✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
FBI Issues Warning on Russian Hackers Exploiting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued an updated warning regarding Russian intelligence phishing campaigns targeting Signal users. Attackers impersonated Signal support, sending messages that prompted users to share their Backup Recovery Keys under the guise of preventing data loss. Once obtained, these keys allowed attackers to restore backups, access private messages, and take over accounts. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and Ukrainian officials. This incident underscores the evolving tactics of nation-state actors in exploiting legitimate features of secure messaging apps through social engineering. The focus on high-profile individuals highlights the strategic nature of the campaign, emphasizing the need for heightened vigilance and robust security practices among potential targets.
1 month ago
Kill Chain
Persistent Cyber Scam Centers in Asia Despite Crackdowns
In June 2026, reports from INTERPOL and Amnesty International highlighted the persistent and escalating issue of cyber scam centers across Asia, particularly in Cambodia, Myanmar, Laos, and the Philippines. Despite high-profile crackdowns and arrests, these operations continue to thrive, generating an estimated $40 billion annually through schemes like romance fraud and investment scams. The resilience of these criminal enterprises is largely attributed to local corruption and collusion with law enforcement, which undermine efforts to dismantle them. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific?utm_source=openai)) This situation underscores the urgent need for enhanced international cooperation and robust anti-corruption measures. The continued operation of these scam centers not only results in significant financial losses globally but also involves severe human rights abuses, including human trafficking and forced labor. Addressing this issue is critical to protecting vulnerable populations and maintaining global cybersecurity. ([amnesty.org](https://www.amnesty.org/en/latest/news/2026/06/cambodia-evidence-suggests-scamming-compounds-bypassed-despite-high-profile-crackdown/?utm_source=openai))
1 month ago
Kill Chain
Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026
In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai)) This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai))
1 month ago
Kill Chain
Microsoft Alerts Hospitality Sector to Advanced Phishing Threat
Since April 2026, a sophisticated phishing campaign has been targeting hotel and hospitality organizations across Europe and Asia. Attackers send emails impersonating 'Booking Manager (via Calendly)' with subjects referencing guest complaints or health inspections. These emails contain links leading to ZIP files named 'photo-<numbers>.zip,' which, when opened, execute a Node.js-based remote access trojan (RAT) called TonRAT. The malware establishes command-and-control channels through the TON blockchain API, complicating detection and mitigation efforts. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms like Calendly and Google’s URL redirect services to bypass traditional email security measures. The use of Node.js implants and blockchain-based command-and-control mechanisms highlights the need for organizations to enhance their cybersecurity defenses against increasingly sophisticated phishing campaigns.
1 month ago
Kill Chain
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
In June 2026, a sophisticated supply chain attack known as 'Miasma' compromised 32 npm packages under Red Hat's @redhat-cloud-services namespace. The attackers gained access through a compromised Red Hat employee's GitHub account, allowing them to push malicious commits that bypassed standard peer reviews. These commits exploited GitHub Actions workflows to publish trojanized package versions to the public npm registry. Upon installation, these packages executed an obfuscated payload designed to steal credentials from various platforms, including GitHub, AWS, Azure, and Google Cloud Platform. The malware also attempted to propagate by compromising additional maintainer packages and, in some cases, could destroy the maintainer’s home directory. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The Miasma campaign highlights the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package repositories to prevent unauthorized access and mitigate the risk of widespread credential theft and system compromise.
1 month ago
Kill Chain
Understanding the DirtyClone Linux Kernel Vulnerability (CVE-2026-43503)
In June 2026, a critical Linux kernel vulnerability known as 'DirtyClone' (CVE-2026-43503) was disclosed, allowing local users to escalate privileges to root by exploiting cloned network packets. This flaw, part of the DirtyFrag family, arises from the kernel's mishandling of shared memory flags during packet cloning, enabling unauthorized memory corruption. The vulnerability affects systems with unpatched kernels prior to May 21, 2026, particularly those with unprivileged user namespaces enabled, such as Debian, Ubuntu, and Fedora. The disclosure of DirtyClone underscores the persistent challenges in securing kernel-level code, especially concerning memory management and privilege escalation. This incident highlights the necessity for organizations to promptly apply security patches and reassess configurations that permit unprivileged user namespaces, to mitigate potential exploitation risks.
1 month ago
Kill Chain
Amazon Q Developer Vulnerability CVE-2026-12957: What You Need to Know
In June 2026, a critical vulnerability (CVE-2026-12957) was identified in Amazon Q Developer's handling of Model Context Protocol (MCP) servers. This flaw allowed malicious repositories to execute arbitrary commands on a developer's machine upon opening and trusting a workspace, potentially leading to unauthorized access to cloud credentials. The issue was promptly addressed by Amazon with the release of Language Servers for AWS version 1.69.0, mitigating the risk of exploitation. This incident underscores the growing security challenges associated with AI-powered development tools. As these tools become more integrated into the software development lifecycle, ensuring robust security measures and prompt patching of vulnerabilities is imperative to protect sensitive data and maintain trust in development environments.
1 month ago
Kill Chain
Critical Linux Kernel Vulnerability 'pedit COW' (CVE-2026-46331) Allows Root Access
In June 2026, a critical vulnerability identified as CVE-2026-46331, also known as 'pedit COW,' was discovered in the Linux kernel's traffic control subsystem. This flaw allows local unprivileged users to escalate their privileges to root by exploiting an out-of-bounds write in the packet-editing action (act_pedit), leading to corruption of shared page-cache memory. A public, working exploit was released shortly after the CVE assignment, raising significant security concerns across various Linux distributions. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-46331?utm_source=openai)) The rapid public disclosure and availability of exploit code for CVE-2026-46331 underscore the critical need for organizations to promptly apply security patches. This incident highlights the ongoing risks associated with kernel-level vulnerabilities and the importance of maintaining up-to-date systems to mitigate potential privilege escalation attacks.
1 month ago
Kill Chain
Massive 2026 Data Breach Exposes One Million Passport Records
In June 2026, a significant data breach exposed nearly one million passport records worldwide. The compromised data originated from an ID verification system used by cannabis dispensaries, where high-value credentials like passports were utilized for authentication. Attackers exploited vulnerabilities in this ancillary system, leading to the unauthorized disclosure of sensitive personal information. This incident underscores the critical need for robust security measures across all systems handling sensitive data, regardless of their primary function. It highlights the risks associated with using high-value credentials in less secure, ancillary systems and the potential for such breaches to have widespread implications.
1 month ago
Kill Chain
Bluekit's Evolution: Browser-in-the-Middle Phishing Attacks
In June 2026, the Bluekit phishing-as-a-service platform introduced browser-in-the-middle (BitM) capabilities, enhancing its ability to steal user credentials. This method involves the attacker controlling a browser session that loads legitimate login pages, intercepting user inputs and session tokens. By leveraging the open-source JavaScript library 'rrweb,' Bluekit streams the page's DOM over a WebSocket connection, allowing real-time interaction and data theft. This evolution signifies a shift towards more sophisticated phishing techniques that can bypass traditional security measures, including multi-factor authentication (MFA). Organizations must be aware of these advanced tactics to bolster their defenses against such threats.
1 month ago
Kill Chain
Gaslight Malware: A New Challenge for AI-Based Security on macOS
In June 2026, cybersecurity researchers identified a new macOS malware named 'Gaslight,' attributed to a North Korean-linked threat actor. This Rust-based malware functions as a backdoor and information stealer, embedding 38 fabricated system messages within its binary. These messages, formatted to resemble legitimate developer logs and error reports, aim to mislead AI-assisted malware analysis tools by simulating analysis errors, potentially causing the tools to abort or misinterpret the malware's behavior. The emergence of 'Gaslight' underscores a growing trend where threat actors develop sophisticated techniques to evade detection by AI-driven security solutions. This incident highlights the need for continuous advancement in cybersecurity defenses to counteract evolving obfuscation methods employed by adversaries.
1 month ago
Kill Chain
Cybercriminals Exploit Shop App in Advanced Phishing Attack - June 2026
In June 2026, threat actors exploited Shopify's order-tracking app, Shop, by inserting fraudulent purchase receipts into users' order histories. These fake receipts, impersonating brands like Norton and PayPal, included phone numbers leading to scammers posing as support agents. Victims were deceived into disclosing sensitive information or installing remote access software, facilitating unauthorized access to their devices. This method leverages the inherent trust users place in the Shop app, making the scam particularly effective. This incident underscores a significant evolution in phishing tactics, moving beyond traditional email-based schemes to infiltrate trusted applications directly. The rise of such sophisticated social engineering attacks highlights the urgent need for enhanced security measures and user vigilance within digital platforms.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports