The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
DifyTap Vulnerabilities: A Wake-Up Call for Multi-Tenant AI Security
In June 2026, cybersecurity researchers from Zafran Security disclosed four critical vulnerabilities in Dify, an open-source agentic workflow platform. These flaws, collectively termed 'DifyTap,' allowed unauthorized access to AI conversations across different tenants without authentication. The vulnerabilities included authorization bypasses and path traversal issues, enabling attackers to read private AI chats, manipulate internal APIs, and access files across tenants. This incident underscores the growing risks associated with multi-tenant cloud services and the importance of stringent access controls. As AI platforms become integral to business operations, ensuring their security is paramount to prevent data breaches and maintain user trust.
3 months ago
Kill Chain
Unveiling the WhatsApp VBS RMM Campaign: A 2026 Cybersecurity Threat
In June 2026, a sophisticated malware campaign was identified, leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. These scripts, once executed, initiated a multi-stage infection chain that ultimately installed Remote Monitoring and Management (RMM) software, granting attackers persistent remote access to compromised Windows systems. The campaign employed social engineering tactics, using deceptive file names to entice users into executing the scripts. Notably, the malware utilized renamed legitimate Windows utilities and retrieved payloads from trusted cloud services, effectively evading detection mechanisms. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/31/whatsapp-malware-campaign-delivers-vbs-payloads-msi-backdoors/?utm_source=openai)) This incident underscores a concerning trend in cyber threats, where attackers exploit widely-used communication platforms and legitimate tools to infiltrate systems. The use of trusted cloud services for payload delivery and the manipulation of standard Windows utilities highlight the evolving sophistication of threat actors. Organizations must remain vigilant, enhancing their security protocols to detect and mitigate such deceptive tactics.
3 months ago
Kill Chain
Crypto Heist Leveraging Fake Reputation Networks to Distribute Malware
In June 2026, cybercriminals orchestrated a sophisticated campaign to distribute a Rust-based clipboard hijacking malware targeting both Windows and macOS users. The attackers created a comprehensive fake reputation network, utilizing GitHub repositories, SourceForge projects, AI-generated YouTube videos, and manipulated VirusTotal comments to lend credibility to their malicious tools. These tools, masquerading as crypto trading and gambling aids, were designed to steal cryptocurrency by intercepting wallet addresses copied to the clipboard, affecting assets like Bitcoin, Ethereum, Monero, Binance Chain, and Solana. This incident underscores a significant evolution in cybercriminal tactics, highlighting their ability to exploit multiple trusted platforms to build false credibility and deceive users. The campaign's success demonstrates the urgent need for enhanced vigilance and skepticism towards online reputation signals, especially in the cryptocurrency domain, where the allure of quick profits can cloud judgment.
3 months ago
Kill Chain
INTERPOL Highlights Escalating Cyber Threats in Asia-Pacific
INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report highlights a significant surge in cybercrime across the region, driven by rapid digitalization and organized criminal networks. Phishing has emerged as the most prevalent and financially damaging form of cybercrime, with over half of the surveyed countries reporting that cybercrime accounts for more than 30% of all recorded crimes. The report also notes a rise in ransomware attacks, deepfake scams, and AI-driven frauds targeting sectors such as real estate, manufacturing, and financial services. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai)) This escalation underscores the urgent need for enhanced cybersecurity measures and international cooperation to combat the evolving threat landscape. The increasing sophistication of cybercriminal tactics, including the use of AI and ransomware-as-a-service models, poses a substantial risk to both public and private sectors. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai))
3 months ago
Kill Chain
React2Shell (CVE-2025-55182) Exploitation: A December 2025 Cybersecurity Incident
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components versions 19.0.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via improper deserialization in the Flight protocol. Within hours of disclosure, multiple state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent access, and exfiltrate data. The rapid exploitation led to significant security incidents across various sectors globally. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The React2Shell incident underscores the critical importance of prompt patching and vigilant monitoring. The swift exploitation by sophisticated threat actors highlights the need for organizations to enhance their vulnerability management processes and adopt proactive security measures to mitigate emerging threats effectively.
3 months ago
Kill Chain
Squidbleed Vulnerability (CVE-2026-47729) Exposes Cleartext HTTP Requests
In June 2026, researchers disclosed 'Squidbleed' (CVE-2026-47729), a critical vulnerability in the Squid web proxy that has existed since 1997. This heap over-read flaw allows an attacker with access to the same proxy to leak another user's cleartext HTTP requests, potentially exposing sensitive information such as credentials or session tokens. The vulnerability stems from improper handling of FTP directory listings, leading to memory disclosure when parsing malformed responses from attacker-controlled FTP servers. Squid's default configuration, which enables FTP support and permits traffic on port 21, exacerbates the risk. The disclosure of Squidbleed underscores the persistent risks associated with legacy code and the importance of regular security audits. Organizations relying on Squid proxies should promptly update to version 7.7 or later, which addresses this vulnerability. Additionally, disabling FTP support can mitigate exposure. This incident highlights the need for vigilant maintenance of network infrastructure to prevent exploitation of longstanding vulnerabilities.
3 months ago
Kill Chain
OXLOADER Exploits Google Ads to Distribute CastleStealer Malware
In June 2026, cybersecurity researchers identified a new malware loader named OXLOADER, which is being used to distribute the CastleStealer infostealer. The campaign begins with malicious Google Ads that redirect users searching for 'lts version of node.js' to a counterfeit website. This site delivers a batch script hosted on Storj, which, when executed, downloads and runs OXLOADER. OXLOADER employs advanced obfuscation techniques and anti-analysis measures to evade detection, ultimately deploying CastleStealer to exfiltrate sensitive information from infected systems. This incident underscores the evolving tactics of threat actors who exploit legitimate services like Google Ads and Storj to distribute malware. The sophisticated obfuscation and anti-analysis methods used by OXLOADER highlight the increasing complexity of malware designed to bypass traditional security measures, posing significant challenges for detection and mitigation.
3 months ago
Kill Chain
Mastra AI Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Microsoft identified a significant supply chain attack targeting the Mastra AI ecosystem, attributed to the North Korean state-sponsored group Sapphire Sleet (also known as BlueNoroff). The attackers compromised an npm maintainer account, 'ehindero,' with publishing privileges across the Mastra package environment. They published malicious updates for over 140 packages within the @mastra scope, introducing a malicious dependency named 'easy-day-js,' a typosquat of the legitimate 'dayjs' JavaScript library. Upon installation, this dependency executed a post-install hook deploying a malware dropper on developers' devices, aiming to steal sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets. The second-stage payload was a cross-platform information stealer designed to target Windows, Linux, and macOS systems, collecting host information, browser histories, installed applications, running processes, and checking for 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. The malware employed different persistence methods depending on the operating system, such as Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. Microsoft observed that systems communicating with the attackers' command-and-control servers exhibited follow-on activity consistent with Sapphire Sleet's previous campaigns, including the deployment of a PowerShell backdoor, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges. This incident underscores the evolving tactics of North Korean threat actors in targeting the software supply chain to facilitate credential theft and cryptocurrency asset exfiltration. Organizations are urged to enhance their supply chain security measures and remain vigilant against such sophisticated attacks.
3 months ago
Kill Chain
Prinz Eugen Ransomware: A New Threat Targeting Recent Files
In June 2026, the Prinz Eugen ransomware group launched attacks targeting organizations in the United Kingdom, France, and South Africa. The group gained initial access through stolen RDP credentials, utilizing legitimate remote monitoring and management tools to establish persistence. Their Go-based malware prioritized encrypting recently modified files, aiming to disrupt critical business operations. Notably, the ransomware did not leave a ransom note, complicating detection and response efforts. This incident underscores the evolving tactics of ransomware groups, emphasizing the need for organizations to enhance their cybersecurity measures. The use of legitimate tools for malicious purposes highlights the importance of monitoring for anomalous behavior and implementing robust access controls to mitigate such threats.
3 months ago
Kill Chain
FortiBleed 2026: A Wake-Up Call for Credential Security
In June 2026, a large-scale credential theft campaign, dubbed "FortiBleed," targeted Fortinet devices, compromising approximately 75,000 firewalls and VPNs globally. Attackers employed password spraying techniques using curated lists from previous breaches to gain unauthorized access. Once inside, they extracted configuration files and credentials, enabling further exploitation and persistence within affected networks. Notably, major corporations such as Chevron, Samsung, and Toyota were impacted, with some organizations experiencing full network infiltration and data exfiltration. This incident underscores the escalating threat of credential-based attacks and highlights the critical need for robust security measures. Organizations must prioritize implementing multi-factor authentication, regularly updating credentials, and monitoring for unauthorized access to mitigate such risks.
3 months ago
Kill Chain
FortiBleed: Unprecedented Exposure of Fortinet Credentials in 2026
In June 2026, a significant cybersecurity incident known as 'FortiBleed' was uncovered, exposing nearly 74,000 Fortinet firewall and VPN credentials. Security researcher Volodymyr 'Bob' Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for 73,932 firewall URLs worldwide. The exposed data also included organizational details such as industry, revenue, and employee count, suggesting the information was compiled to facilitate future attacks. Threat intelligence company Hudson Rock described this as one of the largest known collections of compromised Fortinet credentials, spanning 21,632 unique domains across 194 countries. The 'FortiBleed' incident underscores the critical importance of securing network devices against credential-based attacks. Organizations are urged to implement robust password policies, enable multifactor authentication, and regularly monitor for unauthorized access to mitigate such threats.
3 months ago
Kill Chain
CISA Confirms Active Exploitation of Splunk Enterprise Vulnerability CVE-2026-20253
In June 2026, a critical vulnerability (CVE-2026-20253) was identified in Splunk Enterprise versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6, allowing unauthenticated remote attackers to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint lacking authentication controls. This flaw enables potential remote code execution, posing significant risks to affected systems. ([advisory.splunk.com](https://advisory.splunk.com/advisories/SVD-2026-0603?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of this vulnerability and has mandated federal agencies to patch their systems by June 22, 2026.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports