticated malware that exploits Microsoft 365 calendar events for covert command-and-control (C2) communication and data exfiltration. By embedding encrypted instructions and stolen data within calendar events dated far into the future (e.g., May 13, 2050), HollowGraph effectively evades detection by blending malicious activities with legitimate Microsoft Graph API traffic. This technique has been observed targeting at least 12 Israeli organizations, with active communications detected between June and July 2026. The malware's design allows it to bypass traditional security measures, posing significant risks to organizations relying on Microsoft 365 services. The emergence of HollowGraph underscores a growing trend where threat actors leverage trusted cloud services to conduct stealthy cyber-espionage campaigns. This incident highlights the critical need for organizations to enhance monitoring of cloud-based activities, implement robust identity and access management controls, and stay vigilant against novel attack vectors that exploit legitimate platforms for malicious purposes.
2 days ago
Kill Chain
Critical Azure Automation Vulnerability (CVE-2025-29827) Exposes Cross-Tenant Identity Risks
In May 2025, a critical vulnerability (CVE-2025-29827) was identified in Microsoft's Azure Automation service, which is widely used for DevOps, resource deployment, and configuration management. The flaw stemmed from improper authorization mechanisms, allowing authenticated attackers to escalate privileges over the network. Exploiting this vulnerability, attackers could assume another tenant's automation identity, enabling them to create or modify automation scripts and access sensitive configuration data or credentials stored in Azure Automation accounts. This could lead to unauthorized creation, modification, or deletion of resources across an organization's cloud workloads. The vulnerability was assigned a CVSS score of 9.9, indicating its critical severity. Microsoft addressed the issue by updating the default settings to prevent automation accounts from being publicly accessible and issued an advisory to inform users of the necessary security measures. Organizations are advised to audit their Azure Automation configurations and ensure that proper access controls are in place to mitigate potential attacks.
2 days ago
Kill Chain
AI Agents Uncover Critical Redis Vulnerabilities: Immediate Action Required
In July 2026, researchers utilizing Moonshot AI's Kimi K3 agents identified multiple zero-day vulnerabilities in Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities allowed authenticated remote code execution (RCE) through the RESTORE command, with additional dependencies on EVAL, XGROUP, and the RedisBloom module in certain versions. Redis promptly released seven security updates on July 23, 2026, to address these critical flaws. Organizations using affected Redis versions are urged to upgrade immediately to mitigate potential exploitation risks. ([eweek.com](https://www.eweek.com/news/moonshot-ai-kimi-k3-redis-rce-exploits-apac-china/?utm_source=openai)) This incident underscores the accelerating role of AI in both discovering and potentially exploiting software vulnerabilities. The rapid identification and proof-of-concept development by AI agents highlight the need for organizations to enhance their security posture and response times to emerging threats. ([news.shield53.com](https://news.shield53.com/ai-agents-discover-redis-zero-days-cve-analysis-and-rce-threat-across-redis-6x8x/?utm_source=openai))
2 days ago
Kill Chain
Golden Chickens Introduces Four New Modular Malware Families in 2026
In July 2026, the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem, also known as Venom Spider, introduced four new malware families: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and ChromEggscalator. These developments signify a strategic shift towards modular, operator-driven tools within the TAG-195 MaaS ecosystem. The modularized ChonkyChicken variant employs a controller-and-plugin architecture, allowing the base implant to dynamically load specific capability modules from attacker-controlled infrastructure, thereby reducing its static detection footprint. All four malware families exhibit consistent command-and-control mechanisms, shared persistence methods, string obfuscation, and execution via legitimate Windows binaries. This evolution underscores TAG-195's commitment to enhancing the adaptability and stealth of its offerings, catering to a diverse range of operational requirements. The emergence of these advanced, modular malware families highlights the ongoing sophistication of MaaS providers and the necessity for organizations to bolster their detection and response strategies against such evolving threats.
2 days ago
Kill Chain
Certighost Exploit: A New Threat to Active Directory Security
In July 2026, researchers H0j3n and Aniq Fakhrul disclosed a critical vulnerability in Active Directory Certificate Services (AD CS), dubbed 'Certighost'. This flaw allows low-privileged Active Directory users to obtain certificates for Domain Controllers, enabling them to impersonate these controllers. Exploiting this vulnerability, attackers can retrieve the 'krbtgt' secret through DCSync, potentially compromising the entire domain. Microsoft addressed this issue with the release of CVE-2026-54121, assigning it a CVSS score of 8.8. Organizations utilizing Enterprise CAs are urged to apply the July 14 updates promptly to mitigate this risk. The public availability of a proof-of-concept exploit underscores the urgency of this matter. While no active exploitation has been reported as of July 24, the existence of a working exploit increases the likelihood of future attacks targeting unpatched systems.
2 days ago
Kill Chain
ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security
In June 2026, Zenity Labs identified a critical vulnerability in OpenAI's ChatGPT Workspace Agents, termed 'AgentForger.' This flaw allowed attackers to craft a phishing link that, when clicked by an employee, could silently create and deploy an autonomous AI agent within the organization's ChatGPT environment. This rogue agent would inherit the employee's identity and access privileges, operating without the employee's knowledge or consent. OpenAI addressed and patched this vulnerability by June 8, 2026. ([zenity.io](https://zenity.io/company-overview/newsroom/company-news/zenity-labs-uncovers-agentforger-a-chatgpt-vulnerability?utm_source=openai)) The 'AgentForger' incident underscores the evolving nature of cyber threats targeting AI systems. As organizations increasingly integrate AI agents into their workflows, ensuring robust security measures and prompt vulnerability management becomes paramount to prevent unauthorized access and potential data breaches.
2 days ago
Kill Chain
Russian Espionage Group Exploits Zimbra Vulnerability in 2025
In July 2025, the Russian state-sponsored threat group known as Laundry Bear initiated a cyber espionage campaign targeting government and commercial organizations by exploiting a zero-day vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS). This vulnerability allowed attackers to execute malicious JavaScript via CSS @import directives in HTML emails, enabling unauthorized access to sensitive data such as emails, passwords, and two-factor authentication tokens. The exploit required no user interaction beyond viewing a malicious email, leading to significant data breaches across multiple sectors. ([cyberscoop.com](https://cyberscoop.com/russian-laundry-bear-zimbra-exploit/?utm_source=openai)) The continued exploitation of unpatched ZCS instances underscores the critical need for organizations to promptly apply security updates. This incident highlights the evolving tactics of state-sponsored actors and the importance of proactive cybersecurity measures to protect sensitive information. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4553352/nsa-and-partners-alert-zimbra-collaboration-suite-users-of-a-russian-state-supp/?utm_source=openai))
2 days ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports