✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
TA585’s MonsterV2: Unveiling 2025’s Next-Gen Phishing Infostealer Threat
In October 2025, cybersecurity researchers uncovered new activities by the previously undocumented threat actor TA585, which was observed conducting sophisticated phishing attacks to deliver the MonsterV2 infostealer malware. The group leveraged advanced tactics, including web injections and traffic filtering, to evade detection and ensure payload delivery. Once deployed, MonsterV2 enabled TA585 to harvest sensitive information and credentials, posing significant risks to organizational data integrity and confidentiality. The attack chains exploited weaknesses in email security and endpoint controls, demonstrating a concerning evolution in social engineering and malware delivery. This incident highlights the growing prevalence of stealthy infostealer campaigns targeting enterprises across multiple sectors. It underscores the urgent need for organizations to reevaluate network segmentation, multi-cloud visibility, and anomaly detection strategies to counter increasingly capable threat actors and align with evolving compliance standards.
6 months ago
Kill Chain
How Malicious Open Source Packages Used Discord to Breach Developer Supply Chains in 2025
In October 2025, security researchers uncovered a widespread supply chain attack targeting popular open source repositories—including npm, PyPI, and RubyGems. Malicious packages were uploaded to these ecosystems and leveraged Discord webhooks as a covert command-and-control (C2) channel to exfiltrate sensitive developer data upon installation. The attackers took advantage of the ease of publishing code to open source registries, embedding scripts that silently siphoned credentials, environment variables, and other project secrets. Dozens of projects and potentially thousands of developers or organizations were impacted, risking further compromise via credential leakage and downstream dependency poisoning. This incident underscores the urgency of enforcing robust dependency hygiene and highlights a rising trend: attackers increasingly abusing trusted supply chains and common collaboration tools for exfiltration. As open source usage soars and supply chain security intensifies, organizations must be vigilant against covert exfiltration methods and adopt multilayered security controls.
6 months ago
Kill Chain
Pixnapping: The Android Flaw Allowing Rogue Apps to Bypass 2FA Security (2025 Breach Analysis)
In October 2025, security researchers from the University of California, Berkeley, uncovered a critical vulnerability affecting Google and Samsung Android devices. The flaw, dubbed "Pixnapping," enables malicious apps to perform pixel-by-pixel side-channel attacks, covertly extracting two-factor authentication (2FA) codes, mapping data (such as Google Maps timelines), and other sensitive on-screen information—all without any special permissions or user awareness. Threat actors can exploit this vulnerability by luring users into installing rogue apps, ultimately undermining common security practices that rely on device or app isolation to keep critical data secure. This incident highlights an increasing trend of advanced side-channel techniques targeting mobile devices, even in environments with strict permission models. As mobile malware continues to evolve, organizations and individuals must stay vigilant, adapt security controls, and reevaluate the effectiveness of current detection and segmentation approaches to safeguard sensitive data.
6 months ago
Kill Chain
AMD RMPocalypse: 2025 SEV-SNP Hardware Flaw Shakes Confidential Computing
In October 2025, researchers from ETH Zürich disclosed a critical vulnerability, dubbed RMPocalypse, affecting AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. The flaw allowed attackers to undermine confidential computing protections by exploiting incomplete memory protections, making it feasible to alter a single 8-byte memory location and bypass hardware security boundaries. This discovery prompted AMD to release urgent patches across impacted EPYC server platforms, as the risk permitted threat actors—potentially including malicious tenants or insiders in cloud environments—to access sensitive workload data previously thought to be isolated and encrypted. This incident highlights persistent risks within hardware-assisted security frameworks and confidential computing platforms, as attackers increasingly target trusted execution environments. With a rise in high-confidence threats and supply-chain attacks, this breach sets a new precedent for cross-layer vulnerability research and the urgency of continuous hardware and firmware security validation.
6 months ago
Kill Chain
Critical SAP NetWeaver Zero-Day in 2025 Enables Unauthenticated Server Takeover
In October 2025, SAP disclosed and patched a critical zero-day vulnerability (CVE-2025-42944) in its NetWeaver Application Server Java platform, stemming from insecure deserialization. The vulnerability, rated CVSS 10.0, enabled unauthenticated remote attackers to execute arbitrary commands on affected servers, potentially compromising entire SAP landscapes. Though SAP issued urgent patches addressing 13 issues, the deserialization flaw was particularly notable for its potential to allow complete server takeover without credential access. Organizations were urged to deploy security updates immediately to prevent exploitation. This incident highlights the ongoing risk posed by deserialization vulnerabilities in widely deployed enterprise applications. As attackers accelerate exploitation of newly disclosed flaws, organizations must prioritize rapid patching, bolster application-layer controls, and monitor for lateral movement to mitigate the risk of business-critical system breaches.
6 months ago
Kill Chain
ICTBroadcast RCE Vulnerability: Hackers Gain Remote Shell Access via Cookie Exploit in 2025
In October 2025, a critical remote code execution vulnerability (CVE-2025-2611, CVSS 9.3) in ICTBroadcast's autodialer platform was actively exploited by threat actors. By leveraging improper input validation in the application's session cookie handler, attackers achieved unauthenticated remote shell access to internet-exposed servers. This exploit enabled malicious actors to execute arbitrary system commands, potentially compromising sensitive data and business operations for organizations using ICTBroadcast. The incident required immediate patching and forensic investigation to contain the breach and restore normal operations. This breach highlights the persistent risk posed by zero-day vulnerabilities in widely used communications software, especially as remote access vector attacks surge. It underscores the strategic shift among attackers toward supply chain and software-specific exploits, which remain difficult to rapidly mitigate across diverse deployment environments.
6 months ago
Kill Chain
Microsoft’s 2025 Windows Zero-Day Exploitation: What Every Enterprise Needs to Know
In October 2025, Microsoft revealed that two previously unknown zero-day vulnerabilities had been discovered and actively exploited in every supported and unsupported version of Windows, following its Patch Tuesday release. Attackers leveraged these unpatched flaws to compromise systems, facilitating unauthorized access and the potential for privilege escalation and lateral movement. The vulnerabilities affected both enterprise and consumer endpoints, raising concerns about widespread risk at a time when older Windows 10 systems reached end-of-support unless enrolled in paid extended coverage. This incident forced rapid emergency patch deployment and incident response in enterprises worldwide. This event underscores a rising trend in the exploitation of zero-day flaws in core operating systems, putting organizations under pressure to minimize their exposure and improve vulnerability and patch management. Regulatory scrutiny and increased attacker sophistication have elevated expectations for response times and organizational cyber resilience.
6 months ago
Kill Chain
How Attackers Bypass Synced Passkeys: Lessons from the 2025 Incident
In October 2025, a significant security incident highlighted how attackers are bypassing synced passkey protections via adversary-in-the-middle (AiTM) techniques. Attackers exploited weaknesses in the synchronization of passkeys—where user credentials are stored in the cloud and synchronized across devices—to circumvent strong authentication requirements. By leveraging AiTM phishing kits and triggering fallback authentication flows, adversaries gained unauthorized access to enterprise accounts, exposing sensitive data and business operations. This vector sidesteps traditional multi-factor authentication and identity-first defenses, putting organizations reliant on passkey sync at risk. This incident demonstrates an urgent shift in attacker tactics toward abusing authentication recovery and synchronization flows that are increasingly common with passwordless deployments. As more businesses move to passkeys for convenience, the associated risks with synced secrets and recoveries have become a major security concern that demands new approaches and controls.
6 months ago
Kill Chain
VS Code Extension Access Token Leak: A 2025 Supply Chain Wake-Up Call
In October 2025, a major supply chain risk was exposed when over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, allowing threat actors to publish malicious updates to widely used extensions. Attackers who obtained these tokens could have distributed compromised software versions to millions of developers globally, undermining trust in open-source ecosystems and introducing the risk of code tampering, credential theft, or insertion of backdoors into organizational environments. The vulnerability lay in the mishandling and inadvertent leakage of personal access tokens (PATs) for both the VSCode Marketplace and Open VSX, giving adversaries an insidious update path into developer workstations and CI/CD pipelines. This incident highlights the increasing frequency and sophistication of supply chain attacks targeting developer tools and open-source dependencies. As the software landscape grows more interconnected, private access tokens and code-signing credentials now represent high-value targets, requiring robust security controls and zero trust validation across the development lifecycle.
6 months ago
Kill Chain
F5 Breach 2025: Nation-State Hackers Steal BIG-IP Source Code in Supply-Chain Attack
In October 2025, F5, a leading U.S. cybersecurity vendor, reported a significant breach attributed to a sophisticated nation-state threat actor. Attackers infiltrated F5's internal systems, gaining persistent access and exfiltrating files containing proprietary BIG-IP source code as well as details on undisclosed vulnerabilities. The breach underscores advanced adversary tactics, likely leveraging supply-chain vectors or unpatched entry points, with the attackers remaining undetected for an extended period. The exposure of source code and sensitive vulnerability information has significant security and operational implications for F5 customers and the wider ecosystem. This incident illustrates an escalating trend of nation-state-backed attacks targeting critical infrastructure vendors and supply chains. The F5 breach spotlights the urgent need for vigilant monitoring, robust threat detection, and transparent vulnerability management as attackers increasingly focus on extracting valuable code and intelligence from IT suppliers.
6 months ago
Kill Chain
Adobe AEM 2025 Breach: CISA Flags Critical Application Flaw Under Active Attack
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) raised alarms about a critical misconfiguration vulnerability (CVE-2025-54253) impacting Adobe Experience Manager (AEM). This flaw, assigned a CVSS score of 10.0, allows remote unauthenticated attackers to achieve arbitrary code execution on vulnerable AEM instances. Active exploitation was confirmed as attackers leveraged the bug to gain foothold, escalate privileges, and deploy malware on targeted organizations, potentially exposing sensitive data and compromising internal operations. The incident highlights the risks of unpatched enterprise software within digital supply chains and data-driven organizations. The AEM vulnerability is currently notable due to increased exploitation by multiple threat actors, coinciding with a larger trend of critical zero-day application flaws being used in advanced persistent attacks. Regulatory agencies and security experts underscore the urgency for patching exposed business applications given the frequency and sophistication of exploitation campaigns in 2025.
6 months ago
Kill Chain
Russian Hackers Evolve Malware via 'I am not a robot' Captchas in 2024
In early 2024, the Russian state-sponsored group Star Blizzard intensified its cyber-espionage operations, leveraging advanced malware strains (NoRobot, MaybeRobot) delivered via deceptive "I am not a robot" CAPTCHA prompts in targeted ClickFix phishing campaigns. Attackers executed multi-stage infection chains, enticing victims to enable malicious browser extensions or download trojanized payloads under the guise of legitimate productivity fixes. These campaigns enabled persistent access to sensitive organizational data, posed risks of lateral movement within networks, and facilitated exfiltration of proprietary intelligence. This incident underscores a concerning trend: the use of dynamic, highly-adaptive social engineering and malware delivery methods by state-backed actors. As similar tactics are increasingly observed across sectors, organizations must harden entry-point protections and improve internal visibility to counter evolving nation-state threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports