✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Evil MSI Background: Unveiling the 2026 Phishing Campaign
In June 2026, a sophisticated phishing campaign emerged, leveraging WeTransfer links to distribute malicious JavaScript files. These scripts, upon execution, utilized obfuscation techniques to decode and run PowerShell commands, which subsequently downloaded additional payloads, including a .NET DLL designed to manipulate Windows Task Scheduler. This method facilitated the execution of further malicious activities, potentially leading to persistent system compromise. The campaign notably exploited legitimate cloud services like Cloudflare Workers and R2 storage to host and distribute its malicious components, thereby enhancing its stealth and effectiveness. This incident underscores a growing trend where threat actors increasingly abuse trusted cloud platforms to host and disseminate malware, complicating detection and mitigation efforts. The use of obfuscated scripts and legitimate services highlights the evolving sophistication of phishing attacks, emphasizing the need for enhanced vigilance and advanced security measures to detect and prevent such threats.
1 month ago
Kill Chain
FBI Dismantles AI-Powered Phishing Operation 'Outsider Enterprise'
In June 2026, the FBI, in collaboration with Google and Black Lotus Labs, dismantled 'Outsider Enterprise,' a Chinese phishing-as-a-service operation active since at least 2023. This cybercrime network utilized AI to distribute phishing kits, creating over 9,000 fake websites and more than a million fraudulent URLs. These sites impersonated trusted brands, leading to the theft of approximately 3.8 million credit card records and causing an estimated $1.9 billion in losses. The takedown, part of Operation Riptide, involved seizing multiple servers, a Shopify storefront, and around $100,000 USDT from Outsider's payment wallets. Thousands of phishing domains now redirect to an FBI splash page. This incident underscores the escalating use of AI in cybercrime, enabling large-scale, sophisticated phishing campaigns. The success of Operation Riptide highlights the importance of coordinated efforts between law enforcement and private sector entities in combating such threats.
1 month ago
Kill Chain
Operation Highland: Unveiling a Decade of Stealthy Cyber-Espionage
In 2026, cybersecurity researchers uncovered 'Operation Highland,' a decade-long cyber-espionage campaign by the Chinese state-sponsored group Velvet Ant. Beginning in 2016, the attackers initially compromised internet-facing servers, deploying modified GS-Netcat reverse shells for encrypted remote access. They then installed custom SOCKS5 proxies to tunnel traffic, enabling access to isolated networks. By backdooring Linux Pluggable Authentication Modules (PAM) and OpenSSH components, Velvet Ant harvested credentials and maintained persistent access, effectively embedding themselves within the authentication process. This allowed them to monitor administrative activities and exfiltrate sensitive data undetected for ten years. The discovery of this prolonged intrusion underscores the evolving sophistication of state-sponsored cyber threats. It highlights the critical need for organizations to implement robust monitoring of authentication systems, conduct regular integrity checks of security components, and adopt a zero-trust security model to mitigate the risk of such stealthy and persistent attacks.
1 month ago
Kill Chain
ShinyHunters' Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
Between May 27 and June 9, 2026, the cyber extortion group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, specifically targeting the Environment Management Hub (EMHub). This critical flaw allowed unauthenticated remote code execution, leading to the compromise of over 100 organizations, predominantly in the higher education sector. The attackers exfiltrated sensitive data from approximately 300 PeopleSoft instances, including personal and financial information of students and staff. Oracle released a security advisory and patch on June 10, 2026, urging immediate action to mitigate the risk. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/shinyhunters-oracle-zero-day-higher-ed?utm_source=openai)) This incident underscores the increasing targeting of educational institutions by cybercriminals exploiting unpatched vulnerabilities in widely used enterprise software. The rapid exploitation of zero-day vulnerabilities highlights the necessity for organizations to implement proactive vulnerability management and incident response strategies to protect sensitive data and maintain operational integrity.
1 month ago
Kill Chain
Critical Vulnerability in Splunk Enterprise: CVE-2026-20253
In June 2026, a critical vulnerability (CVE-2026-20253) was identified in Splunk Enterprise versions below 10.2.4 and 10.0.7, allowing unauthenticated users to perform arbitrary file operations via a PostgreSQL sidecar service endpoint lacking authentication controls. This flaw could lead to remote code execution, data destruction, and full system compromise. Splunk has released patches to address this issue, urging immediate updates to mitigate potential exploitation. The disclosure of CVE-2026-20253 underscores the ongoing risks associated with unauthenticated access points in enterprise software. Organizations are advised to review their security postures, apply the latest patches promptly, and implement robust access controls to prevent similar vulnerabilities from being exploited.
1 month ago
Kill Chain
Unveiling App.MenuItem: A New Forensic Artifact in macOS Tahoe 26
In June 2026, researchers identified a new artifact in macOS Tahoe 26, named App.MenuItem, which logs specific menu selections made by users across the operating system. This artifact provides a detailed record of user actions, such as compressing files or emptying the trash, offering critical context for forensic investigations. Located at ~/Library/Biome/streams/restricted/App.MenuItem/local, the artifact contains SEGB-encapsulated protobuf entries that require specific tools to parse. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/?_wpnonce=c8aaaf1bea&lg=en&pdf=download&utm_source=openai)) The discovery of App.MenuItem is significant for digital forensics, as it allows examiners to reconstruct user workflows with greater precision. By capturing exact menu choices and timestamps, investigators can gain insights into user intent and actions, enhancing the accuracy of forensic analyses. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/?_wpnonce=c8aaaf1bea&lg=en&pdf=download&utm_source=openai))
1 month ago
Kill Chain
Critical Unauthenticated RCE Vulnerability in Oracle PeopleSoft Exploited: CVE-2026-35273
In early June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in its PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component. This flaw, present in versions 8.61 and 8.62, allows unauthenticated attackers with network access via HTTP to execute remote code, potentially leading to full system compromise. The vulnerability was actively exploited between May 27 and June 9, 2026, before Oracle released a patch on June 10. Over 100 organizations were affected, with data exfiltration reported from nearly 300 PeopleSoft instances. The cyber extortion group ShinyHunters is believed to be behind these attacks, though some experts suggest possible impersonation. ([techradar.com](https://www.techradar.com/pro/security/oracle-warns-customers-of-critical-peoplesoft-attack-after-hundreds-of-servers-hacked-by-apparent-shinyhunters-data-theft-attacks?utm_source=openai)) This incident underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in widely used enterprise applications. The rapid exploitation of CVE-2026-35273 highlights the importance of timely patch management and proactive monitoring to detect and mitigate such threats before they can cause significant damage.
1 month ago
Kill Chain
FBI Dismantles Outsider Cybercrime Network Responsible for $1.9 Billion in Losses
In June 2026, the FBI, in collaboration with Google and Lumen Technologies, dismantled a significant China-based cybercrime network known as Outsider Enterprise. This operation, dubbed 'Operation Ghost Hook,' targeted a phishing-as-a-service platform that had been active since July 2023. Outsider provided cybercriminals with phishing kits and hosted infrastructure, enabling them to impersonate trusted brands and defraud victims across 55 countries, including the United States. The takedown resulted in the seizure of several core admin server domains, a Shopify storefront, approximately $100,000 from Outsider's payment wallets, and thousands of domains registered through U.S.-based providers. Authorities linked Outsider's phishing domains to nearly 3.9 million stolen credit cards, contributing to an estimated $1.9 billion in losses. This incident underscores the evolving sophistication of cybercriminal operations, particularly the use of AI to enhance phishing campaigns. The Outsider platform's integration of AI tools like Google's Gemini allowed for the creation of highly convincing phishing lures, making it increasingly challenging for individuals and organizations to detect and prevent such attacks. The takedown highlights the necessity for continuous advancements in cybersecurity measures and the importance of international cooperation in combating cyber threats.
1 month ago
Kill Chain
Conti Ransomware Member Pleads Guilty to Wire Fraud Conspiracy
In June 2026, Ukrainian national Oleksii Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his role in the Conti ransomware group. Lytvynenko admitted to joining Conti in September 2021, developing malware used in attacks, and possessing data from 12 victims, including eight in the United States. Conti was responsible for over 1,000 ransomware attacks globally, resulting in at least $150 million in ransom payments. Lytvynenko faces up to 20 years in prison, with sentencing scheduled for September 10, 2026. This case underscores the persistent threat posed by ransomware groups and highlights the importance of international cooperation in combating cybercrime. Organizations should remain vigilant, as threat actors continue to evolve their tactics and rebrand under new identities, necessitating robust cybersecurity measures and proactive defense strategies.
1 month ago
Kill Chain
Detecting Early Warning Signs of Supply Chain Attacks on the Dark Web
In June 2026, cybersecurity researchers identified early indicators of potential supply chain attacks emerging from the dark web. Threat actors were observed advertising access to developer accounts, private repositories, and source code, which could be exploited to infiltrate organizations through trusted third-party relationships. These findings underscore the critical need for proactive monitoring of underground forums to detect and mitigate supply chain vulnerabilities before they escalate into full-scale breaches. The increasing sophistication of cybercriminals in targeting supply chains highlights the urgency for organizations to enhance their threat intelligence capabilities. By identifying and addressing these early warning signs, businesses can strengthen their defenses against complex attacks that exploit trusted connections and third-party services.
1 month ago
Kill Chain
Urgent: CISA's Directive on Patching Critical Ivanti Sentry Vulnerability
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating federal agencies to patch a critical vulnerability (CVE-2026-10520) in Ivanti Sentry devices within three days. This OS command injection flaw allows unauthenticated remote attackers to execute code with root privileges. Despite Ivanti's initial statement of no evidence of exploitation, reports emerged of attackers backdooring exposed Sentry gateways. This incident underscores the escalating threat landscape where critical vulnerabilities are rapidly exploited. Organizations must prioritize timely patching and robust vulnerability management to mitigate risks associated with such high-severity flaws.
1 month ago
Kill Chain
Ukrainian National's Guilty Plea Highlights Ongoing Ransomware Threats
In June 2026, Ukrainian national Oleksii Oleksiyovych Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his involvement in the Conti ransomware attacks between 2021 and 2022. Lytvynenko and his co-conspirators deployed Conti ransomware on victim networks in the United States and abroad, stealing data and encrypting devices to extort Bitcoin ransom payments. He admitted to possessing data stolen from eight U.S. victims and four overseas victims and to developing malware loaders used in these attacks. The Conti ransomware operation, active from 2019 to 2022, targeted over 1,000 victims worldwide, collecting over $150 million in ransom payments. The group was known for large-scale attacks against healthcare organizations, governments, and enterprises before shutting down in 2022 following internal leaks and increased law enforcement pressure. Former Conti members have since splintered into other ransomware groups, including BlackCat, Black Basta, and Hive.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports