The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Critical Zero-Day Vulnerability in Cisco SD-WAN vManage Exploited in the Wild
In June 2026, Cisco disclosed a critical vulnerability (CVE-2026-20262) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw allowed authenticated remote attackers with low-level privileges to execute arbitrary commands as root by exploiting insufficient input validation during file uploads. The vulnerability affected all deployment types, including on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP). Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation of this zero-day vulnerability earlier in the month and strongly advised customers to apply the released security updates promptly. The exploitation of CVE-2026-20262 underscores a concerning trend of attackers targeting critical infrastructure components through zero-day vulnerabilities. Organizations must remain vigilant, ensuring timely patch management and robust security practices to mitigate such risks.
3 months ago
Kill Chain
North Korean Hackers Exploit Developer Tools in Sophisticated Phishing Campaign
In early 2026, a North Korean state-sponsored threat actor, identified as UNK_DeadDrop, launched a sophisticated phishing campaign targeting software developers across nearly 100 organizations, primarily in the United States. The attackers sent over 250 emails between April and May, masquerading as recruitment offers or code review requests. These emails directed recipients to clone malicious GitHub or GitLab repositories, which, when opened in code editors like Visual Studio Code, executed embedded malware. This approach enabled the attackers to steal cryptocurrency wallets and sensitive developer credentials. ([theregister.com](https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526?utm_source=openai)) This incident underscores a significant evolution in cyberattack methodologies, where adversaries exploit trusted developer tools and workflows to deliver malware. The campaign's scale and sophistication highlight the increasing targeting of the tech industry by state-sponsored actors, emphasizing the need for heightened vigilance and robust security measures within development environments. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/?utm_source=openai))
3 months ago
Kill Chain
Critical Authentication Bypass in SimpleHelp: CVE-2026-48558
In June 2026, a critical vulnerability (CVE-2026-48558) was discovered in SimpleHelp remote management software versions 5.5.15 and earlier, as well as 6.0 pre-release versions. This flaw allows unauthenticated attackers to create privileged technician accounts by exploiting improper validation of identity tokens in the OpenID Connect (OIDC) authentication flow. Consequently, attackers can gain unauthorized access to managed endpoints, execute scripts, and perform administrative actions without user interaction. SimpleHelp addressed this issue by releasing patched versions 5.5.16 and 6.0 RC2 on June 9, 2026. Organizations are urged to update their systems promptly to mitigate potential exploitation risks. This incident underscores the critical importance of robust authentication mechanisms and thorough validation processes in remote management tools. The exploitation of OIDC vulnerabilities highlights a growing trend where attackers target identity and access management systems to gain unauthorized access, emphasizing the need for continuous vigilance and timely patch management.
3 months ago
Kill Chain
Critical LiteLLM Vulnerabilities Expose AI Gateways to Unauthenticated RCE
In May 2026, a critical vulnerability chain was discovered in LiteLLM, an open-source AI gateway widely used to interface with over 100 large language model providers. The primary flaw, CVE-2026-42271, is a command injection vulnerability affecting versions 1.74.2 through 1.83.6. This vulnerability allows authenticated users, including those with low-privilege internal-user keys, to execute arbitrary commands on the host system by exploiting two Model Context Protocol (MCP) test endpoints. When combined with CVE-2026-48710, an authentication bypass in the Starlette web framework, attackers can achieve unauthenticated remote code execution, granting them full control over the server. This chain of vulnerabilities exposes sensitive API keys and secrets stored by the proxy, potentially compromising connected AI systems and enabling lateral movement within enterprise networks. The active exploitation of these vulnerabilities underscores the increasing targeting of AI gateway infrastructures by threat actors. Organizations relying on LiteLLM are urged to upgrade to version 1.83.7 or later, which addresses these issues by implementing stricter authorization controls and updating dependencies. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, emphasizing the urgency for immediate remediation to prevent potential breaches and data exfiltration.
3 months ago
Kill Chain
Palo Alto Networks PAN-OS GlobalProtect VPN Authentication Bypass Vulnerability (CVE-2026-0257)
In May 2026, Palo Alto Networks disclosed CVE-2026-0257, a high-severity authentication bypass vulnerability in the GlobalProtect portal and gateway components of PAN-OS software. This flaw allows unauthenticated remote attackers to forge valid session cookies, enabling unauthorized VPN connections into corporate networks. Active exploitation of this vulnerability was observed starting May 17, 2026, with attackers attempting to access GlobalProtect portals. While no post-access behavior or lateral movement has been identified, the potential for unauthorized access to sensitive internal resources poses a significant risk. The inclusion of CVE-2026-0257 in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog underscores the urgency for organizations to address this issue. The active exploitation highlights a broader trend of attackers targeting VPN infrastructures to gain unauthorized access, emphasizing the need for robust authentication mechanisms and timely patch management to mitigate such threats.
3 months ago
Kill Chain
Sniper Dz Scams Exploit Fake Facebook Offers to Target MENA Users
In June 2026, cybersecurity researchers uncovered a series of fraudulent activities targeting users in the Middle East and North Africa (MENA) region. Cybercriminals employed fake Facebook accounts impersonating politicians, public figures, and trusted organizations to promote deceptive offers such as free mobile internet packages and financial compensations. Victims who clicked on these offers were redirected through a series of intermediary websites leading to phishing pages and monetization schemes, including browser notification abuse and premium SMS subscriptions. This incident highlights the evolving tactics of cybercriminals who exploit social engineering and trusted platforms to deceive users. The use of legitimate services like link-aggregation platforms and browser notifications underscores the need for heightened vigilance and advanced security measures to protect against such sophisticated scams.
3 months ago
Kill Chain
Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-11645
In June 2026, Google addressed a high-severity zero-day vulnerability, CVE-2026-11645, in its Chrome browser. This flaw, an out-of-bounds read and write issue in the V8 JavaScript engine, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to mitigate the risk. Users were urged to update to version 149.0.7827.103 to secure their systems. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/?utm_source=openai)) This incident underscores the persistent targeting of widely used software by threat actors and highlights the critical importance of timely software updates. The exploitation of such vulnerabilities can lead to significant data breaches and system compromises, emphasizing the need for robust cybersecurity practices.
3 months ago
Kill Chain
Microsoft 365 Copilot 'SearchLeak' Vulnerability Exposes Sensitive Data
In June 2026, Varonis Threat Labs identified a critical vulnerability in Microsoft 365 Copilot, termed 'SearchLeak'. This flaw allowed attackers to craft a single-click link that, when accessed by a user, could exfiltrate sensitive data such as emails, calendar details, and indexed files without any further interaction. The attack exploited a combination of AI prompt injection and web vulnerabilities, enabling unauthorized access to a user's Microsoft Graph data. Microsoft assigned CVE-2026-42824 to this issue and has since mitigated the flaw on its backend, with no known exploitation in the wild. This incident underscores the evolving nature of cyber threats targeting AI-integrated platforms. As organizations increasingly adopt AI-driven tools, it is imperative to implement robust security measures to prevent similar vulnerabilities. Continuous monitoring and prompt patching are essential to safeguard sensitive information against emerging attack vectors.
3 months ago
Kill Chain
Evil MSI Background: Unveiling the 2026 Phishing Campaign
In June 2026, a sophisticated phishing campaign emerged, leveraging WeTransfer links to distribute malicious JavaScript files. These scripts, upon execution, utilized obfuscation techniques to decode and run PowerShell commands, which subsequently downloaded additional payloads, including a .NET DLL designed to manipulate Windows Task Scheduler. This method facilitated the execution of further malicious activities, potentially leading to persistent system compromise. The campaign notably exploited legitimate cloud services like Cloudflare Workers and R2 storage to host and distribute its malicious components, thereby enhancing its stealth and effectiveness. This incident underscores a growing trend where threat actors increasingly abuse trusted cloud platforms to host and disseminate malware, complicating detection and mitigation efforts. The use of obfuscated scripts and legitimate services highlights the evolving sophistication of phishing attacks, emphasizing the need for enhanced vigilance and advanced security measures to detect and prevent such threats.
3 months ago
Kill Chain
FBI Dismantles AI-Powered Phishing Operation 'Outsider Enterprise'
In June 2026, the FBI, in collaboration with Google and Black Lotus Labs, dismantled 'Outsider Enterprise,' a Chinese phishing-as-a-service operation active since at least 2023. This cybercrime network utilized AI to distribute phishing kits, creating over 9,000 fake websites and more than a million fraudulent URLs. These sites impersonated trusted brands, leading to the theft of approximately 3.8 million credit card records and causing an estimated $1.9 billion in losses. The takedown, part of Operation Riptide, involved seizing multiple servers, a Shopify storefront, and around $100,000 USDT from Outsider's payment wallets. Thousands of phishing domains now redirect to an FBI splash page. This incident underscores the escalating use of AI in cybercrime, enabling large-scale, sophisticated phishing campaigns. The success of Operation Riptide highlights the importance of coordinated efforts between law enforcement and private sector entities in combating such threats.
3 months ago
Kill Chain
Operation Highland: Unveiling a Decade of Stealthy Cyber-Espionage
In 2026, cybersecurity researchers uncovered 'Operation Highland,' a decade-long cyber-espionage campaign by the Chinese state-sponsored group Velvet Ant. Beginning in 2016, the attackers initially compromised internet-facing servers, deploying modified GS-Netcat reverse shells for encrypted remote access. They then installed custom SOCKS5 proxies to tunnel traffic, enabling access to isolated networks. By backdooring Linux Pluggable Authentication Modules (PAM) and OpenSSH components, Velvet Ant harvested credentials and maintained persistent access, effectively embedding themselves within the authentication process. This allowed them to monitor administrative activities and exfiltrate sensitive data undetected for ten years. The discovery of this prolonged intrusion underscores the evolving sophistication of state-sponsored cyber threats. It highlights the critical need for organizations to implement robust monitoring of authentication systems, conduct regular integrity checks of security components, and adopt a zero-trust security model to mitigate the risk of such stealthy and persistent attacks.
3 months ago
Kill Chain
ShinyHunters' Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
Between May 27 and June 9, 2026, the cyber extortion group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, specifically targeting the Environment Management Hub (EMHub). This critical flaw allowed unauthenticated remote code execution, leading to the compromise of over 100 organizations, predominantly in the higher education sector. The attackers exfiltrated sensitive data from approximately 300 PeopleSoft instances, including personal and financial information of students and staff. Oracle released a security advisory and patch on June 10, 2026, urging immediate action to mitigate the risk. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/shinyhunters-oracle-zero-day-higher-ed?utm_source=openai)) This incident underscores the increasing targeting of educational institutions by cybercriminals exploiting unpatched vulnerabilities in widely used enterprise software. The rapid exploitation of zero-day vulnerabilities highlights the necessity for organizations to implement proactive vulnerability management and incident response strategies to protect sensitive data and maintain operational integrity.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports