✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
MongoBleed 2025: Critical MongoDB Vulnerability Exposes Data on 87K Servers
In early June 2025, the MongoBleed vulnerability (CVE-2025-14847) was actively exploited against MongoDB servers worldwide, exposing sensitive database secrets and credentials on over 87,000 publicly accessible systems. Attackers exploited a flaw present in multiple MongoDB versions, allowing unauthorized access to in-transit data and internal database secrets without authentication. The exposure occurred as a result of inadequate encryption and misconfiguration, providing an entry point for lateral movement, data exfiltration, and potentially further compromise of enterprise networks. Organizations in finance, healthcare, SaaS, and retail sectors have been especially impacted by this incident, given their widespread MongoDB adoption for critical workloads. This breach highlights an increasingly common pattern of weaponizing newly disclosed database vulnerabilities at scale by sophisticated threat actors. The incident underscores the urgent need for robust encryption practices, Zero Trust segmentation, and vigilant patch management to protect highly sensitive data and prevent large-scale exposure as regulatory scrutiny and attacker sophistication intensify.
6 months ago
Kill Chain
SEC Uncovers $14M Crypto Scam Using Fake AI-Themed Investment Clubs
In late 2025, the U.S. Securities and Exchange Commission charged a network of fraudulent crypto trading platforms and investment clubs for orchestrating a $14 million scam targeting retail investors. The scammers operated platforms such as Morocoin Tech Corp., Berge Blockchain Technology Co., Ltd., and Cirkor Inc., as well as front groups like AI Wealth Inc. and others, leveraging social media ads and WhatsApp messages promising AI-driven trading tips. Victims were enticed to buy into phony 'Security Token Offerings' with guarantees of high returns, only to be tricked a second time by advance withdrawal fees before all funds were siphoned to overseas accounts, predominantly in Asia. This incident underscores the urgent risk of AI-wash fraud and the exploitation of digital messaging channels to build investor trust. As cryptocurrency scams grow more sophisticated and regulatory scrutiny intensifies, organizations and individuals should exercise heightened vigilance against elaborate schemes blending false credentials, social engineering, and AI-themed deception.
6 months ago
Kill Chain
Active Exploitation of Fortinet SSL VPN 2FA Bypass Shows Criticality of Patch Hygiene
In December 2025, Fortinet disclosed ongoing, active exploitation of a previously known vulnerability (CVE-2020-12812) affecting FortiOS SSL VPN devices. The flaw allows attackers to bypass two-factor authentication (2FA) by manipulating the case sensitivity of usernames when certain configurations are in place, specifically when integrating local users with LDAP groups. This misconfiguration enables unauthorized access for administrative and VPN users, as attackers can skip required 2FA checks and authenticate directly via LDAP. The vulnerability, originally patched in 2020, has resurfaced due to a large number of unpatched and exposed Fortinet devices, with over 9,700 instances still vulnerable worldwide as of January 2026. This incident exemplifies the persistent risk of legacy vulnerabilities, particularly in Internet-facing VPN and perimeter security devices. Attackers are increasingly revisiting older weaknesses to target unpatched infrastructure, elevating the urgency for ongoing patch management and configuration reviews in enterprise environments.
6 months ago
Kill Chain
Critical Vulnerability in LangChain Core Exposes Secrets and Enables Prompt Injection
In December 2025, a critical vulnerability was disclosed in LangChain Core, a widely used Python package within the LangChain open-source ecosystem. Attackers were able to exploit a flaw in the serialization process, resulting in exposure of sensitive secrets and the ability to manipulate large language model (LLM) responses via prompt injection. The underlying vulnerability allowed threat actors to craft malicious payloads, leading to remote code execution in environments where untrusted input could be serialized, posing major risks to organizations relying on LangChain-powered AI workflows. This supply-chain attack path also opened the door for access to credentials and proprietary data. This incident highlights the expanding threat landscape targeting AI infrastructure and software supply chains. With the surge of enterprise adoption of AI and LLMs, vulnerabilities in core AI frameworks are increasingly attractive to threat actors, underscoring regulatory scrutiny and the need for robust code security practices within open-source dependencies.
6 months ago
Kill Chain
Critical MongoDB Flaw Exposes Sensitive Server Memory to Unauthenticated Threats
In December 2025, a critical security flaw (CVE-2025-14847) was publicly disclosed in multiple versions of MongoDB, exposing organizations to the risk of uninitialized memory disclosure by unauthenticated attackers. The flaw stems from improper handling of length parameter inconsistencies within zlib compressed protocol headers, allowing remote, unauthenticated clients to read uninitialized heap memory. Impacted versions span major MongoDB releases 3.6 through 8.2, potentially exposing sensitive data in server memory. MongoDB responded by releasing patches and advised urgent upgrades or the disabling of zlib compression. This incident gains heightened significance as memory disclosure vulnerabilities enable threat actors to harvest sensitive information without authentication. The vulnerability underscores the increasing importance of rigorous software supply chain security and timely patch management amid a growing landscape of data exposure risks in widely used open-source technologies.
6 months ago
Kill Chain
Trust Wallet Chrome Extension Supply Chain Attack Results in $7 Million Crypto Theft
In December 2023, Trust Wallet, a prominent cryptocurrency wallet provider, suffered a supply chain attack via its Chrome extension. Attackers compromised the extension update process on December 24, distributing malicious code to unsuspecting users. As a result, users who installed the tainted update had their crypto wallets drained, collectively losing over $7 million worth of digital assets. The attack leveraged phishing domains to trick users and highlighted gaps in software supply chain security. Trust Wallet responded swiftly with advisories and efforts to contain further compromise while warning all extension users. This breach underscores the escalating threat and sophistication of supply chain attacks targeting digital assets, echoing a sharp rise in attacks exploiting third-party software update channels. Organizations must prioritize controls around extension security, continuous monitoring, and response plans to mitigate similar high-impact incidents.
6 months ago
Kill Chain
Trust Wallet Chrome Extension Breach: $7M in Crypto Lost to Supply Chain Attack
In December 2025, Trust Wallet suffered a major supply chain attack when a malicious version (2.68) of its Chrome browser extension was published via a compromised Chrome Web Store API key. The attacker embedded backdoored code that exfiltrated users’ decrypted mnemonic phrases to an external server, allowing theft of approximately $7 million in cryptocurrencies. Over 2,500 wallet addresses were impacted, with stolen funds laundered through centralized exchanges and cross-chain bridges. Trust Wallet responded by urging users to upgrade to a safe version, launching a reimbursement program, and enhancing release procedures. This breach highlights the growing risks of supply chain attacks targeting widely-used browser extensions, especially in the cryptocurrency sector. With attackers demonstrating sophistication by bypassing official release processes and leveraging trusted analytics tools for data exfiltration, organizations face mounting pressure to secure development and release pipelines against insider threats and credential misuse.
6 months ago
Kill Chain
2025's Stealth Loader and AI Exploit Wave: How Multi-Vector Attacks Redefined Cybersecurity
In late 2025, a coordinated wave of global cyber attacks leveraged stealthy multi-vector campaigns with commodity loaders, AI-powered exploits, and social engineering. Attackers weaponized legitimate tools like Nezha for post-exploitation, orchestrated large-scale phishing using fake updates and PoC exploits, and targeted both enterprise and consumer platforms. These campaigns saw loaders like Caminho deliver diverse malware such as XWorm, PureLogs, and RATs into manufacturing, government, and IT networks across several regions. Simultaneously, attackers abused vulnerabilities in AI assistants and exploited weaknesses in NFC-enabled Android malware, achieving persistent access, privilege escalation, data exfiltration, and lateral movement—all while skillfully blending malicious traffic with normal system behaviors. This incident highlights a sharp evolution in attack methods as threat actors increasingly favor low-noise, blended tradecraft over traditional smash-and-grab approaches. With the convergence of signature evasion, AI system manipulation, and commodity loader sharing, defenders must shift toward integrated, threat-aware security architectures. These incidents mark a critical inflection point, signaling a persistent rise in invisible, multi-layered threats fueled by automation and attacker collaboration.
6 months ago
Kill Chain
LastPass 2022 Breach Fuels Years-Long Cryptocurrency Heists by Russian Actors
In 2022, LastPass suffered a significant data breach that enabled attackers to steal encrypted password vaults, exposing sensitive customer credentials, including cryptocurrency wallet keys and seed phrases. According to research by TRM Labs, Russian cybercriminals exploited weak master passwords over subsequent years, decrypting vaults offline and siphoning more than $35 million in digital assets as recently as late 2025. Stolen funds were laundered using advanced cryptocurrency mixing and routed through sanctioned Russian exchanges. The incident underscores a persistent threat model: stolen encrypted data can remain exploitable for years if password hygiene and vault security are neglected. The breach’s fallout continues to evolve, heightening urgency for organizations to reassess encryption, password management, and layered defense strategies.
6 months ago
Kill Chain
Operation Sentinel: Global Crackdown on African Cybercrime Syndicates in 2024
In June 2024, Operation Sentinel saw a sweeping law enforcement crackdown on African-based cybercrime syndicates, with authorities across 19 countries arresting 574 individuals and recovering over $3 million in illicit funds. The syndicates, operating throughout sub-Saharan Africa, orchestrated widespread business email compromise (BEC), digital extortion, and ransomware attacks. The multi-vector threat campaign exploited unencrypted traffic, lateral movement within networks, and common gaps in segmentation and egress controls. The collective action disrupted dozens of criminal infrastructures, protected strategic sectors, and exposed critical weaknesses across hybrid and cloud-connected environments. This operation underscores the growing collaboration between threat actors spanning continents, the use of sophisticated tactics like lateral movement, and heightened regulatory scrutiny. As hybrid work and cloud adoption accelerate, organizations face increasing risks from financially motivated cybercriminals exploiting east-west security gaps and insufficient threat detection.
6 months ago
Kill Chain
Typosquatted MAS Domain Delivers PowerShell Malware in 2024 Attack
In early 2024, cybersecurity researchers identified a campaign leveraging a typosquatted domain mimicking the legitimate Microsoft Activation Scripts (MAS) tool to distribute the 'Cosmali Loader' malware. Unsuspecting users seeking MAS utilities were tricked into downloading malicious PowerShell scripts, which silently loaded the Cosmali Loader onto Windows machines. The loader subsequently enabled additional payload delivery, providing attackers with persistent access and the ability to deploy further malware or conduct post-infection activities. The incident demonstrates the ongoing risks of social engineering via typosquatting and open-source tool impersonation, with users and organizations inadvertently compromising their systems. This campaign is particularly relevant as it highlights the resurgence of supply chain threats and the increasing sophistication of threat actors leveraging typosquatted domains to bypass conventional defenses. The incident signals a growing trend targeting both individual users and enterprise environments through deceptive domains and script-based malware.
6 months ago
Kill Chain
MacSync Stealer 2025: Notarized macOS Malware Defeats Gatekeeper Protections
In June 2025, security researchers uncovered a new campaign leveraging a variant of the MacSync information stealer, which specifically targets macOS devices. In this incident, attackers distributed malware using a digitally signed and Apple-notarized Swift-based application disguised as a messaging app installer. This approach allowed the threat to bypass Apple Gatekeeper security controls designed to prevent unauthorized software execution. Once executed, the stealer harvested sensitive user data—such as browser credentials, wallets, and system information—and exfiltrated it to remote attacker-controlled servers, posing significant operational and reputational risks to affected organizations and users. This incident highlights a growing trend wherein adversaries employ legitimate-looking, signed applications to circumvent platform defenses. With an uptick in sophisticated macOS attacks and abuse of code-signing, organizations need to bolster defenses and maintain heightened vigilance for notarized application threats in enterprise environments.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports