✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
DraftKings 2022 Credential Stuffing Attack: A Case Study
In November 2022, DraftKings, a prominent sports betting platform, experienced a credential stuffing attack that compromised approximately 68,000 user accounts. Attackers exploited reused or weak passwords to gain unauthorized access, leading to the theft of nearly $300,000 from customer accounts. The company promptly reimbursed affected users and emphasized the importance of unique passwords and two-factor authentication to enhance account security. This incident underscores the growing threat of credential stuffing attacks, where cybercriminals leverage stolen credentials from previous breaches to infiltrate accounts on other platforms. The DraftKings case highlights the critical need for robust password practices and multi-factor authentication to mitigate such risks.
1 month ago
Kill Chain
Global Coalition Dismantles Amadey and StealC Malware Networks
In June 2026, an international law enforcement operation, in collaboration with private sector partners including Microsoft, Bitdefender, Bitsight, and ESET, successfully dismantled the infrastructure supporting the Amadey and StealC malware networks. This coordinated effort led to the seizure of 326 servers and 142 domains, the identification and restriction of over $47 million in illicit cryptocurrency assets, and the recovery of approximately 27 million stolen login credentials. The operation targeted the 'assembly lines' used by cybercriminals to launch ransomware, financial fraud, and attacks on critical infrastructure. This takedown underscores the growing effectiveness of public-private partnerships in combating cybercrime. By disrupting the infrastructure of malware-as-a-service operations like Amadey and StealC, authorities have significantly hindered the ability of cybercriminals to execute large-scale attacks, highlighting the importance of collaborative efforts in enhancing global cybersecurity.
1 month ago
Kill Chain
Klue OAuth Breach: A Wake-Up Call for Third-Party Integration Security
In June 2026, attackers exploited a legacy credential to breach Klue's backend servers, deploying malicious code that harvested OAuth tokens used to integrate with third-party platforms, including Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated substantial CRM data—such as business contacts, price quotes, and sales communications—from multiple organizations, including Huntress and Recorded Future. The extortion group 'Icarus' claimed responsibility, threatening to leak the stolen data if ransom demands were not met. In response, Salesforce disabled the Klue Battlecards app integration to prevent further unauthorized access. This incident underscores the critical vulnerabilities associated with third-party integrations and the importance of stringent access controls and credential management. The exploitation of OAuth tokens highlights a growing trend in supply chain attacks, emphasizing the need for organizations to reassess and fortify their security postures against such sophisticated threats.
1 month ago
Kill Chain
Understanding the 'Cordyceps' Vulnerability: A Threat to CI/CD Workflows
In June 2026, a critical vulnerability named 'Cordyceps' was identified, affecting Continuous Integration and Continuous Deployment (CI/CD) workflows across major platforms including Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and the Python Software Foundation's Black. This flaw allows unauthenticated attackers to exploit automated workflows via malicious pull requests, potentially leading to command injection, privilege escalation, and full control over affected repositories. The attack vector leverages the inherent trust in pull requests and the automated processes that handle them, exposing millions of repositories to potential hijacking. ([darkreading.com](https://www.darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflows?utm_source=openai)) The discovery of 'Cordyceps' underscores the escalating risks within software supply chains, particularly as agentic coding practices proliferate, reproducing insecure patterns across numerous repositories. Organizations are urged to audit and secure their CI/CD configurations to prevent unauthorized access and mitigate the risk of supply chain compromises.
1 month ago
Kill Chain
Malicious OpenClaw Skills Threaten AI Supply Chain
In June 2026, security researchers identified five malicious skills on ClawHub, OpenClaw's dedicated marketplace, that could steal credentials, bypass security scans, and perform other malicious activities for financial gain. These skills, appearing legitimate, demonstrated that such platforms are emerging as significant AI supply chain attack surfaces. ClawHub sells these skills to add functionality to the open-source AI agent, which has seen rapid adoption among developers and businesses since its launch last November. The malicious skills included infostealers targeting macOS, evasion techniques using inflated file sizes to bypass detection, and agentic threats like affiliate injection and front-running, all posing significant risks to organizations using OpenClaw. ([darkreading.com](https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain?utm_source=openai)) This incident underscores the growing threat of supply chain attacks within AI ecosystems, highlighting the need for rigorous verification frameworks and continuous monitoring of third-party extensions to prevent unauthorized access and data exfiltration.
1 month ago
Kill Chain
Critical macOS Vulnerability Allows Disabling of Security Tools Without Admin Credentials
In June 2026, researchers at XM Cyber identified a macOS vulnerability that allows users with standard privileges to disable enterprise security tools and execute privileged functions without administrator credentials. This flaw exploits how macOS establishes and validates application trust information, enabling attackers to impersonate trusted application components and perform actions reserved for privileged processes. The technique was demonstrated to disable CrowdStrike Falcon Endpoint Detection and Response (EDR) and Kandji Mobile Device Management (MDM) without triggering alerts or requiring kernel exploits. The issue potentially affects other macOS applications that provide privileged Cross-Process Communication (XPC) services and rely on Apple's CDHash for verifying application authenticity. XM Cyber plans to release an open-source tool named XPC Hunter at Black Hat USA in August to help security researchers identify similar vulnerabilities across macOS applications. Apple has been notified but has not responded at press time. This vulnerability underscores the need for organizations to reassess their macOS security configurations and implement additional safeguards to prevent unauthorized access and manipulation of security tools.
1 month ago
Kill Chain
CISA Highlights Critical Vulnerabilities in Lantronix and Ubiquiti Devices
On June 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2025-67038 affecting Lantronix EDS5000 devices, and three critical issues in Ubiquiti UniFi OS: CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation). These vulnerabilities are frequently exploited by malicious actors, posing significant risks to federal enterprises. ([cyberleveling.com](https://cyberleveling.com/blog/unifi-os-cve-2026-34908-34909-34910-critical?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched systems. Organizations are urged to prioritize remediation efforts to mitigate potential exploits, especially given the critical nature of these vulnerabilities and their potential impact on network infrastructure.
1 month ago
Kill Chain
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
In June 2026, the U.S. Department of Justice seized a cloud computing account utilized by subsidiaries of Cambodia-based Huione Group. This infrastructure supported Huione Guarantee, a Telegram-based marketplace facilitating the laundering of billions in cryptocurrency obtained through investment frauds and cyber scams. The platform offered services such as money laundering, sale of stolen personal data, and tools for fraudulent activities, enabling the conversion of illicit proceeds into the legitimate banking system undetected. This action underscores the escalating global efforts to dismantle sophisticated cybercriminal networks exploiting digital platforms for large-scale financial crimes. The seizure highlights the critical need for robust cybersecurity measures and vigilant monitoring of online marketplaces to prevent the proliferation of such illicit activities.
1 month ago
Kill Chain
Critical Cisco Unified CM Vulnerability CVE-2026-20230 Exploited in the Wild
In June 2026, a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-20230, was discovered in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). This flaw allows unauthenticated remote attackers to send crafted HTTP requests, enabling arbitrary file writes to the underlying operating system and potential privilege escalation to root. The vulnerability specifically affects deployments with the WebDialer service enabled, which is disabled by default. Cisco has assigned a Security Impact Rating of Critical due to the severity of the potential exploit. The public availability of proof-of-concept exploit code has led to active exploitation of this vulnerability in the wild. Organizations using affected Cisco Unified CM versions are urged to apply the provided patches immediately or disable the WebDialer service to mitigate the risk of unauthorized access and control over their telephony infrastructure.
1 month ago
Kill Chain
The Rise of Autonomous AI Cyber Threats in 2026
In early 2026, the cybersecurity landscape experienced a paradigm shift with the emergence of frontier agentic AI models capable of autonomously discovering and exploiting software vulnerabilities at unprecedented speeds. These AI entities can identify, weaponize, and execute attacks before human defenders can respond, rendering traditional defense mechanisms inadequate. The convergence of IT and OT systems further amplifies the risk, as AI-driven breaches can seamlessly transition from digital to physical infrastructures, leading to potential operational disruptions and safety hazards. This development underscores the urgent need for organizations to reassess their cybersecurity strategies. The rapid evolution of AI-driven threats necessitates the adoption of advanced defense mechanisms that can operate at machine speed, ensuring resilience against these sophisticated adversaries.
1 month ago
Kill Chain
OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security
In early 2026, the OpenClaw AI agent ecosystem experienced a significant supply chain attack. Malicious actors uploaded over 800 compromised skills to ClawHub, OpenClaw's official skill marketplace, embedding infostealers and enabling agentic financial fraud. This breach exposed more than 135,000 instances, highlighting critical vulnerabilities in AI agent platforms. The incident underscores the urgent need for enhanced security measures in AI supply chains, as attackers increasingly exploit these platforms to distribute malware and conduct sophisticated cyber operations.
1 month ago
Kill Chain
Cordyceps Vulnerabilities Threaten Over 300 GitHub Repositories
In June 2026, cybersecurity firm Novee identified a systemic class of vulnerabilities, dubbed 'Cordyceps,' within GitHub Actions workflows. These flaws enable unauthenticated attackers to hijack continuous integration and continuous deployment (CI/CD) pipelines by exploiting insecure configurations in YAML files. The vulnerabilities affect repositories from major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, potentially compromising software supply chains and exposing sensitive credentials. ([securityweek.com](https://www.securityweek.com/exploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking/?utm_source=openai)) This incident underscores the escalating risks associated with CI/CD pipeline security, especially as AI-driven coding tools proliferate. Organizations must prioritize securing their development workflows to prevent similar supply chain attacks, which are becoming increasingly sophisticated and widespread. ([mallory.ai](https://www.mallory.ai/stories/019ef4cf-b141-7c22-b785-3b7e99e1c73f?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports