✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Inside the GhostCall & GhostHire Malware Campaigns: BlueNoroff’s 2025 Cryptocurrency Heists
In October 2025, cybersecurity researchers uncovered new attack chains, GhostCall and GhostHire, attributed to BlueNoroff—a sub-group of North Korea's Lazarus Group—targeting the Web3 and blockchain sectors. The campaigns form part of SnatchCrypto, an ongoing operation active since 2017, characterized by sophisticated spear-phishing, malware-laden documents, and social engineering tactics to infiltrate cryptocurrency firms and financial technology startups. Once initial access is gained, attackers deploy custom malware, bypass defenses, and ultimately exfiltrate sensitive data and digital assets, resulting in significant cryptocurrency thefts and disruption across targeted organizations. This campaign is especially concerning amid a surge of advanced persistent threats exploiting trust gaps in rapidly evolving blockchain and cryptocurrency environments. Regulators and cybersecurity teams are on high alert as major financial losses and reputational impacts drive urgency for improved controls, detection, and Zero Trust strategies.
6 months ago
Kill Chain
Memento Labs Leverages Chrome Zero-Day to Deploy LeetAgent Spyware in 2025
In March 2025, a critical zero-day vulnerability (CVE-2025-2783) in Google Chrome was exploited in the wild, enabling threat actors to escape the browser sandbox and deliver espionage-focused LeetAgent spyware attributed to Italian firm Memento Labs. Security researchers from Kaspersky identified targeted campaigns leveraging this flaw to compromise high-value victims via crafted web content, resulting in covert surveillance, data exfiltration, and unauthorized system access before Google patched the issue. This breach underscores the rapid weaponization of browser vulnerabilities by sophisticated actors to distribute espionage tools, often before defenders can respond. Incidents like this demonstrate an uptick in exploitation of high-impact zero-day flaws, especially in widely used software like Chrome, allowing elite cyber espionage operators to rapidly compromise organizations. The trend poses mounting risks as zero-days are increasingly used for targeted intrusions ahead of public disclosure and patch deployment.
6 months ago
Kill Chain
Herodotus Trojan Outsmarts Android Defenses with Human-Like Behavior
In October 2025, cybersecurity researchers uncovered a new Android banking trojan, dubbed Herodotus, actively targeting financial institutions and users in Italy and Brazil. The malware stands out by performing sophisticated device takeover (DTO) attacks while mimicking genuine human behavior—specifically attempting to bypass behavioral biometrics and anti-fraud detection. Herodotus infects devices via malicious apps or phishing, granting attackers near-complete control, which they use to exfiltrate sensitive financial and authentication data by simulating legitimate user interaction. The Herodotus incident underscores a troubling advancement in mobile malware—attackers are increasingly leveraging techniques that closely imitate human behavior to elude cutting-edge security controls. This signals a growing risk for banking apps and enterprises relying on behavioral biometrics, and highlights the urgent need for multilayered zero trust strategies and improved east-west visibility in mobile ecosystems.
6 months ago
Kill Chain
Atroposia RAT: How Turnkey Malware Is Changing Enterprise Threats in 2024
In early 2024, a sophisticated Remote Access Trojan (RAT) named Atroposia emerged for public sale on cybercrime forums, offering low-level attackers turnkey access to advanced capabilities such as persistent remote control, stealth, and evasion. Distributed as a ready-to-use toolkit, Atroposia enables affiliates to deploy the malware with minimal technical skill, significantly lowering the barrier to conducting targeted attacks against organizations. Key behaviors include encrypted communications, lateral movement, and data exfiltration, leveraging evasion techniques to bypass traditional security controls. The rapid adoption of Atroposia among threat actors increases operational risk for organizations lacking modern defenses. The prevalence of Atroposia highlights a growing trend in the cybercrime ecosystem: advanced malware-as-a-service platforms democratize sophisticated attacks, making high-impact breaches increasingly accessible. Enterprises face urgent pressure to modernize lateral movement controls, incident detection, and segmentation as attacker toolkits continue to evolve.
6 months ago
Kill Chain
Memento Spyware: Chrome Zero-Day Attack Sheds Light on Evolving Spyware Threats
In early 2024, cybersecurity researchers identified active exploitation of a zero-day vulnerability in Google Chrome by Memento Labs, deploying sophisticated spyware against select targets worldwide. Memento Labs, known as the successor to the notorious Hacking Team, leveraged the undocumented Chrome exploit to remotely compromise endpoints and gain persistent access. The campaign allowed attackers to harvest sensitive data, monitor communications, and exfiltrate information from compromised browsers, with initial infections traced via malicious websites distributing tailored payloads. Businesses affected faced risks of data breaches, espionage, and unauthorized surveillance impacting operational and reputational trust. This attack is significant due to the revival of commercially available offensive spyware targeting widely used software through zero-days. As high-profile threat actors increasingly exploit browser vulnerabilities, organizations face a heightened threat landscape requiring advanced detection and zero trust protections.
6 months ago
Kill Chain
North Korean BlueNoroff APT Hits Fintech and Web3 in Sophisticated 2024 Crypto Heist
In early 2024, the North Korean APT group BlueNoroff (a sub-group of Lazarus) launched sophisticated cross-platform campaigns against fintech executives and Web3 developers worldwide. The attackers utilized fake business collaboration and job recruitment lures distributed via phishing documents and messaging apps to implant malware on both Windows and macOS devices. Once in the network, BlueNoroff leveraged their established toolkits—including custom backdoors and credential stealers—to escalate privileges and ultimately exfiltrate cryptocurrency assets. This activity resulted in significant fund theft for several organizations, eroding trust in targeted fintech sectors. This incident highlights the continuous evolution of state-sponsored cybercrime groups, who now use highly adaptive social engineering paired with platform-agnostic malware. The financial sector, especially emerging blockchain and crypto startups, remains a primary focus amid a surge of advanced financially-motivated nation-state attacks.
6 months ago
Kill Chain
Morocco’s 'Jingle Thief' Heist Shows Retailers’ Holiday Cyber Weaknesses
In late 2024, the retail sector was targeted by a Morocco-based cybercriminal operation dubbed 'Jingle Thief.' The attackers orchestrated a large-scale gift card fraud campaign by exploiting weaknesses in payment and e-commerce systems. Through phishing and the abuse of unencrypted and east-west traffic within retail networks, the adversaries accessed internal gift card management tools. The stolen gift card data was quickly monetized, resulting in fraudulent transactions and direct financial losses to multiple retailers during the lucrative holiday season. This incident underscores the urgent need for advanced segmentation, strong encryption of data in transit, and continuous network threat detection in retail environments. It also highlights an emerging trend of financially motivated attackers focusing on high-impact, low-resilience periods such as holiday shopping surges.
6 months ago
Kill Chain
How Chinese Gangs Engineered a $1B+ US Credit Card Fraud Wave via Smishing in 2025
In 2025, large-scale social engineering attacks targeted US consumers through smishing campaigns that impersonated legitimate institutions such as highway toll authorities and the US Postal Service. Orchestrated by Chinese criminal organizations, these fraudulent text messages lured victims into divulging their credit card details, which were then monetized to purchase goods via an elaborate scheme. Attackers leveraged the stolen card data by installing it into Google and Apple Wallets in Asia and facilitating cross-border purchases, enabling smooth, large-scale fraud amounting to over $1 billion across a three-year period. This case underscores a recent surge in sophisticated financial fraud campaigns that combine social engineering with digital payment ecosystems, exploiting global tech infrastructure and multi-region collaboration. The landscape sees continued pressure on organizations to safeguard payment and customer data against rapidly evolving threats.
6 months ago
Kill Chain
Invisible Unicode: A 2024 Phishing Campaign Evades Filters with Steganographic Subjects
In October 2024, a targeted phishing campaign exploited invisible Unicode characters—specifically soft hyphens—in email subject lines and bodies to evade detection by automated email filtering systems. The attackers crafted emails with subjects encoded in MIME 'encoded-word' format and used invisible characters to break up suspicious keywords, rendering them undetectable by many traditional filtering solutions. The email lured recipients to a generic credential-stealing webmail page via a deceptive link, aiming to harvest login credentials. This incident highlights a growing trend of adversaries leveraging subtle encoding techniques and Unicode manipulation to bypass security controls. Recent phishing attacks demonstrate increasing sophistication, making it critical for organizations to update their detection mechanisms and user awareness to defend against such evasive TTPs.
6 months ago
Kill Chain
Microsoft WSUS RCE Vulnerability (CVE-2025-59287): Supply Chain Attack Exposes Critical Gaps
In November 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-59287, was identified and exploited in Microsoft’s Windows Server Update Services (WSUS). Threat actors leveraged this flaw by sending malicious payloads via unpatched WSUS endpoints, enabling them to execute arbitrary code on affected servers. The attackers’ methodology consistently involved targeting organizations with exposed WSUS interfaces, compromising update mechanisms, and gaining privileged access. The attack resulted in the deployment of malware, lateral movement within enterprise networks, and in certain cases, potential data exfiltration and operational disruptions. This incident highlights an increasing threat trend involving supply chain attacks that target software update infrastructure. The exploitation of a widely-used service like WSUS underscores the evolving sophistication of attackers and the importance of rapid patching, robust segmentation, and east-west traffic controls in mitigating emerging remote code execution threats.
6 months ago
Kill Chain
Remote Code Execution: WSUS Patch Bypass Turns Trusted Update Service Into Attack Platform
In June 2024, attackers exploited a critical remote code execution vulnerability (CVE-2025-59287) in Microsoft’s deprecated Windows Server Update Services (WSUS), bypassing an emergency patch that was meant to mitigate the threat. Attackers leveraged publicly exposed WSUS servers, executing unauthenticated commands that enabled environmental enumeration and potential data exfiltration. Researchers observed threat activity just hours after Microsoft released a revised patch, with at least 2,800 exposed WSUS instances identified globally. These servers, operating with high system privileges, presented an ideal entry point for attackers to target downstream systems via malicious software updates, elevating the risk of a far-reaching internal supply chain compromise. This incident highlights the increasing risk associated with outdated and internet-exposed infrastructure. It underscores the rapid pace of threat actor adaptation—often outpacing defenders’ patch cycles—and demonstrates the necessity for organizations to promptly apply patches and follow defense-in-depth practices for critical administrative tools.
6 months ago
Kill Chain
RedTiger Infostealer Attack Hits Discord Users in 2024
In early June 2024, cybersecurity researchers uncovered a new campaign in which attackers used a RedTiger-based infostealer to target Discord users. The campaign leveraged the open-source red-team tool RedTiger to build a custom infostealer designed to harvest Discord account credentials and stored payment information by injecting malicious code into Discord’s directories. Victims typically became infected through malicious downloads or phishing websites, unknowingly handing over sensitive data, including authentication tokens and payment details, to the attackers. As a result, stolen Discord accounts were sold or used for further fraud and account takeovers, risking both personal and organizational information leakage. This incident highlights an escalating trend of using open-source red-team tools for malicious infostealer campaigns, boosting attackers’ agility and reach. It underscores the risk of credential-based attacks on popular platforms, the need for real-time threat detection, and reinforces the importance of continuous endpoint monitoring and stronger egress security controls.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports