✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
NAIC's 2026 Data Breach: A ShinyHunters Exploit of Oracle PeopleSoft
In June 2026, the National Association of Insurance Commissioners (NAIC) experienced a cyberattack by the ShinyHunters group, who exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft servers. The attackers claimed to have stolen 3.1 TB of data, including insurer regulatory filings and AWS infrastructure configurations. NAIC's investigation indicated that only publicly available data, outdated logs, and configuration files were accessed, with no evidence of personal or financial data exposure. The breach led to operational disruptions, such as temporary suspension of data feeds by credit rating agencies and a pause in NAIC's investment designation work. This incident underscores the critical importance of promptly addressing zero-day vulnerabilities and implementing robust security measures to protect sensitive data. Organizations must remain vigilant against sophisticated threat actors like ShinyHunters, who continue to exploit unpatched systems, emphasizing the need for proactive cybersecurity strategies and timely software updates.
4 weeks ago
Kill Chain
Malicious Perplexity Chrome Extension Compromises User Data
In June 2026, Microsoft identified a malicious Chrome extension named "Search for perplexity ai" that impersonated the AI search engine Perplexity. This extension intercepted users' search queries and address bar inputs, routing them through an attacker-controlled server before redirecting to legitimate search results. The extension set itself as the default search engine upon installation, capturing every character typed into the address bar and transmitting this data, along with browser headers, IP addresses, and user agents, to the attacker's server. Microsoft reported the extension to Google, leading to its removal from the Chrome Web Store. ([thehackernews.com](https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html?utm_source=openai)) This incident underscores a growing trend of malicious browser extensions exploiting the popularity of AI tools to harvest sensitive user data. Similar campaigns have targeted users by masquerading as AI assistants, leading to significant data breaches. Organizations must remain vigilant, implementing strict policies on browser extensions and educating users about the risks associated with unverified add-ons. ([techradar.com](https://www.techradar.com/pro/security/fake-chrome-ai-extensions-targeted-over-300-000-users-to-steal-emails-personal-data-and-more?utm_source=openai))
4 weeks ago
Kill Chain
AWS Threat Technique Catalog June 2026 Update: Enhancing Your AWS Security Posture
In June 2026, the AWS Customer Incident Response Team (AWS CIRT) updated the Threat Technique Catalog (TTC) to address emerging security challenges in container security, organizational trust, and compute hijacking. The update introduces five new entries: EKS workload modification, exploitation of public-facing applications in EKS, assuming root access into organization member accounts, compute hijacking in EKS, and inviting accounts to unknown organizations. These techniques reflect real-world incidents where threat actors exploit legitimate AWS functionalities to compromise environments, emphasizing the need for robust security measures and vigilant monitoring. This update underscores a trend where attackers leverage standard cloud operations to evade detection, highlighting the importance for organizations to enhance their security postures by implementing controls such as admission controllers, service control policies, and resource quotas, and by actively monitoring for anomalous activities within their AWS environments.
4 weeks ago
Kill Chain
Hijacked npm and Go Packages Exploit VS Code to Deploy Python Infostealer
In June 2026, cybersecurity researchers identified a sophisticated supply chain attack involving hijacked npm and Go packages designed to deploy a Python-based information stealer across Windows, Linux, and macOS systems. The attackers embedded malicious code within Visual Studio Code (VS Code) tasks, configured to execute automatically when a project folder was opened. This method bypassed traditional npm execution paths, allowing the malware to retrieve encrypted JavaScript from blockchain transactions, establish a backdoor via socket.io, and ultimately deploy the Python infostealer. The compromised npm packages, 'html-to-gutenberg' and 'fetch-page-assets', were uploaded on May 25, 2026, and have since been removed from the registry. This incident underscores a growing trend of attackers exploiting development environments and tools to infiltrate systems, highlighting the need for enhanced security measures within the software supply chain. The use of blockchain as a resilient command-and-control mechanism further complicates detection and mitigation efforts, emphasizing the importance of vigilance and proactive defense strategies among developers and organizations.
4 weeks ago
Kill Chain
Microsoft Eliminates 119 Malicious Edge Extensions Concealing Malware
In June 2026, Microsoft identified and removed 119 malicious extensions from the Edge Add-ons store, collectively known as 'StegoAd.' These extensions, active since at least 2021, utilized steganography to conceal malware within image and font files. After installation, the malware remained dormant, later activating to steal user credentials and conduct ad fraud. The affected extensions, including ad blockers, VPNs, translators, and video downloaders, amassed up to 2.6 million installations. The exact number of compromised users remains undetermined. This incident underscores the evolving sophistication of cyber threats, particularly in the realm of browser extensions. The use of steganography to evade detection highlights the need for enhanced security measures and vigilant monitoring of third-party add-ons. Organizations must prioritize the implementation of robust security protocols to mitigate such risks.
4 weeks ago
Kill Chain
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
In June 2026, a critical vulnerability identified as CVE-2026-55200 was discovered in libssh2 versions up to and including 1.11.1. This flaw resides in the ssh2_transport_read() function, which fails to properly validate the packet_length field in incoming SSH packets. As a result, remote attackers can send specially crafted SSH packets with excessively large packet_length values, leading to heap memory corruption and potential remote code execution without requiring authentication or user interaction. The issue was addressed in commit 7acf3df. The release of a public proof-of-concept (PoC) exploit for this vulnerability has heightened the risk of widespread exploitation. Given libssh2's integration into numerous applications and systems, including curl, Git, PHP, and various backup agents, the potential attack surface is extensive. Organizations are urged to assess their environments for affected versions and apply the necessary patches promptly to mitigate the risk of compromise.
4 weeks ago
Kill Chain
Critical DirtyClone Vulnerability in Linux Kernel (CVE-2026-43503) Exposes Systems to Root Access
In June 2026, a critical vulnerability known as DirtyClone (CVE-2026-43503) was discovered in the Linux kernel, allowing local users to escalate privileges to root by exploiting cloned network packets. This flaw, a variant of the earlier DirtyFrag vulnerability, affects multiple Linux distributions, including Debian, Ubuntu, and Fedora. The vulnerability arises from the kernel's mishandling of shared socket-buffer fragments during network packet processing, enabling attackers to manipulate the Linux page cache and gain unauthorized access. ([thehackernews.com](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html?utm_source=openai)) The emergence of DirtyClone underscores the persistent challenges in securing the Linux kernel against privilege escalation attacks. With the increasing adoption of multi-tenant cloud environments and containerized workloads, the risk of such vulnerabilities being exploited has escalated, highlighting the need for prompt patching and vigilant system monitoring. ([securityweek.com](https://www.securityweek.com/dirtyclone-linux-kernel-vulnerability-leads-to-root-access/?utm_source=openai))
4 weeks ago
Kill Chain
Massive Crypto Scam Operation Exploits DCloud Uni-App Framework
In June 2026, cybersecurity firm Infoblox uncovered that over 236,000 websites were utilizing investment scam templates built with the DCloud Uni-App framework. These sites facilitated a range of fraudulent activities, including fake cryptocurrency exchanges, phishing schemes, and crypto wallet drainers. The malicious domains spanned multiple continents and languages, indicating a coordinated effort by various threat actors. Notably, the RainbowEx platform, implicated in a Ponzi scheme affecting thousands in Argentina in late 2024, was among the identified domains. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai)) The exploitation of legitimate development frameworks like DCloud Uni-App underscores the evolving tactics of cybercriminals. This incident highlights the critical need for organizations to implement robust security measures, including thorough vetting of third-party tools and continuous monitoring for suspicious activities. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai))
4 weeks ago
Kill Chain
Exploiting AI Coding Agents: The New Frontier in Supply Chain Attacks
In June 2026, researchers at Mozilla's Zero Day Investigative Network (0DIN) identified a novel supply chain attack targeting AI coding agents. The attack involved a seemingly benign GitHub repository containing standard setup instructions. When an AI coding agent, such as Claude Code, cloned and initialized the repository, it encountered an error message prompting the execution of an initialization command. This command triggered a shell script that retrieved and executed a payload from a DNS TXT record controlled by the attacker, resulting in the establishment of an interactive shell on the developer's machine. This method allowed attackers to gain unauthorized access to sensitive information without any malicious code present in the repository itself. This incident underscores the evolving sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. As AI coding agents become more integrated into software development workflows, they present new vectors for exploitation. Organizations must enhance their security protocols to address these emerging threats, ensuring that AI tools are configured to disclose and verify the full execution chain of setup commands to prevent unauthorized code execution.
1 month ago
Kill Chain
Russian Intelligence Services' Phishing Campaigns Targeting Messaging Apps in 2026
In March 2026, the FBI and CISA issued a Public Service Announcement warning of ongoing phishing campaigns by Russian Intelligence Services (RIS) targeting commercial messaging applications (CMAs) such as Signal and WhatsApp. These campaigns aim to compromise individual user accounts by impersonating official support channels and tricking users into sharing verification codes or personal information. High-value targets include U.S. government officials, military personnel, political figures, and journalists. Once access is gained, attackers can view messages, contact lists, and conduct further phishing attacks. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260626?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors employing social engineering tactics to bypass encryption and gain unauthorized access to sensitive communications. The rise in such targeted phishing campaigns highlights the need for heightened vigilance and robust security practices among users of CMAs.
1 month ago
Kill Chain
Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations
In June 2026, cybersecurity firms were targeted by a sophisticated social engineering campaign dubbed 'Poisoned Tenant.' Threat actors created fraudulent OpenAI ChatGPT organizations impersonating legitimate companies and sent authentic-looking invitations to employees, urging them to join these fake tenants. Upon acceptance, employees were granted administrative privileges, potentially exposing sensitive company information. The attackers utilized OpenAI's legitimate notification system, making the invitations appear credible and bypassing standard email security measures. This incident underscores the evolving tactics of cyber adversaries who exploit trusted platforms to execute social engineering attacks. The use of legitimate services to deliver malicious content highlights the need for organizations to enhance their security awareness training and implement robust verification processes for unsolicited invitations, even when they appear to originate from trusted sources.
1 month ago
Kill Chain
Polymarket Supply-Chain Attack Results in $3 Million Theft
In June 2026, Polymarket, a leading cryptocurrency-based prediction market platform, suffered a supply-chain attack resulting in the theft of approximately $3 million from its customers. Attackers compromised a third-party vendor, injecting malicious JavaScript into Polymarket's frontend. This script deceived users into approving fraudulent transactions, leading to unauthorized fund transfers. The platform's backend infrastructure remained unaffected, and Polymarket has committed to fully reimbursing the impacted users. This incident underscores the escalating threat of supply-chain attacks targeting financial platforms. As cybercriminals increasingly exploit third-party dependencies to infiltrate systems, organizations must enhance their security measures and conduct thorough audits of their supply chains to mitigate such risks.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Computer/Network Security
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports