Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 101 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1201–1212 / 4893 reports
15 TP-Link Vulnerabilities Unveil Critical Zero-Touch Provisioning Risks
Telecommunications3 months ago

15 TP-Link Vulnerabilities Unveil Critical Zero-Touch Provisioning Risks

In August 2026, researchers at Black Hat USA disclosed 15 vulnerabilities in TP-Link's Omada software-defined networking ecosystem, highlighting significant security risks associated with zero-touch provisioning (ZTP). These vulnerabilities, affecting routers, switches, gateways, and Wi-Fi access points, could be exploited to hijack devices, execute client-side code, disclose sensitive information, and compromise encryption protocols. The findings underscore the potential for large-scale network intrusions facilitated by automated provisioning processes. The incident serves as a critical reminder of the inherent risks in ZTP implementations, emphasizing the need for organizations to scrutinize and secure their provisioning workflows. As ZTP adoption grows, ensuring robust security measures during device onboarding becomes paramount to prevent exploitation by threat actors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling CSS Email Attacks: Insights from Black Hat 2026
Financial Services3 months ago

Unveiling CSS Email Attacks: Insights from Black Hat 2026

In August 2026, at Black Hat USA, security researcher Gareth Heyes unveiled a series of novel attack techniques exploiting Cascading Style Sheets (CSS) within HTML emails. These methods enable attackers to compromise email accounts by bypassing traditional security measures, such as CSS sanitization and Content Security Policies, using only CSS and HTML. The attacks can lead to unauthorized data exfiltration, user tracking, and full account takeovers without the need for JavaScript or malicious attachments. ([portswigger.net](https://portswigger.net/research/talks?talkid=34&utm_source=openai)) This research highlights a significant shift in email-based attack vectors, emphasizing the need for enhanced security measures in webmail platforms. As attackers continue to innovate, organizations must adapt their defenses to address these emerging threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
AI-Driven Fraud: A New Era of Global Crime Syndicates in 2026
Banking/Mortgage3 months ago

AI-Driven Fraud: A New Era of Global Crime Syndicates in 2026

In 2026, global crime syndicates have significantly escalated their fraudulent activities by leveraging advanced artificial intelligence technologies. These groups employ AI-driven tools such as voice cloning, deepfake real-time video overlays, large language model (LLM)-driven persona management, and automated translation to create highly convincing synthetic identities. This sophisticated approach enables them to bypass traditional 'know your customer' (KYC) protocols and other identity verification methods, leading to substantial financial losses across various sectors, including financial institutions, online retailers, and cryptocurrency exchanges. The urgency to address this issue is underscored by a 2026 INTERPOL report, which highlights a 54% increase in fraud-related campaigns since 2024, attributing this surge to AI enhancements. The report also notes that AI-enhanced fraud is 4.5 times more profitable than traditional methods, emphasizing the need for immediate and coordinated global action to combat this evolving threat. ([interpol.int](https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-warns-of-increasingly-sophisticated-global-financial-fraud-threat?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Unveiling the Security Flaws in AI-Powered Browsers
Computer Software/Engineering3 months ago

Unveiling the Security Flaws in AI-Powered Browsers

In August 2026, security researcher Artem Chaikin presented findings at Black Hat USA 2026 revealing that AI-powered web browsers, including Opera's AI browser, Perplexity's Comet, and OpenAI's ChatGPT Atlas, are susceptible to prompt injection attacks. These attacks exploit hidden instructions within web content, leading to potential data exfiltration and account takeovers. Despite implementing various security measures such as system-level prompts, content tagging, and user approval mechanisms, these browsers remain vulnerable due to the inherent challenges in distinguishing between user instructions and untrusted web content. This incident underscores the persistent security challenges associated with integrating AI assistants into web browsers. As AI functionalities become more embedded in everyday applications, the risk of prompt injection attacks increases, highlighting the need for continuous research and development of more robust security frameworks to protect users from emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Understanding 'PleaseFix': Securing AI Browsers Against Zero-Click Agent Hijacking
Computer Software/Engineering3 months ago

Understanding 'PleaseFix': Securing AI Browsers Against Zero-Click Agent Hijacking

In March 2026, Zenity Labs disclosed 'PleaseFix,' a family of critical vulnerabilities affecting agentic browsers like Perplexity Comet. These flaws enable attackers to hijack AI agents through malicious instructions embedded in routine content, such as emails or calendar invites, without any user interaction. Exploiting these vulnerabilities, adversaries can access local files, steal credentials, and perform unauthorized actions within authenticated user sessions. The root cause lies in the agents' inability to distinguish between legitimate user commands and adversarially injected instructions, leading to significant security breaches. This incident underscores the urgent need for organizations to reassess the security models of AI-integrated systems. As AI agents become more prevalent in enterprise environments, the risk of similar zero-click exploits increases, highlighting the necessity for robust input validation, strict access controls, and continuous monitoring to prevent unauthorized agent behavior.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Snowflake Data Breach: Lessons in Credential Security
Telecommunications3 months ago

Snowflake Data Breach: Lessons in Credential Security

In 2024, threat actor UNC5537 exploited stolen credentials to access Snowflake customer accounts lacking multi-factor authentication (MFA), compromising at least 165 organizations and exposing data of over 100 million individuals. The attackers utilized infostealer malware to harvest credentials, some dating back to 2020, leading to significant data breaches affecting companies like AT&T and Ticketmaster. This incident underscores the critical importance of implementing robust security measures, such as MFA and regular credential rotation, to protect against credential-based attacks. Organizations must remain vigilant as similar tactics continue to pose significant threats to data security.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Urgent: Active Exploitation of TeamCity CVE-2026-63077 RCE Vulnerability
Computer Software/Engineering3 months ago

Urgent: Active Exploitation of TeamCity CVE-2026-63077 RCE Vulnerability

In July 2026, JetBrains identified a critical vulnerability (CVE-2026-63077) in TeamCity On-Premises, allowing unauthenticated remote code execution via the agent polling protocol. This flaw enables attackers to bypass authentication and execute arbitrary OS commands with the server's privileges, potentially exposing sensitive data and compromising CI/CD pipelines. JetBrains released patches in versions 2025.11.7 and 2026.1.3 to address this issue. ([blog.jetbrains.com](https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/?utm_source=openai)) By August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability in the wild, emphasizing the urgency for organizations to apply the available patches promptly to mitigate potential threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ransom Cartel Creator Sentenced to 16 Years in Prison
Financial Services3 months ago

Ransom Cartel Creator Sentenced to 16 Years in Prison

In August 2026, Maksim Silnikau, a 40-year-old Belarusian national, was sentenced to 16 years in prison for creating and operating the Ransom Cartel ransomware-as-a-service (RaaS) operation. Between 2021 and 2023, Ransom Cartel affiliates attacked at least 18 companies across the United States and abroad. Silnikau developed the ransomware software, acquired stolen credentials from initial access brokers, and managed a hidden panel where affiliates coordinated attacks, negotiated with victims, and divided proceeds. He also implemented a ratings system to reward productive affiliates and utilized cryptocurrency mixers to launder ransom payments. This sentencing underscores the ongoing threat posed by RaaS operations and highlights the importance of robust cybersecurity measures. The case also reflects the evolving landscape of cybercrime, where individuals can orchestrate widespread attacks without directly engaging in intrusions, emphasizing the need for comprehensive strategies to combat such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Agent Infrastructure Flaws Patched by AWS, Google, and Vercel
Computer Software/Engineering3 months ago

Critical Agent Infrastructure Flaws Patched by AWS, Google, and Vercel

In August 2026, security vulnerabilities were identified in agent infrastructures from Amazon Web Services (AWS), Google, and Vercel, allowing attackers to execute tools without model authorization. These flaws affected AWS's Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for Codex and OpenCode coding agents. The vulnerabilities enabled untrusted instructions to reach agent tools without verification, bypassing system prompts and model-level guardrails. AWS, Google, and Vercel have since released patches to address these issues. This incident underscores the critical need for robust input validation and authorization mechanisms in AI agent infrastructures. As AI tools become increasingly integrated into enterprise environments, ensuring their security is paramount to prevent unauthorized access and potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Attackers Leverage SQL Injection to Deploy 'khunt' Toolkit in Oracle Database
Banking/Mortgage3 months ago

Attackers Leverage SQL Injection to Deploy 'khunt' Toolkit in Oracle Database

In July 2026, attackers exploited a SQL injection vulnerability in a public-facing web application's autocomplete search field to gain unauthorized access to an organization's Oracle database. Utilizing the database's embedded Java Virtual Machine, they compiled and executed Java code within the database, achieving SYSTEM-level access on the underlying Windows server. This method allowed the deployment of a post-exploitation toolkit, 'khunt,' without writing executables to disk, effectively transforming the database into an attack platform. The incident underscores the critical need for robust input validation, parameterized queries, and strict privilege management to prevent such sophisticated attacks. The 'khunt' toolkit's deployment highlights a resurgence in advanced SQL injection techniques, emphasizing the importance of comprehensive security measures in database management systems. Organizations must remain vigilant against evolving threats that exploit inherent database functionalities for malicious purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Apple iCloud Private Relay Vulnerability Exposes Real IP Addresses
Financial Services3 months ago

Apple iCloud Private Relay Vulnerability Exposes Real IP Addresses

In August 2026, cybersecurity researchers Talal Haj Bakry and Tommy Mysk disclosed a vulnerability in Apple's iCloud Private Relay, a feature designed to enhance user privacy by routing Safari web traffic through dual relays. The flaw resides in WebKit's handling of DNS prefetching, WebAuthn Related Origin Requests, and WebTransport, which can bypass configured proxies and expose users' real IP addresses. This issue affects Safari and all third-party browsers on iOS, iPadOS, and macOS that rely on WebKit's proxy configuration APIs. As a result, users' actual IP addresses can be leaked, undermining the privacy protections offered by iCloud Private Relay. This vulnerability is particularly concerning given the widespread use of WebKit across Apple's ecosystem and its integration into various browsers. The exposure of real IP addresses can lead to targeted attacks, tracking, and a compromise of user anonymity. Organizations and individuals relying on iCloud Private Relay for privacy should be aware of this flaw and consider additional protective measures until a patch is released.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CryptoJS Vulnerability Exposes Cryptocurrency Wallets to Massive Theft
Financial Services3 months ago

CryptoJS Vulnerability Exposes Cryptocurrency Wallets to Massive Theft

In August 2026, Coinspect identified a critical vulnerability in the JavaScript cryptography library CryptoJS, specifically in the `WordArray.random()` function. This function, introduced 12 years prior, utilized a weak random number generator that compromised the entropy of recovery phrases generated by several cryptocurrency wallet applications. As a result, attackers exploited this weakness to drain approximately $5.7 million from affected wallets across two major incidents since late May 2026. The compromised wallets include RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo, with varying degrees of remediation and discontinuation. This incident underscores the critical importance of robust cryptographic practices in software development, especially in applications handling sensitive financial data. The exploitation of weak random number generators highlights the necessity for developers to employ secure entropy sources and for organizations to conduct thorough security audits of third-party libraries to prevent similar vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports