Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 120 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1429–1440 / 4893 reports
Critical SharePoint RCE Flaw Exploited to Steal Machine Keys
Information Technology/IT3 months ago

Critical SharePoint RCE Flaw Exploited to Steal Machine Keys

In July 2026, a critical vulnerability identified as CVE-2026-50522 was discovered in Microsoft SharePoint Server versions 2016, 2019, and Subscription Edition. This deserialization flaw allows unauthenticated remote attackers to execute arbitrary code over the network. Exploitation of this vulnerability enables attackers to steal machine keys, facilitating the creation of valid authentication tokens to impersonate users and access SharePoint resources with elevated privileges. Microsoft addressed this issue in their July security updates, but active exploitation was observed shortly after a proof-of-concept exploit became publicly available. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-50522?utm_source=openai)) The rapid exploitation of CVE-2026-50522 underscores the critical need for organizations to promptly apply security patches and monitor for unauthorized access. The ability of attackers to maintain persistent access by stealing machine keys highlights the importance of comprehensive security measures beyond patching, including credential rotation and continuous monitoring. ([thehackernews.com](https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Authorities Dismantle Kratos Phishing Platform and Arrest Developer
Financial Services3 months ago

Authorities Dismantle Kratos Phishing Platform and Arrest Developer

In July 2026, German and U.S. authorities dismantled the Kratos phishing-as-a-service (PhaaS) platform, arresting its developer in Indonesia. Kratos enabled cybercriminals to create fake Microsoft authentication pages, facilitating the theft of email addresses and passwords. Over 1,800 clients used Kratos to conduct approximately 15,000 phishing campaigns monthly, affecting victims in over 35 countries, primarily in Europe and the United States. The platform's operator reportedly earned at least €300,000 since 2024. The takedown involved seizing more than 200 servers, effectively rendering the service inoperable. This incident underscores the persistent threat posed by sophisticated phishing services that lower the barrier to entry for cybercriminals. The successful operation highlights the importance of international collaboration in combating cybercrime and the need for organizations to remain vigilant against evolving phishing tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Emerging Ransomware Tactics: BitLocker and Office Printers in 2026
Financial Services3 months ago

Emerging Ransomware Tactics: BitLocker and Office Printers in 2026

In mid-2026, two Latin American organizations experienced ransomware attacks where adversaries exploited misconfigured Remote Desktop Protocol (RDP) and Microsoft SQL Server (MSSQL) services to gain unauthorized access. The attackers utilized Microsoft's BitLocker to encrypt critical data and disseminated ransom notes via compromised office printers. The ransom demands were notably low, around $3,000, indicating a shift towards targeting smaller organizations with modest financial extortion. These incidents underscore the critical need for stringent security configurations and proactive monitoring to prevent such breaches. The use of built-in tools like BitLocker for malicious purposes highlights a growing trend where attackers leverage legitimate software to evade detection. Additionally, the exploitation of office printers as a communication channel for ransom demands reveals an innovative tactic in ransomware operations, emphasizing the importance of securing all network-connected devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical AWS Kiro Vulnerability Allows Remote Code Execution via Hidden Web Content
Computer Software/Engineering3 months ago

Critical AWS Kiro Vulnerability Allows Remote Code Execution via Hidden Web Content

In July 2026, a critical vulnerability was discovered in AWS's agentic coding IDE, Kiro. The flaw allowed hidden text on a web page to manipulate Kiro into rewriting its configuration file, leading to remote code execution on developers' machines without their approval. This security lapse was identified by Intezer in collaboration with Kodem Security. AWS has since patched the issue, though no CVE has been assigned. The vulnerability exploited Kiro's ability to autonomously modify its settings, bypassing the intended human approval process. By embedding malicious instructions in concealed text within web pages, attackers could deceive Kiro into executing arbitrary code, posing significant risks to developers and their environments. This incident underscores the growing challenges in securing AI-driven development tools. As these tools become more integrated into software development workflows, ensuring robust security measures and maintaining human oversight are paramount to prevent similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple's Hide My Email Vulnerability: A Year-Long Privacy Breach
Computer Software/Engineering3 months ago

Apple's Hide My Email Vulnerability: A Year-Long Privacy Breach

In July 2026, a significant vulnerability was discovered in Apple's 'Hide My Email' feature, which is designed to protect users' real email addresses by generating random aliases. Security researcher Tyler Murphy identified that this flaw allowed attackers to unmask users' actual email addresses, thereby compromising their privacy. Despite being reported to Apple in June 2025, the issue remained unresolved for over a year, with Apple deploying a fix only on July 3, 2026. This delay has raised concerns about the effectiveness of Apple's privacy safeguards and its responsiveness to security vulnerabilities. The incident underscores the critical importance of timely vulnerability management and transparent communication in maintaining user trust. It also highlights the need for organizations to regularly audit and test their privacy features to ensure they function as intended, especially when user data protection is a key selling point.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Hacker 'Trim' Transforms AI Jailbreaks into Offensive Cyber Tool
Computer Software/Engineering3 months ago

Hacker 'Trim' Transforms AI Jailbreaks into Offensive Cyber Tool

In March 2026, a Russian-speaking hacker known as "Trim" began publishing detailed guides on jailbreaking publicly available large language models (LLMs) to bypass their safety filters. By July 2026, Trim had developed and commercially launched "AI Pentest Checker," an AI-powered penetration-testing platform that integrates these jailbroken models with offensive security tools. This platform automates reconnaissance, vulnerability validation, exploitation reporting, and generates comprehensive reports, effectively weaponizing AI models for cybercriminal activities. This incident underscores the evolving threat landscape where cybercriminals are increasingly leveraging AI technologies to enhance their attack capabilities. The rapid development and commercialization of such tools highlight the urgent need for organizations to reassess their security postures and implement robust defenses against AI-driven threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ivanti's AI-Driven Discovery of CVE-2026-10520
Computer Software/Engineering3 months ago

Ivanti's AI-Driven Discovery of CVE-2026-10520

In June 2026, Ivanti disclosed CVE-2026-10520, a critical OS command injection vulnerability in its Sentry mobile gateway product, allowing remote unauthenticated attackers to execute code with root privileges. Notably, this flaw was identified by Ivanti's deployment of large language models (LLMs) within their engineering and security teams, marking a significant advancement in automated vulnerability detection. This incident underscores the growing role of AI in cybersecurity, highlighting both the potential and challenges of integrating LLMs into security operations. As threat actors increasingly leverage AI for attacks, organizations must adapt by incorporating advanced technologies to enhance their defensive capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild
Information Technology/IT3 months ago

Critical ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild

In July 2026, a critical vulnerability (CVE-2026-6875) was identified in the ServiceNow AI Platform, allowing unauthenticated attackers to execute arbitrary code by escaping the platform's script sandbox. ServiceNow promptly released patches throughout June 2026 to address this flaw. However, by mid-July, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild, posing significant risks to organizations utilizing the platform. ([thehackernews.com](https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html?utm_source=openai)) The exploitation of CVE-2026-6875 underscores the increasing targeting of AI platforms by cyber adversaries. This incident highlights the urgency for organizations to apply security patches promptly and to enhance monitoring of AI-driven systems to mitigate emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ENCFORGE Ransomware Targets AI Model Files via Langflow Exploit
Computer Software/Engineering3 months ago

ENCFORGE Ransomware Targets AI Model Files via Langflow Exploit

In July 2026, researchers identified a sophisticated ransomware attack targeting AI infrastructure. The threat actor, known as JADEPUFFER, exploited a critical vulnerability (CVE-2025-3248) in Langflow versions prior to 1.3.0, allowing unauthenticated remote code execution. This breach led to the deployment of ENCFORGE, a Go-based ransomware designed to encrypt AI model files, including model weights, vector indexes, and training datasets. The attack compromised the host filesystem, rendering essential AI resources inaccessible and disrupting operations. This incident underscores a concerning trend: cybercriminals are increasingly focusing on AI and machine learning assets. The targeted nature of ENCFORGE highlights the need for organizations to prioritize the security of their AI infrastructure, especially as such attacks can severely impact business continuity and data integrity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
AI's Role in Accelerating Exploit Development: A Call for Immediate Action
Financial Services3 months ago

AI's Role in Accelerating Exploit Development: A Call for Immediate Action

In July 2026, cybersecurity experts highlighted a critical shift in vulnerability exploitation dynamics. Traditionally, organizations had weeks to patch known vulnerabilities before attackers could develop exploits. However, advancements in AI have drastically reduced this window. For instance, AI systems like Claude Mythos Preview have demonstrated the capability to reverse-engineer patches into working exploits within an hour of a patch's release. This rapid turnaround means that unpatched systems are at immediate risk, as attackers can weaponize vulnerabilities almost as soon as they are disclosed. This development underscores the urgent need for organizations to rethink their vulnerability management strategies. The traditional approach of patching within weeks is no longer sufficient. Organizations must adopt proactive measures, such as continuous monitoring, real-time threat intelligence, and automated patch management, to stay ahead of rapidly evolving threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Unveiling Critical Security Flaws in Open-Source Android AI Agents
Financial Services3 months ago

Unveiling Critical Security Flaws in Open-Source Android AI Agents

In July 2026, researchers identified critical vulnerabilities in five open-source Android AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. Malicious Android applications with overlay and shared storage permissions can inject invisible text into the device's screen, which these AI agents process, leading to unauthorized command execution on connected host PCs. The attack exploits the agents' reliance on visual inputs and inadequate input sanitization, allowing attackers to execute arbitrary commands remotely. This incident underscores the emerging security challenges posed by AI-driven automation tools, particularly in mobile environments. As AI agents become more integrated into daily operations, their potential as attack vectors increases, necessitating robust security measures and vigilant oversight to prevent exploitation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zimbra's Critical Security Update: Addressing SNMP Command Injection and XSS Vulnerabilities
Financial Services3 months ago

Zimbra's Critical Security Update: Addressing SNMP Command Injection and XSS Vulnerabilities

In July 2026, Zimbra released version 10.1.20 to address multiple critical security vulnerabilities, including a command injection flaw in the SNMP monitoring component and four cross-site scripting (XSS) vulnerabilities in the Classic Web Client. These flaws could allow unauthenticated attackers to execute arbitrary OS commands and malicious scripts, potentially compromising email servers and user sessions. Additionally, a mail forwarding restriction bypass (CVE-2026-50055) was patched, which could have allowed authenticated users to exfiltrate emails despite restrictions being enabled. The prompt release of these patches underscores the importance of timely software updates to mitigate potential security risks. Organizations using Zimbra are advised to upgrade to version 10.1.20 immediately to protect against these vulnerabilities and maintain the integrity of their email systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports