✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
CoPhish 2024: How Microsoft Copilot Studio Became a Vector for OAuth Phishing
In early June 2024, security researchers discovered a sophisticated phishing campaign dubbed 'CoPhish' exploiting Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests. By leveraging legitimate Microsoft domains and trusted Copilot workflows, attackers deceived enterprise users into granting malicious apps access to their Microsoft 365 accounts, thereby stealing OAuth tokens and enabling unauthorized access to sensitive emails, files, and collaborative workspaces. The attack chain bypassed traditional email security controls due to its reliance on trusted infrastructure and social engineering, putting multiple organizations at risk of data compromise and account takeover. This incident underscores the growing trend of threat actors abusing trusted cloud and AI-powered collaboration platforms, capitalizing on user trust and shadow IT. It highlights urgent security concerns around identity-driven attacks, modern authentication abuse, and the need for enhanced vigilance in managing third-party OAuth authorizations.
6 months ago
Kill Chain
Synthient Data Breach 2024: 2 Billion Exposed Credentials Spark Global Risk
In early 2024, a new breach known as the 'Synthient Threat Data Collection' surfaced, encompassing a staggering two billion unique email addresses tied to credential stuffing operations. This data was amassed from large-scale compromise campaigns and open sources, then processed and analyzed for integrity and novelty on high-capacity infrastructure. The breach reflects the increasing industrialization of credential harvesting by attackers, raising significant privacy and security concerns for individuals and organizations across sectors, as many of these records had never before been reported in regular breach repositories. The exposure demonstrates a dramatic uptick in both credential reuse attacks and the volume of personal data accessible to cybercriminals. As data brokers and threat actors accelerate their harvesting and aggregation campaigns, organizations must bolster detection, consumer alerts, and incident response to meet new regulatory and operational risks.
6 months ago
Kill Chain
Microsoft Issues Emergency Patch for Critical WSUS Vulnerability (CVE-2025-59287)
In October 2025, Microsoft disclosed and initially patched a critical vulnerability, tracked as CVE-2025-59287, in its Windows Server Update Services (WSUS) platform. The flaw, actively exploited in the wild, allowed attackers to compromise the WSUS update mechanism, potentially enabling malicious code injection during trusted Windows Server updates. Rapid exploitation following the Patch Tuesday release prompted Microsoft to issue an emergency out-of-band security update in response to ongoing attacks, underscoring the vulnerability's urgency and the risk of widespread operational impact for enterprises reliant on WSUS. This incident highlights the escalating frequency of supply chain and update-platform attacks as adversaries increasingly target patch distribution mechanisms. The rise in vulnerability exploitation, particularly against trusted infrastructure components, is driving regulatory attention and motivating organizations to reassess their zero trust models and patch management processes.
6 months ago
Kill Chain
Threat Actors Exploit AzureHound for Cloud Reconnaissance in 2024
In early 2024, threat actors were observed misusing AzureHound, a powerful cloud pentesting and reconnaissance tool, to discover and map sensitive resources within Microsoft Azure environments. Instead of supporting authorized security assessments, malicious groups leveraged AzureHound's automation to enumerate identities, permissions, and relationships with the intent to facilitate lateral movement and privilege escalation. The attackers accessed cloud APIs with stolen or compromised credentials, largely evading detection until telemetry patterns indicative of broad cloud discovery were identified by Unit 42 researchers. The incident highlighted the urgent need for robust monitoring and threat detection tailored for cloud-specific attack vectors. This incident underscores an accelerating trend in the weaponization of legitimate security tools by adversaries to attack cloud infrastructure. As organizations rapidly adopt multi-cloud strategies, the risk surface expands, magnifying the necessity for proactive defense strategies and comprehensive visibility into cloud-based TTPs.
6 months ago
Kill Chain
Pwn2Own Ireland 2025: Researchers Unveil 73 Zero-Day Vulnerabilities
In June 2025, the Pwn2Own Ireland hacking competition saw security researchers successfully exploit 73 unique zero-day vulnerabilities across a variety of enterprise software and devices. Over $1,024,750 in rewards were awarded as teams identified and demonstrated live, working exploits, many targeting critical business platforms. These zero-days, by definition previously unknown to vendors, highlight the rapid pace at which vulnerabilities are discovered and the ongoing challenges organizations face in maintaining strong security posture against both sophisticated and opportunistic attackers. This event underscores the persistent risk of zero-day vulnerabilities and the growing sophistication of offensive security research. The scale and speed of exploit identification at Pwn2Own reflect broader industry trends, including increased investment in bug bounties and rising regulatory expectations for vulnerability management and disclosure.
6 months ago
Kill Chain
Critical WSUS RCE Exploit in Windows Server: Immediate Patching Required
In June 2024, Microsoft urgently released out-of-band security patches to address a critical vulnerability (CVE-2024-30080) in Windows Server Update Services (WSUS). Security researchers publicly disclosed a proof-of-concept exploit that bypassed authentication and enabled remote code execution (RCE) on WSUS servers, exposing connected enterprise environments to attacker control. Threat actors could exploit this flaw to gain high-level privileges, push malicious updates to endpoints, or pivot deeper into corporate networks, presenting significant risk to organizations depending on WSUS for patch management. Microsoft advised immediate patching and provided guidance for mitigating exposed servers. This incident underscores a recent escalation in supply-chain and patch management vulnerabilities targeted by threat actors. Public exploit availability heightens the urgency for rapid remediation, as adversaries increasingly weaponize new vulnerabilities before standard patch cycles can address them.
6 months ago
Kill Chain
How Attackers Used LastPass Inheritance Phishing to Breach Vaults in 2024
In June 2024, LastPass disclosed a targeted phishing campaign in which attackers sent fraudulent emails to customers, falsely claiming an access request to password vaults as part of a legacy inheritance process. These sophisticated phishing emails leveraged urgent social engineering tactics, such as fake death notifications, aiming to trick users into divulging their master passwords or clicking malicious links. Attackers subsequently attempted unauthorized access to vaults, raising concerns about potential credential compromise and data theft. This incident underscores the evolving threat landscape, where social engineering techniques and highly tailored phishing campaigns are targeting password managers and identity-centric security controls. As threat actors continue to exploit trust and human error, organizations must strengthen user awareness, enhance detection of inbound phishing, and revisit identity-based access protections.
6 months ago
Kill Chain
Amazon AWS 2024 Outage: What the DNS Infrastructure Failure Reveals
On June 13, 2024, Amazon Web Services (AWS) suffered a widespread outage attributed to a major DNS (Domain Name System) infrastructure failure. This disruption impacted numerous high-traffic websites and mission-critical online services, causing downtime and service degradation for businesses relying on AWS. While the outage was not caused by a cyberattack, the critical nature of DNS infrastructure meant that service availability and operational continuity were significantly affected. Amazon engineers quickly identified the root cause as an internal DNS misconfiguration and implemented remediation protocols to restore operations within hours. This incident highlights growing concerns about cloud infrastructure dependencies and the cascading business impact of DNS and network-layer disruptions. As digital ecosystems become more interlinked, organizations must consider both cyberattacks and operational failures in their risk management and compliance strategies.
6 months ago
Kill Chain
GlassWorm Worm Spreads via VS Code Extensions in Massive 2025 Supply Chain Attack
In October 2025, cybersecurity researchers uncovered a major supply chain attack involving a self-spreading worm dubbed 'GlassWorm' that compromised Visual Studio Code (VS Code) extensions distributed via the Open VSX Registry and Microsoft Extension Marketplace. The threat actors leveraged malicious extensions to automatically propagate the worm among developer environments, enabling it to execute unauthorized code, exfiltrate credentials, and embed backdoors in developer toolchains. This incident resulted in widespread risk to organizations whose software supply chains depend on the integrity of these popular extension repositories, forcing rapid incident response across the global developer community. The GlassWorm incident highlights the escalating targeting of developers and DevOps pipelines by sophisticated cyber adversaries. As attackers evolve to exploit trust relationships in software ecosystems, organizations must strengthen supply chain security controls and increase vigilance around third-party code dependencies.
6 months ago
Kill Chain
WSUS Windows Server Vulnerability Exploited: What Organizations Need to Know in 2024
In June 2024, attackers began actively exploiting a critical-severity vulnerability in Microsoft’s Windows Server Update Services (WSUS), allowing unauthenticated remote code execution on unpatched Windows Server instances. Public proof-of-concept exploit code enabled threat actors to target organizations’ update infrastructure, potentially granting attackers elevated privileges and control over networked endpoints. The attack vector leverages unencrypted or weakly secured WSUS communication endpoints, risking malware delivery or the propagation of malicious updates across enterprise environments. Immediate business impacts can include system compromise, lateral movement, and potential data exfiltration. This exploitation reflects a recent trend where attackers leverage highly impactful remote code execution bugs in widely deployed software with public exploits, underscoring the need for rapid patch management and improved east-west traffic visibility. Organizations using legacy or unpatched WSUS deployments are most at risk as targeted attacks continue to rise.
6 months ago
Kill Chain
Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild
In October 2025, Microsoft disclosed and urgently patched a critical remote code execution vulnerability (CVE-2025-59287) impacting the Windows Server Update Services (WSUS) framework. Following the public release of a proof-of-concept exploit, threat actors began actively targeting vulnerable WSUS deployments to execute malicious code, gain unauthorized access, and potentially compromise large segments of enterprise environments. The flaw, assigned a CVSS score of 9.8, allowed unauthenticated attackers to leverage exposed update services, posing significant risk to organizations’ patch management infrastructures before the emergency fix was implemented. This incident highlights the continuing trend of sophisticated adversaries exploiting zero-day and n-day vulnerabilities in widely used systems with available PoCs. It also underscores growing urgency for proactive patch management, real-time anomaly detection, and adoption of Zero Trust models to protect against rapidly weaponized threats.
6 months ago
Kill Chain
Smishing Triad’s 2024 US SMS Phishing Campaign: Government Impersonation Goes Mainstream
In early 2024, a threat group known as the 'Smishing Triad' launched a wave of phishing attacks targeting American mobile phone users through fake government-related SMS messages. The group impersonated federal and state agencies, primarily sending texts about unpaid toll fees and penalties to lure recipients into clicking malicious links. These links redirected victims to counterfeit payment portals to steal personal and financial information. The campaign used low-frequency, highly targeted smishing tactics which significantly increased trust and subsequent victim engagement, resulting in a notable uptick in credential theft and financial fraud. This incident is part of a broader trend where cybercriminal organizations leverage sophisticated social engineering and government impersonation at a time of regulatory scrutiny around SMS-based phishing (smishing). Its evolving tactics show how attackers adapt to increase impact, highlighting the urgent need for layered, identity- and zero-trust-driven defenses.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports