✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026
In May 2026, the 'Mini Shai-Hulud' supply chain attack compromised over 300 npm packages within the @antv ecosystem by exploiting a maintainer's account. The attackers published 639 malicious versions across 323 packages, embedding malware designed to steal developer credentials and cloud secrets. This breach affected widely used packages like echarts-for-react, impacting millions of weekly downloads. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation and sophisticated techniques employed highlight the need for enhanced security measures in package management and developer workflows to prevent similar future compromises.
2 months ago
Kill Chain
GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities
In May 2026, threat actors compromised the GitHub Actions workflow 'actions-cool/issues-helper' by redirecting existing tags to an imposter commit containing malicious code. This code, when executed within CI/CD pipelines, harvested sensitive credentials and exfiltrated them to an attacker-controlled server. The attack involved downloading the Bun JavaScript runtime, reading memory from the Runner.Worker process to extract credentials, and transmitting the stolen data to 't.m-kosche[.]com'. GitHub has since disabled access to the affected repository due to violations of its terms of service. This incident underscores the escalating trend of software supply chain attacks targeting CI/CD pipelines. The use of imposter commits to inject malicious code highlights the need for organizations to implement stringent security measures, such as pinning dependencies to known-good commit SHAs and continuously monitoring for unauthorized changes in their development workflows.
2 months ago
Kill Chain
Nx Console Extension Compromised: A Wake-Up Call for Developer Security
On May 18, 2026, a compromised version of the Nx Console extension (version 18.95.0) was published to the Microsoft Visual Studio Code Marketplace. This extension, widely used by over 2.2 million developers, was altered to include a credential-stealing payload. Upon opening any workspace, the malicious extension fetched and executed an obfuscated payload from a hidden commit within the official nrwl/nx GitHub repository. This payload harvested sensitive information, including tokens and secrets from platforms such as GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, exfiltrating them via multiple channels. ([stepsecurity.io](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting developer tools. The sophisticated method of embedding malicious code within trusted extensions highlights the need for enhanced vigilance and security measures in software development environments. Developers and organizations must prioritize the integrity of their toolchains to prevent similar breaches.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in SEPPmail Secure Email Gateway
In May 2026, multiple critical vulnerabilities were identified in SEPPmail Secure Email Gateway, an enterprise-grade email security solution. These flaws, including CVE-2026-2743 (CVSS score: 10.0) and CVE-2026-44128 (CVSS score: 9.3), allowed unauthenticated remote code execution and unauthorized access to email traffic. Exploitation could lead to complete system compromise, enabling attackers to read all mail traffic and potentially use the gateway as an entry point into internal networks. ([thehackernews.com](https://thehackernews.com/2026/05/seppmail-secure-e-mail-gateway.html?utm_source=openai)) This incident underscores the persistent threat posed by vulnerabilities in email security solutions, highlighting the necessity for organizations to promptly apply security patches and conduct regular vulnerability assessments to safeguard sensitive communications.
2 months ago
Kill Chain
Drupal's Upcoming Security Update: What You Need to Know
On May 20, 2026, Drupal plans to release a highly critical security update for all supported core branches between 17:00 and 21:00 UTC. The Drupal Security Team has advised site administrators to allocate time for these updates, as exploits may emerge shortly after the release. Affected versions include 11.3.x, 11.2.x, 10.6.x, and 10.5.x. Administrators are encouraged to update to the latest patch releases in preparation for the security window. ([drupal.org](https://www.drupal.org/psa-2026-05-18?utm_source=openai)) This proactive measure underscores the importance of timely security updates in mitigating potential vulnerabilities. Organizations relying on Drupal should prioritize these updates to maintain the integrity and security of their web platforms.
2 months ago
Kill Chain
DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635
On May 19, 2026, a proof-of-concept (PoC) exploit code was released for a recently patched security flaw in the Linux kernel, identified as CVE-2026-31635 and dubbed 'DirtyDecrypt' or 'DirtyCBC'. This vulnerability, discovered by the Zellic and V12 security team, allows local privilege escalation due to a missing copy-on-write (COW) guard in the rxgk_decrypt_skb() function. The flaw enables unprivileged local users to write arbitrary bytes into the kernel's page cache of read-only files, potentially granting root privileges. Distributions with CONFIG_RXGK enabled, such as Fedora, Arch Linux, and openSUSE Tumbleweed, are affected. ([thehackernews.com](https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html?utm_source=openai)) The release of the PoC highlights the urgency for system administrators to apply the available patches promptly. This incident underscores the critical need for timely updates and vigilant monitoring of security advisories to mitigate risks associated with such vulnerabilities.
2 months ago
Kill Chain
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.
2 months ago
Kill Chain
TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. ([thehackernews.com](https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.
2 months ago
Kill Chain
Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation
In May 2026, Microsoft disrupted Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) platform. Fox Tempest exploited Microsoft's Artifact Signing to generate over a thousand fraudulent code-signing certificates, enabling other cybercriminals to distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, under the guise of legitimate software. This operation facilitated attacks across various sectors globally, including healthcare, education, government, and financial services. The takedown involved revoking the fraudulent certificates and dismantling the infrastructure supporting Fox Tempest's operations. The incident underscores the evolving tactics of cybercriminals who abuse legitimate services to enhance the credibility of their malware, thereby evading traditional security measures. It highlights the critical need for organizations to implement robust security controls, including advanced threat detection and response capabilities, to mitigate the risks posed by such sophisticated attack vectors.
2 months ago
Kill Chain
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in the MENA Region
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle East and North African countries. This operation led to 201 arrests, the identification of 382 additional suspects, and the seizure of 53 servers. Authorities disrupted various cybercrime activities, including phishing services, malware distribution, and financial scams, affecting nearly 4,000 victims. Notably, in Jordan, police uncovered a human trafficking scheme linked to financial fraud scams, rescuing 15 victims coerced into criminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private sector partners like Group-IB, Kaspersky, and Team Cymru provided critical threat intelligence, facilitating the identification and dismantling of malicious infrastructures. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))
2 months ago
Kill Chain
Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime
In May 2026, Microsoft, through its Digital Crimes Unit, successfully dismantled the infrastructure of Fox Tempest, a cybercrime service that produced and sold over 1,000 fraudulent code-signing certificates. These certificates were utilized by various ransomware groups, including Rhysida and Vanilla Tempest, to make malicious software appear legitimate, thereby bypassing security defenses. The operation involved seizing domain names, websites, and Azure resources linked to Fox Tempest, effectively disrupting their malware-signing-as-a-service operations. ([axios.com](https://www.axios.com/2026/05/19/microsoft-fox-tempest-law-enforcement-takedown?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, moving upstream to exploit software verification systems. The ability to fabricate trusted certificates at scale poses a substantial threat to global cybersecurity, emphasizing the need for enhanced vigilance and robust verification processes within software supply chains.
2 months ago
Kill Chain
Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities
The Pwn2Own Berlin 2026 hacking contest, held from May 14 to May 16, 2026, at the OffensiveCon conference, concluded with security researchers earning $1,298,250 in rewards after successfully exploiting 47 zero-day vulnerabilities. The competition focused on enterprise technologies and artificial intelligence, targeting fully patched products across various categories, including web browsers, enterprise applications, servers, and virtualization platforms. Notably, the DEVCORE Research Team secured the highest reward of $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. This event underscores the persistent challenges in securing enterprise software and the critical importance of proactive vulnerability management. The exposure of these zero-day vulnerabilities highlights the need for organizations to stay vigilant and prioritize timely patching to mitigate potential exploitation risks.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports