✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Nomani Scam Exposes AI Deepfake Threats to Social Media in 2025
In 2025, the Nomani investment scam surged by 62%, leveraging sophisticated AI-based deepfake advertisements across major social media platforms including Facebook and YouTube. The scheme utilized convincing fake endorsements and manipulated video content to lure unsuspecting individuals into fraudulent investment schemes. Security firm ESET recorded over 64,000 unique URLs distributing the fraudulent campaign, indicating an expansion both in scale and reach. The attackers exploited trust in familiar faces, rapidly spreading the scam and leading to substantial financial losses and reputational risks for victims and targeted brands. This incident highlights the growing threat of AI-enabled social engineering, with deepfakes enabling unprecedented scale and believability. As identity manipulation technologies proliferate, organizations and regulators face increased pressure to combat fraud, educate users, and adapt security controls to counter the evolving landscape of digital deception.
6 months ago
Kill Chain
WebRAT Infostealer Abuses GitHub: 2024 Supply Chain Attack Exposed
In June 2024, cybersecurity researchers observed a campaign distributing the WebRAT infostealer through malicious GitHub repositories. Threat actors uploaded repositories pretending to offer proof-of-concept exploits for recent vulnerabilities, luring security professionals and researchers to download and execute the malware. Once installed, WebRAT exfiltrates sensitive information, leverages encrypted channels to evade detection, and can facilitate follow-on attacks via credential or data theft. This campaign underscores the risks in sourcing security tools or code from unverified public repositories and demonstrates the sophistication of modern software supply chain attacks. The incident highlights the growing trend of cybercriminals abusing trusted platforms like GitHub to reach a wide audience. With infostealer malware evolving and developer-targeted attacks increasing, organizations must remain vigilant about supply chain security and implement controls to detect and block lateral movement or data exfiltration.
6 months ago
Kill Chain
Malicious Chrome Extensions Steal Credentials in 2024 Supply-Chain Attack
In June 2024, security researchers discovered two malicious Chrome extensions, 'Phantom Shuttle,' available in the official Web Store, that masqueraded as proxy service plugins but instead hijacked users’ browser sessions. Once installed, these extensions intercepted sensitive user data—including login credentials—by redirecting and manipulating network traffic. By deploying the extensions within the Chrome browser ecosystem, threat actors leveraged a trusted supply-chain vector to reach a broad user base without raising immediate suspicion, resulting in widespread data theft before the plugins were reported and removed. This incident highlights the persistent risks associated with supply-chain compromise in browser extension ecosystems. Attackers increasingly exploit official platforms like Chrome’s Web Store to distribute malicious tools, circumvent traditional network defenses, and exfiltrate credentials, underscoring the need for robust extension vetting, user education, and advanced detection capabilities.
6 months ago
Kill Chain
Urban VPN Proxy Secretly Harvests AI Chat Data in Major 2025 Breach
In December 2025, security researchers revealed that Urban VPN, a widely used proxy extension, was surreptitiously intercepting conversations across multiple major AI platforms including ChatGPT, Claude, Gemini, and others. The extension embedded specialized scripts to harvest every prompt, response, and session identifier, regardless of VPN connectivity, compromising the privacy of millions of users. This covert data collection occurred without user awareness or consent, and the only available mitigation was uninstalling the extension altogether. Widespread harvesting of AI chat data raised severe concerns over data confidentiality and regulatory non-compliance. This incident underscores the increasing exploitation of browser extensions as attack vectors, especially as user reliance on generative AI tools for sensitive communications grows. The lack of transparency and opt-out mechanisms amplifies exposure to data-harvesting malware and highlights urgent needs for enhanced supply-chain vetting and detective controls in both enterprise and consumer environments.
6 months ago
Kill Chain
INTERPOL’s Landmark Crackdown: 574 Cybercrime Arrests across Africa in Operation Sentinel
In November 2025, INTERPOL coordinated Operation Sentinel across 19 African nations, resulting in the arrest of 574 suspected cybercriminals and recovery of $3 million. The operation targeted major cybercrime networks involved in business email compromise (BEC), digital extortion, and related ransomware campaigns. Notably, a Ukrainian national associated with ransomware operations pled guilty, highlighting the global breadth of these criminal networks. The operation uncovered sophisticated use of encrypted communication and lateral movement tactics to evade detection, impacting financial institutions and businesses across the continent. The crackdown underscores the evolving nature of cybercrime, with attackers leveraging advanced techniques and international collaboration among law enforcement agencies rising in response. Increased BEC and ransomware threats have pressed organizations in Africa and globally to evaluate existing cybersecurity and compliance controls.
6 months ago
Kill Chain
How Phantom Shuttle Chrome Extensions Undermined Enterprise Security with Man-in-the-Middle Attacks
In December 2025, cybersecurity researchers discovered two versions of a Google Chrome extension named 'Phantom Shuttle' that secretly intercepted network traffic and stole user credentials from over 170 targeted domains. Masquerading as a legitimate VPN and speed test tool, these browser add-ons leveraged proxy permissions and malicious JavaScript code to inject authentication credentials and enable man-in-the-middle attacks. Users paid for subscriptions believing they were purchasing a secure service, while in reality, their web traffic, including passwords, authentication cookies, credit card information, API keys, and browsing histories, was exfiltrated continuously to a threat actor-controlled command-and-control server. The operation leveraged a subscription model and payment integrations via Alipay and WeChat, while traffic was routed through threat actor proxies managed via PAC scripts. This incident highlights a growing trend of browser extension abuse, with attackers monetizing malicious add-ons under the guise of productivity or security tools. With enterprise users increasingly utilizing browser extensions for business workflows, unmanaged browser risk is rapidly becoming a critical threat to organizational data security and compliance.
6 months ago
Kill Chain
Amazon Thwarts Massive North Korean IT Job Scam: Lessons in Zero Trust and Insider Defense
In 2024, Amazon confronted a surge of over 1,800 suspected North Korean state-sponsored IT job scammers who attempted to infiltrate the company’s workforce through fraudulent job applications. The attackers used sophisticated social engineering and impersonation tactics to pose as legitimate IT professionals, seeking remote work to gain internal access or sensitive data. Amazon’s security and HR teams collaborated to detect anomalies, verify identities, and block the hiring process for the fraudulent profiles, successfully preventing insider threats and potential exploitation of corporate assets. The operation underscores the increasing complexity and scale of employment-based attack vectors. This incident is particularly relevant as cybercriminals and nation-state actors are increasingly leveraging remote work trends and IT labor shortages to execute social engineering intrusions. It highlights the need for enhanced workforce vetting, robust anomaly detection, and proactive segmentation to protect organizations from evolving insider and supply chain threats.
6 months ago
Kill Chain
Threat Actors Exploit Zero-Day Vulnerability in WatchGuard Firebox Devices
In early 2024, cybercriminals exploited a previously unknown zero-day vulnerability in WatchGuard Firebox firewall devices, enabling unauthorized remote access and control over affected appliances. Attackers leveraged this flaw to bypass authentication, deploy malware, and establish persistent footholds within targeted organizational networks. The campaign resulted in potential data breaches, service disruptions, and exposure of sensitive internal traffic due to compromised network perimeters. WatchGuard has since released urgent patches and guidance, while security teams raced to detect and remediate compromised devices. This incident highlights the persistent targeting of edge security appliances by advanced threat actors and the speed at which zero-day exploits are weaponized. As remote work and hybrid cloud adoption surge, organizations must prioritize rapid patching and enhanced detection to mitigate risks posed by critical perimeter vulnerabilities.
6 months ago
Kill Chain
Remote Code Execution Risk in Windows Imaging Component: Deep Dive into CVE-2025-50165
In November 2025, researchers exposed a critical vulnerability (CVE-2025-50165) in the Windows Imaging Component, specifically affecting WindowsCodecs.dll. The flaw arises from the mishandling of 12-bit and 16-bit JPG image encoding, where uninitialized function pointers could lead to a remote code execution (RCE) scenario. Attackers could theoretically trigger the vulnerability when a vulnerable application (such as Microsoft Photos or other image-processing tools) attempts to (re-)encode specially crafted JPG files. However, exploitation is complex and requires precise conditions—such as address leaks and heap control—making real-world attacks unlikely. Microsoft and library maintainers released patches to address the flaw by initializing pointers and adding error checks. This case highlights persistent risks in legacy image-processing libraries and the importance of timely patching. With software supply chains increasingly relying on third-party components, vulnerabilities in popular libraries can have broad implications, especially as adversaries probe for new entry points through common file formats.
6 months ago
Kill Chain
Ascension 2024 Breach: How RC4’s Legacy Left Millions Exposed
In May 2024, healthcare giant Ascension suffered a major data breach after threat actors exploited legacy support for the outdated RC4 encryption algorithm in Microsoft Windows environments. Attackers leveraged the well-known 'Kerberoasting' attack technique, enabled by RC4’s weak cryptography, to compromise credentials and move laterally between systems. This breach led to significant operational disruption across 140 hospitals, putting 5.6 million patient records at risk and critically impacting healthcare delivery. The incident highlighted the dangers of legacy cryptography persisting in critical infrastructure. The breach has brought renewed urgency to deprecate outdated cryptographic standards and accelerate upgrades within regulated industries. Regulatory scrutiny and increased attacker focus on cryptographic weaknesses make retiring end-of-life encryption technologies a top priority for all enterprises.
6 months ago
Kill Chain
WatchGuard 2025 RCE Breach Exposes 115,000+ Firebox Firewalls Globally
In December 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-14733, was disclosed impacting over 115,000 WatchGuard Firebox firewalls running Fireware OS. The flaw, residing in the OS iked process, allowed unauthenticated attackers to execute arbitrary code over the network when IKEv2 VPN was enabled. Actively exploited in the wild, the vulnerability placed thousands of organizations worldwide at risk of compromise. Shadowserver reported over 117,000 unpatched instances exposed online days after patches were released. U.S. federal agencies were ordered to patch affected firewalls within one week, with WatchGuard providing indicators of compromise, urgent mitigation steps, and guidance for customers unable to patch immediately. This incident underscores the persistent risk of edge device vulnerabilities and rapid attacker exploitation cycles. With federal mandates, ongoing zero-day disclosures, and increasingly sophisticated attack vectors targeting VPN and firewall infrastructure, organizations must prioritize timely patching and layered defenses to reduce exposure.
6 months ago
Kill Chain
Global Enterprises Breached: Ukrainian Nefilim Ransomware Affiliate Exposed in 2024
In December 2025, Ukrainian national Artem Aleksandrovych Stryzhak pleaded guilty to participating as an affiliate of the Nefilim ransomware gang, responsible for attacks on large enterprises across the U.S., Europe, and Australia between 2021 and 2022. Stryzhak and his accomplices, using custom-tailored ransomware, infiltrated businesses with revenues exceeding $100 million by exploiting online data gathering and targeting internal systems, leading to significant disruptions and ransom demands. Sensitive company data was threatened with public leaks to pressure victims into paying, amplifying both operational and reputational damage. U.S. authorities arrested Stryzhak in Spain in 2024, with sentencing scheduled for 2026. This incident exemplifies the continued operational sophistication and profitability of affiliate-based ransomware models. It also highlights evolving attacker methods that combine technical exploits with business intelligence gathering, and the increasing coordination among international law enforcement to counter cybercrime.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports