The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Miasma Worm's 2026 Attack on Microsoft GitHub: A Wake-Up Call for Developers
In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm infiltrated 73 of its GitHub repositories, including those under Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously compromised contributor credentials to push malicious commits, introducing configuration files that executed credential-harvesting payloads upon opening in AI coding tools or IDEs. This breach led to the temporary disabling of the affected repositories, disrupting critical workflows and CI/CD pipelines. ([computing.co.uk](https://www.computing.co.uk/news/2026/security/microsoft-s-github-repositories-taken-offline-amid-miasma-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted development environments. The Miasma worm's ability to exploit AI coding tools highlights the need for enhanced security measures in software development processes to prevent similar breaches in the future.
3 months ago
Kill Chain
Critical Vulnerability in Ivanti Sentry: CVE-2026-10520
In June 2026, a critical OS command injection vulnerability, CVE-2026-10520, was identified in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. This flaw allows remote, unauthenticated attackers to execute arbitrary code with root privileges. Within 24 hours of disclosure, attackers exploited this vulnerability to backdoor exposed Ivanti Sentry appliances, compromising enterprise mobile gateways. ([techtimes.com](https://www.techtimes.com/articles/318221/20260611/ivanti-sentry-actively-exploited-cvss-100-flaw-backdoors-enterprise-mobile-gateways.htm?utm_source=openai)) The rapid exploitation underscores the urgency for organizations to promptly apply security patches. The availability of a public proof-of-concept exploit increases the risk of widespread attacks, emphasizing the need for immediate remediation. ([noise.getoto.net](https://noise.getoto.net/2026/06/10/cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry/?utm_source=openai))
3 months ago
Kill Chain
Anthropic's Claude Fable 5: Balancing Advanced AI Capabilities with Security
In June 2026, Anthropic released Claude Fable 5, a public version of its advanced AI model, Claude Mythos 5, which was previously restricted due to security concerns. Fable 5 is designed to perform complex tasks autonomously, including software development and research. To mitigate potential misuse in sensitive areas like cybersecurity and biology, Anthropic implemented safeguards that redirect high-risk queries to a less capable model, Claude Opus 4.8. This approach aims to balance the model's powerful capabilities with safety considerations. The release of Claude Fable 5 underscores the ongoing challenge of deploying advanced AI systems responsibly. As AI models become more capable, ensuring they are used ethically and securely remains a critical concern for developers and users alike.
3 months ago
Kill Chain
Phishing Attacks Decline 20% in 2026, But AI Enhances Threats
In 2026, phishing attack volumes decreased by 20% for the second consecutive year. However, the sophistication and effectiveness of these attacks have significantly increased, largely due to the integration of artificial intelligence (AI) by cybercriminals. AI tools enable attackers to craft highly convincing phishing lures and automate the creation of fraudulent websites, leading to more targeted and successful campaigns. ([zscaler.com](https://www.zscaler.com/blogs/security-research/one-click-compromise-threatlabz-2026-phishing-and-initial-access-report?utm_source=openai)) This trend underscores a shift in cybercriminal strategies from mass, indiscriminate attacks to focused, high-yield operations. Organizations must recognize that while the quantity of phishing attempts has declined, the quality and potential impact of these attacks have escalated, necessitating enhanced vigilance and advanced security measures.
3 months ago
Kill Chain
Europol Dismantles 'AudiA6' Crypto Laundering Service Used by Ransomware Gangs
In June 2026, an international law enforcement operation led by Europol dismantled 'AudiA6,' a cryptocurrency laundering service that processed over €336 million for ransomware gangs and cybercriminal networks between 2022 and 2025. The operation resulted in the arrest of two alleged administrators in Georgia, the seizure of more than 30 servers, 25 domains, over 80 vehicles, multiple properties, and the freezing of approximately €692,000 in cryptocurrency assets. 'AudiA6' was linked to over 15 international cybercrime investigations and was also associated with the dark web forum 'Dark2Web,' which facilitated illicit services and connections among cybercriminals. ([fdicoig.gov](https://www.fdicoig.gov/news/investigations-press-releases/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering?utm_source=openai)) This takedown underscores the growing industrialization of cryptocurrency laundering services that support the global cybercrime economy. The operation highlights the increasing reliance of ransomware groups on sophisticated laundering platforms to obscure illicit proceeds, emphasizing the need for enhanced international cooperation and advanced forensic capabilities to combat such threats. ([dig.watch](https://dig.watch/updates/europol-audia6-crypto-laundering-network?utm_source=openai))
3 months ago
Kill Chain
Critical RCE Vulnerability in LangGraph: Immediate Action Required
In February 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-27794, was discovered in LangGraph's caching layer. This flaw allowed attackers with write access to the cache backend to inject malicious serialized objects, leading to arbitrary code execution upon deserialization by the LangGraph process. The vulnerability affected versions of langgraph-checkpoint prior to 4.0.0 and was particularly concerning for applications utilizing cache backends inheriting from BaseCache with nodes opted into caching via CachePolicy. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27794/?utm_source=openai)) This incident underscores the persistent risks associated with deserialization of untrusted data, especially in AI frameworks. Organizations leveraging LangGraph for AI agent orchestration must ensure they have updated to version 4.0.0 or later to mitigate this vulnerability. The event highlights the critical need for secure coding practices and regular security assessments in AI development environments.
3 months ago
Kill Chain
CISA Adds CVE-2026-10520 to Known Exploited Vulnerabilities Catalog
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-10520 to its Known Exploited Vulnerabilities (KEV) Catalog. This critical OS Command Injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to execute code with root privileges. The flaw poses significant risks to federal enterprises and has been actively exploited in the wild. Organizations are urged to update to the patched versions immediately to mitigate potential threats. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-10520?utm_source=openai)) The inclusion of CVE-2026-10520 in the KEV Catalog underscores the ongoing threat posed by command injection vulnerabilities. This incident highlights the importance of timely patch management and proactive vulnerability assessments to prevent unauthorized access and potential data breaches.
3 months ago
Kill Chain
Critical Security Flaws Discovered in Brickcom Cameras
In June 2026, critical vulnerabilities were identified in Brickcom cameras, specifically models Cube, Dome, Bullet, and Box version 3.2.3.5.6. These flaws, cataloged as CVE-2026-50245 and CVE-2026-50005, allow unauthenticated remote attackers to access live video feeds and still images via the /ONVIF endpoint without requiring authentication. Additionally, the use of default credentials enables silent access to camera feeds, compromising sensitive visual information and potentially granting administrative control over the devices. The exploitation of these vulnerabilities poses significant risks to sectors such as Commercial Facilities, Critical Manufacturing, Financial Services, and Healthcare, where surveillance systems are integral to security operations. The absence of authentication mechanisms in these cameras underscores the critical need for robust access controls and regular security assessments to prevent unauthorized access and data breaches.
3 months ago
Kill Chain
Agentjacking: Exploiting AI Coding Agents via Sentry Vulnerability
In June 2026, Tenet Security identified a novel attack method termed 'Agentjacking,' which exploits AI coding agents by injecting malicious code through manipulated error reports in Sentry, an open-source error-tracking platform. Attackers can send crafted error events to Sentry using publicly accessible Data Source Names (DSNs), embedding commands that AI agents interpret and execute as legitimate diagnostic steps. This technique allows unauthorized code execution on developer machines, potentially exposing sensitive data such as environment variables, Git credentials, and private repository URLs. The Agentjacking attack underscores the growing security risks associated with integrating AI coding agents into development workflows. As these agents gain broader access to codebases and tools, they become attractive targets for exploitation. This incident highlights the urgent need for robust security measures and governance frameworks to manage the deployment and operation of AI agents, ensuring they do not inadvertently become vectors for cyberattacks.
3 months ago
Kill Chain
CompleteFTP 'Short-Sleeve' RSA and DSA Key Vulnerability Exposed
In June 2026, researchers identified a vulnerability in RSA and DSA key generation within the CompleteFTP software, leading to the creation of 'short-sleeve' keys with predictable zero-bit patterns. This flaw, stemming from a type mismatch in big-integer code, resulted in the generation of weak cryptographic keys that could be easily factored, compromising the security of encrypted communications. The issue affected CompleteFTP versions 10.0.0 through 23.0.4, spanning from December 2016 to December 2023. EnterpriseDT, the developers of CompleteFTP, promptly released version 26.1.0 on May 8, 2026, which includes a tool to detect and regenerate vulnerable keys. ([enterprisedt.jp](https://www.enterprisedt.jp/doc23/html/howtoserverkeys.html?utm_source=openai)) This incident underscores the critical importance of rigorous code review and adherence to cryptographic standards in software development. It also highlights the necessity for organizations to regularly audit their cryptographic implementations to identify and mitigate potential vulnerabilities that could be exploited by attackers.
3 months ago
Kill Chain
Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required
In June 2026, a critical OS command injection vulnerability (CVE-2026-10520) was discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on affected devices. Ivanti released patches on June 9, 2026, addressing the issue in versions R10.5.2, R10.6.2, and R10.7.1. However, within 24 hours, reports emerged of active exploitation, with attackers backdooring exposed Sentry gateways. The Shadowserver Foundation identified multiple compromised instances, indicating widespread exploitation. Organizations using Ivanti Sentry are urged to apply the patches immediately to mitigate the risk of unauthorized access and potential data breaches. This incident underscores the critical importance of timely patch management and proactive vulnerability assessments to safeguard enterprise networks against rapidly evolving threats.
3 months ago
Kill Chain
Coupang Data Breach 2025: A Wake-Up Call for E-Commerce Security
In June 2025, Coupang, South Korea's leading e-commerce platform, experienced a significant data breach that went undetected until November 2025. The breach compromised personal information of approximately 37.55 million customers, including names, email addresses, phone numbers, delivery addresses, and order histories. Investigations revealed that the breach resulted from inadequate security practices, such as poor authentication key management and insufficient access controls. This incident underscores the critical importance of robust cybersecurity measures in protecting sensitive customer data. The substantial fine imposed by South Korean authorities highlights the growing regulatory focus on data protection and the severe consequences of security lapses for organizations handling large volumes of personal information.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports