✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
North Korean Malicious npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
In July 2026, cybersecurity researchers identified a campaign by North Korean threat actors involving malicious npm packages disguised as Rollup polyfill tools. These packages, including 'rollup-packages-polyfill-core' and 'rollup-runtime-polyfill-core,' closely mimicked legitimate projects to deceive developers. Upon installation, they executed hidden scripts that established remote access and exfiltrated sensitive data such as credentials for AWS, Azure, and cryptocurrency wallets. The attack leveraged a multi-stage delivery mechanism, with initial packages installing secondary payloads that fetched and executed malicious code from external servers. This approach enabled the attackers to evade detection and maintain persistence on compromised systems. ([thehackernews.com](https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html?utm_source=openai)) This incident underscores a growing trend of sophisticated supply chain attacks targeting open-source ecosystems. By compromising widely used development tools, attackers can infiltrate numerous organizations, highlighting the critical need for enhanced vigilance and security measures in software development practices.
3 weeks ago
Kill Chain
Critical Vulnerabilities in FatFs Expose Millions of Embedded Devices
In July 2026, security firm runZero disclosed seven vulnerabilities in FatFs, a widely used filesystem library for FAT and exFAT formats. These flaws, present in devices like security cameras, drones, and industrial controllers, allow attackers to exploit crafted storage media to corrupt memory and execute arbitrary code. The vulnerabilities, rated Medium to High severity, include issues like integer overflows and buffer overflows, leading to potential device crashes or unauthorized code execution. Notably, CVE-2026-6682 involves an integer overflow during FAT32 volume mounting, which can result in memory corruption and code execution. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai)) The widespread use of FatFs in embedded systems, combined with the lack of upstream fixes and the absence of a responsive maintainer, poses significant security risks. Devices relying on FatFs remain vulnerable, and the exploitation of these flaws could lead to persistent operational denial of service or device bricking. Organizations must assess their exposure and implement mitigations to protect against potential attacks. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai))
3 weeks ago
Kill Chain
Unveiling Avalon: The AI-Assisted Malware Framework with Ransomware Capabilities
In July 2026, cybersecurity researchers identified a new modular malware framework named Avalon, which is distributed through a sophisticated multi-stage phishing campaign. This framework integrates various malicious functionalities, including credential harvesting, lateral movement, remote access, system recovery disruption, and ransomware deployment. The ransomware component, dubbed CrownX, encrypts critical files and delivers ransom notes with payment instructions and deadlines. The attack initiates with a deceptive email containing a link to a password-protected archive on Proton Drive. Within this archive, an ISO image houses a Windows Shortcut file that, when executed, triggers a sequence leading to Avalon's deployment. Avalon employs advanced evasion techniques to bypass detection by security tools from vendors such as Microsoft Defender, SentinelOne, and CrowdStrike. It also targets data from browsers, cryptocurrency wallets, and communication applications, exfiltrating information to a remote server. Additionally, Avalon disrupts system recovery by terminating Volume Shadow Copy Service and deleting shadow copies, complicating incident response efforts. The emergence of Avalon underscores the increasing sophistication of malware threats, particularly those leveraging artificial intelligence to streamline development and enhance capabilities. This trend highlights the need for organizations to adopt proactive security measures, including employee training on phishing awareness, robust endpoint protection, and comprehensive incident response plans to mitigate the risks posed by such advanced threats.
3 weeks ago
Kill Chain
FBI Dismantles NetNut Proxy Network and Popa Botnet in 2026
In July 2026, the FBI, in collaboration with industry partners including Google and Lumen Technologies, seized hundreds of domains associated with NetNut, a residential proxy service operated by Alarum Technologies. This action disrupted the Popa botnet, which had compromised over two million devices, such as smart TVs and streaming boxes, turning them into proxy nodes for cybercriminal activities like content scraping, advertising fraud, and account takeovers. The takedown significantly degraded NetNut's proxy network and business operations, reducing the pool of compromised devices by millions. This incident underscores the persistent threat posed by residential proxy networks exploited by cybercriminals to mask malicious activities. The collaboration between law enforcement and industry partners highlights the importance of coordinated efforts in combating such threats. Organizations should remain vigilant and implement robust security measures to protect against similar vulnerabilities.
3 weeks ago
Kill Chain
FortiBleed Campaign's Link to Inc and Lynx Ransomware Groups Unveiled
In July 2026, the FortiBleed campaign, initially identified as a credential-harvesting operation targeting Fortinet FortiGate firewalls, was linked to ransomware-as-a-service groups Inc Ransom and Lynx. SOCRadar researchers discovered that an operator within the FortiBleed infrastructure was actively engaged in ransom negotiations for both groups, indicating that credentials obtained through FortiBleed were being utilized for ransomware deployment. The campaign compromised approximately 12,000 FortiGate devices, with at least 12 confirmed ransomware deployments resulting in hundreds of encrypted endpoints across affected organizations. ([darkreading.com](https://www.darkreading.com/threat-intelligence/fortibleed-actors-inc-lynx-ransomware-gangs?utm_source=openai)) This incident underscores the evolving threat landscape where initial access brokers collaborate with ransomware operators, amplifying the risk to organizations. The exploitation of network security devices as entry points highlights the critical need for robust perimeter defenses and vigilant monitoring to prevent unauthorized access and subsequent ransomware attacks.
3 weeks ago
Kill Chain
Chinese AI Models Redefine Cybersecurity Landscape
In June 2026, Chinese companies Zhipu AI and 360 Security Technology released advanced AI models—GLM-5.2 and Tulongfeng, respectively—that significantly enhance vulnerability discovery capabilities. GLM-5.2, an open-weight model, demonstrated performance on par with leading U.S. models like Anthropic's Mythos in identifying software vulnerabilities. Tulongfeng, described as China's version of Mythos, reportedly identified over 3,400 vulnerabilities, with 105 acknowledged by the Chinese government. These developments underscore a rapid advancement in AI-driven cybersecurity tools within China, potentially altering the global cybersecurity landscape. ([techradar.com](https://www.techradar.com/pro/security/chinese-cybersecurity-company-360-unveils-chinas-version-of-mythos-and-yitianzhen-to-automate-cyber-defense?utm_source=openai)) The emergence of these models highlights the increasing accessibility of sophisticated AI tools for both defenders and attackers. The open-source nature of GLM-5.2 raises concerns about potential misuse by malicious actors, as it allows for modification and deployment without restrictions. This trend necessitates a reassessment of current cybersecurity strategies to address the evolving threat landscape posed by AI-enhanced capabilities. ([axios.com](https://www.axios.com/2026/06/25/china-glm-52-open-source-hackers?utm_source=openai))
3 weeks ago
Kill Chain
PamStealer: A New Threat to macOS Users in 2026
In July 2026, cybersecurity researchers identified a new macOS malware named PamStealer, which masquerades as the legitimate Maccy clipboard manager. Distributed through fake websites, PamStealer employs a two-stage attack chain: an initial AppleScript lure that bypasses macOS's quarantine protections, followed by a Rust-based payload. This payload validates user credentials via macOS's Pluggable Authentication Modules (PAM) before exfiltrating sensitive data, including browser cookies, clipboard contents, and cryptocurrency wallet information. The malware also establishes persistence by creating login items and disguises itself as system components to evade detection. The emergence of PamStealer underscores a growing trend of sophisticated macOS-targeted malware that leverages native system features to enhance stealth and effectiveness. This development highlights the need for macOS users to exercise caution when downloading software and to remain vigilant against increasingly advanced social engineering tactics.
3 weeks ago
Kill Chain
Anthropic's Mythos AI Breach: A Wake-Up Call for AI Security
In April 2026, unauthorized users gained access to Anthropic's restricted AI cybersecurity tool, Mythos, through a third-party vendor environment. Mythos, designed for enterprise security, was considered too powerful for public release due to its potential to identify vulnerabilities and simulate cyberattacks autonomously. The breach raised significant concerns about the security of advanced AI tools and the potential misuse of such technologies. This incident underscores the critical need for robust security measures when handling powerful AI tools, especially those capable of autonomous actions. It highlights the importance of securing third-party vendor environments to prevent unauthorized access to sensitive technologies.
3 weeks ago
Kill Chain
Scattered Spider Member Peter Stokes Extradited to US in 2026
In July 2026, Peter Stokes, a 19-year-old dual U.S.-Estonian citizen and alleged member of the cybercriminal group Scattered Spider, was extradited to the United States following his arrest in Finland. Stokes is accused of participating in multiple data theft and extortion attempts, including attacks on a luxury jewelry retailer in May 2025 and a U.S.-based insurance company in June 2025. Scattered Spider, active since 2022, has infiltrated over 100 businesses and extorted more than $100 million globally. ([cyberscoop.com](https://cyberscoop.com/scattered-spider-peter-stokes-cybercrime-extradition/?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminal groups employing sophisticated social engineering tactics to infiltrate organizations. The arrest highlights the importance of robust cybersecurity measures and international cooperation in combating cybercrime.
3 weeks ago
Kill Chain
Opera's 'Paste Protect' Feature: A New Defense Against 'ClickFix' Attacks
In July 2026, Opera introduced 'Paste Protect,' a security feature designed to combat 'ClickFix' attacks—a social engineering technique where users are deceived into copying and executing malicious commands via their system's command-line interface. These attacks often masquerade as legitimate verification processes or problem-solving instructions, leading to the execution of harmful commands with the user's privileges, potentially resulting in malware installation or data theft. 'Paste Protect' proactively scans clipboard content for patterns associated with malicious scripts across Windows, macOS, and Linux platforms. Upon detecting suspicious content, it blocks the copy operation, alerts the user with a warning, and displays a red security indicator in the browser's address bar. This feature aims to prevent users from inadvertently executing harmful commands, thereby enhancing overall system security. The introduction of 'Paste Protect' underscores the growing prevalence of 'ClickFix' attacks and the necessity for proactive security measures. As threat actors increasingly exploit human behavior through sophisticated social engineering tactics, it becomes imperative for both software developers and users to adopt and maintain robust security practices to mitigate such evolving threats.
3 weeks ago
Kill Chain
Alleged Scattered Spider Hacker Extradited to the United States
In April 2026, 19-year-old Peter Stokes, a dual U.S.-Estonian citizen, was arrested in Finland and extradited to the United States to face charges of conspiracy, computer intrusion, and fraud. Stokes is alleged to be a member of the Scattered Spider hacking group, implicated in over 100 network intrusions resulting in more than $100 million in ransom payments and significant operational disruptions. Notably, in May 2025, the group targeted a luxury item retailer, demanding an $8 million ransom after stealing 100 gigabytes of data. The company refused to pay but incurred over $2 million in losses due to operational disruptions and remediation efforts. ([justice.gov](https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminal groups like Scattered Spider, known for sophisticated social engineering tactics and targeting high-profile organizations. The arrest highlights ongoing international efforts to combat cybercrime and the importance of robust cybersecurity measures to protect against such threats.
3 weeks ago
Kill Chain
Urgent: Microsoft SharePoint RCE Vulnerability (CVE-2026-45659) Under Active Exploitation
In May 2026, Microsoft disclosed a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint Server, stemming from the deserialization of untrusted data. This flaw allows authenticated attackers with minimal privileges to execute arbitrary code on unpatched SharePoint servers without user interaction. Despite the release of security updates on May 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability as of July 2, 2026, and added it to its Known Exploited Vulnerabilities Catalog, urging immediate remediation. The active exploitation of CVE-2026-45659 underscores the critical need for organizations to promptly apply security patches to prevent potential breaches. With over 10,000 SharePoint servers exposed online, the risk of widespread exploitation is significant, highlighting the importance of maintaining up-to-date systems to safeguard sensitive information.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports