Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 133 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1585–1596 / 4893 reports
Cybersecurity Professional Sentenced for Aiding Ransomware Attacks
Computer/Network Security4 months ago

Cybersecurity Professional Sentenced for Aiding Ransomware Attacks

In July 2026, Angelo Martino, a 41-year-old former ransomware negotiator from Florida, was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group. Between April and November 2023, Martino exploited his position by leaking confidential information from five U.S. companies he was hired to protect, including cyber insurance limits and internal negotiation strategies. This betrayal enabled BlackCat to extort over $75 million from victims, including a nonprofit ($26.8M) and a financial firm ($25.6M). Additionally, Martino directly assisted in deploying ransomware attacks, demanding over $16 million and personally laundering $1.2 million in Bitcoin. Authorities seized more than $10 million in assets from him, including cryptocurrency, vehicles, and property. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/florida-man-pleads-guilty-after-leaking-victims-insurance-details-to-blackcat-hackers?utm_source=openai)) This case underscores the critical importance of trust and integrity within the cybersecurity industry. The exploitation of insider knowledge for malicious purposes highlights the need for stringent vetting processes and continuous monitoring of individuals in sensitive roles. Organizations must remain vigilant against both external threats and potential internal vulnerabilities to safeguard their operations and data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
O-UNC-066 Exploits Microsoft Entra Passkey Enrollment in Vishing Scheme
Financial Services4 months ago

O-UNC-066 Exploits Microsoft Entra Passkey Enrollment in Vishing Scheme

In April 2026, a threat actor identified as O-UNC-066 initiated a sophisticated vishing campaign targeting Microsoft 365 users across multiple sectors, including food and beverage, technology, healthcare, automotive, construction, and aviation. The attackers impersonated internal security personnel, contacting employees via phone and instructing them to enroll a new Microsoft Entra passkey for enhanced security. Victims were directed to phishing websites that closely mimicked Microsoft's legitimate passkey enrollment process. Unbeknownst to the users, this process allowed the attackers to register their own passkeys, thereby gaining unauthorized access to the victims' Microsoft 365 accounts. Subsequent to gaining access, the attackers engaged in data exfiltration activities, targeting sensitive information stored in SharePoint and OneDrive. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/?utm_source=openai)) This incident underscores a concerning trend in cyber threats, where attackers exploit legitimate security features to deceive users. The abuse of Microsoft's passkey enrollment process highlights the need for organizations to implement robust user education programs and to remain vigilant against evolving social engineering tactics. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Unveiling MODBEACON: Silver Fox's Latest Encrypted C2 RAT
Financial Services4 months ago

Unveiling MODBEACON: Silver Fox's Latest Encrypted C2 RAT

In July 2026, the China-linked cybercrime group known as Silver Fox was identified as the operator behind a new Rust-based remote access trojan (RAT) named MODBEACON. This sophisticated malware utilizes gRPC streaming to establish encrypted command-and-control (C2) communications, effectively evading traditional network detection mechanisms. MODBEACON is distributed through counterfeit software installers, leveraging search engine optimization (SEO) poisoning techniques to lure victims into downloading the malicious payload. Once installed, the RAT enables attackers to execute commands remotely, exfiltrate sensitive data, and maintain persistent access to compromised systems. The emergence of MODBEACON underscores a growing trend among threat actors to adopt advanced encryption methods and unconventional communication protocols to obfuscate their activities. This development highlights the necessity for organizations to enhance their detection capabilities, focusing on behavioral analysis and anomaly detection to identify and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
Internet4 months ago

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

In July 2026, a critical vulnerability named XRING was disclosed in XQUIC, Alibaba's QUIC and HTTP/3 library. This flaw allows remote clients to crash HTTP/3 servers by sending approximately 260 bytes of standard QPACK traffic, without requiring authentication or malformed packets. The issue stems from improper handling of the dynamic table resizing in QPACK, leading to memory corruption and server crashes. All versions up to v1.9.4 are affected, and as of July 10, no patch has been released. This incident underscores the importance of rigorous input validation and memory management in protocol implementations. The lack of a current patch necessitates immediate mitigation measures, such as disabling QPACK's dynamic table or HTTP/3 support, to prevent potential denial-of-service attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unpatchable Vulnerability in Tangem Wallets Exposed by Laser Attack
Financial Services4 months ago

Unpatchable Vulnerability in Tangem Wallets Exposed by Laser Attack

In July 2026, Ledger's Donjon security team disclosed a vulnerability in Tangem crypto wallet cards, revealing that a precisely timed laser pulse aimed at the card's secure element chip can reset the card's password without the original password or backup card. This allows an attacker to gain control over the wallet and transfer funds. The attack requires physical possession of the card, specialized equipment estimated at $250,000, and leaves visible damage, making it impractical for widespread exploitation. However, due to Tangem's design, which lacks firmware update capabilities, this vulnerability cannot be patched, leaving all existing cards susceptible. This incident underscores the challenges in securing hardware wallets against sophisticated physical attacks and highlights the importance of considering firmware update mechanisms in device design. While the attack's complexity limits its immediate threat, it raises concerns about the long-term security of devices that cannot receive updates to address discovered vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security
Computer Software/Engineering4 months ago

OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security

In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, a popular open-source AI assistant. These flaws, including CVE-2026-25253, CVE-2026-24763, and CVE-2026-25157, allowed attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data. Exploitation of these vulnerabilities led to unauthorized access to over 28,000 systems worldwide, with attackers gaining full control over affected hosts. The widespread deployment of OpenClaw in enterprise environments amplified the impact, exposing numerous organizations to significant security risks. The rapid adoption of AI agents like OpenClaw underscores the urgent need for robust security measures in AI deployments. This incident highlights the importance of comprehensive vulnerability assessments, timely patch management, and stringent access controls to mitigate the risks associated with integrating AI assistants into critical systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing Campaign Evades AI Detection with HTML Comment Padding
Financial Services4 months ago

Phishing Campaign Evades AI Detection with HTML Comment Padding

In July 2026, a sophisticated phishing campaign was identified, utilizing oversized HTML attachments filled with extensive comment padding to evade AI-based email security filters. The phishing emails masqueraded as Microsoft Teams notifications, featuring attachments named to resemble legitimate documents. These attachments, significantly larger than typical phishing payloads, contained minimal functional content surrounded by large blocks of HTML comments, effectively diluting the malicious code and bypassing detection mechanisms. This technique underscores the evolving tactics of cybercriminals in circumventing advanced security measures. The incident highlights a growing trend where attackers exploit AI and machine learning systems' limitations by manipulating content to evade detection. As AI becomes more integral to cybersecurity defenses, adversaries are developing methods to exploit its weaknesses, necessitating continuous adaptation and enhancement of security protocols to address these sophisticated evasion techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DigitalMint Negotiator's Betrayal: A Wake-Up Call for Cybersecurity
Financial Services4 months ago

DigitalMint Negotiator's Betrayal: A Wake-Up Call for Cybersecurity

In 2023, Angelo Martino, a ransomware negotiator at DigitalMint, exploited his position by sharing confidential client information with the BlackCat/ALPHV ransomware group. This betrayal enabled the attackers to extort a total of $75.3 million from five U.S. companies. Martino's actions included disclosing victims' negotiation strategies and insurance details, thereby maximizing ransom demands. In July 2026, he was sentenced to 70 months in prison for his role in these conspiracies. This case underscores the critical importance of trust and integrity within cybersecurity roles. The incident highlights the potential risks posed by insider threats and the necessity for organizations to implement stringent oversight and monitoring mechanisms to safeguard sensitive information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
INTERPOL's Operation First Light 2026: A Major Blow to Global Fraud Networks
Financial Services4 months ago

INTERPOL's Operation First Light 2026: A Major Blow to Global Fraud Networks

Between January 15 and April 30, 2026, INTERPOL coordinated 'Operation First Light 2026,' a global initiative targeting social engineering fraud and money laundering across 97 countries. The operation resulted in the arrest of 5,811 suspects, the seizure of $293 million in illicit assets, and the identification of over 142,000 victims. Authorities also blocked 31,014 bank accounts and analyzed 152,808 cases, highlighting the extensive reach of these fraudulent activities. This operation underscores the escalating threat of transnational social engineering scams, which have become increasingly sophisticated and widespread. The significant number of victims and the substantial financial impact emphasize the urgent need for enhanced international cooperation and proactive measures to combat such fraud.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Forg365: AI-Driven Phishing Platform Targets Microsoft 365 Accounts
Financial Services4 months ago

Forg365: AI-Driven Phishing Platform Targets Microsoft 365 Accounts

In July 2026, a new phishing-as-a-service (PhaaS) platform named Forg365 emerged, targeting Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code phishing techniques with AI-assisted lure generation. The platform offers a browser extension that maintains access to compromised accounts without re-authentication. Researchers at ZeroBEC identified features in Forg365 similar to those in other PhaaS platforms like Kali365 and Sneaky2FA, indicating a sophisticated operation capable of blending malicious activities into regular email traffic. The integration of AI in Forg365's dashboard allows attackers to craft and refine phishing emails efficiently, reducing the cost and complexity of developing custom phishing content. This advancement underscores the evolving threat landscape, where AI is increasingly leveraged to enhance the effectiveness and accessibility of cyberattacks, posing significant challenges to traditional security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Helix Vishing Group Exploits SharePoint in Data Theft Attacks
Financial Services4 months ago

Helix Vishing Group Exploits SharePoint in Data Theft Attacks

In July 2026, a new data-extortion group named Helix emerged, employing sophisticated identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to infiltrate SharePoint environments. The attackers initiated contact by impersonating managers over the phone, convincing employees to provide device codes, thereby gaining unauthorized access to their accounts. Once inside, Helix operators registered new MFA applications to maintain persistence, systematically enumerated SharePoint content, and exfiltrated sensitive files. The stolen data was then used to extort victim organizations by threatening public disclosure or selling it to other cybercriminals. This incident underscores a significant shift towards identity-based attacks targeting cloud services, highlighting the vulnerabilities in current authentication processes. The Helix group's methods bear similarities to previous tactics employed by groups like ShinyHunters and BlackFile, indicating a possible evolution or rebranding of these threat actors. Organizations must reassess and strengthen their security protocols, particularly around identity verification and access controls, to mitigate the risks posed by such sophisticated social engineering attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Injective SDK npm Supply-Chain Attack Exposes Cryptocurrency Wallets
Computer Software/Engineering4 months ago

Injective SDK npm Supply-Chain Attack Exposes Cryptocurrency Wallets

In July 2026, attackers compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious version (1.20.21) of the @injectivelabs/sdk-ts package on npm. This package, widely used for developing applications on the Injective blockchain, was altered to steal cryptocurrency wallet private keys and mnemonic seed phrases. The breach was detected promptly, and a clean version (1.20.23) was released. However, the malicious package was downloaded 310 times before deprecation, potentially compromising numerous developer systems. This incident underscores the escalating threat of supply-chain attacks targeting open-source ecosystems, particularly within the cryptocurrency sector. The rapid detection and response highlight the importance of vigilant monitoring and swift action in mitigating such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports