Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 137 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1633–1644 / 4893 reports
GitLost: Unveiling the AI Vulnerability in GitHub's Agentic Workflows
Computer Software/Engineering4 months ago

GitLost: Unveiling the AI Vulnerability in GitHub's Agentic Workflows

In July 2026, a critical vulnerability named 'GitLost' was discovered in GitHub's Agentic Workflows, allowing unauthenticated attackers to exploit AI-powered automation and access private repositories. By crafting a malicious issue in a public repository, attackers could manipulate the AI agent to extract and expose sensitive data from private repositories without needing credentials or exploiting traditional software vulnerabilities. This incident underscores the emerging risks associated with integrating AI agents into development workflows, particularly the susceptibility to prompt injection attacks. Organizations must reassess their security protocols to mitigate such vulnerabilities and protect sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support and PRA
Information Technology/IT4 months ago

Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support and PRA

In July 2026, BeyondTrust disclosed two critical pre-authentication vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in their Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws stemmed from improper validation and processing of authentication data, potentially allowing unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation required specific authentication configurations to be enabled. BeyondTrust promptly released patches to address these issues. The disclosure underscores the persistent risk of authentication bypass vulnerabilities in remote access solutions. Organizations are urged to review and update their security configurations regularly to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CERT/CC Uncovers Hidden Admin Backdoor in Tenda Router Firmware
Telecommunications4 months ago

CERT/CC Uncovers Hidden Admin Backdoor in Tenda Router Firmware

In July 2026, the CERT Coordination Center (CERT/CC) disclosed a critical vulnerability (CVE-2026-11405) in Tenda router firmware, revealing an undocumented backdoor that allows attackers to bypass authentication and gain full administrative access to the device's web management interface. This backdoor is present in multiple firmware versions, including US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD and US_AC6V2.0RTL_V15.03.06.51_multi_T, among others. Exploitation of this vulnerability could lead to unauthorized remote modifications, disabling of security features, or complete device takeover. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai)) The discovery underscores the persistent risks associated with undocumented backdoors in network devices, highlighting the need for rigorous security assessments and prompt firmware updates. Organizations are advised to disable remote management and change default LAN IP addresses to mitigate potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the 'WriteOut' Vulnerability in Writer AI Platform
Computer Software/Engineering4 months ago

Understanding the 'WriteOut' Vulnerability in Writer AI Platform

In July 2026, a critical session isolation vulnerability, dubbed 'WriteOut,' was discovered in Writer, an enterprise generative AI platform. This flaw allowed attackers to hijack user sessions across different organizations by exploiting the platform's live preview feature. By sharing a malicious preview link, attackers could gain unauthorized access to sensitive data, including private chats, documents, and large language model credentials, without requiring prior access to the victim's organization. ([thehackernews.com](https://thehackernews.com/2026/07/writer-ai-flaw-could-let-agent-previews.html?utm_source=openai)) The 'WriteOut' vulnerability underscores the growing security challenges in AI platforms, particularly concerning tenant isolation and session management. As AI adoption accelerates, ensuring robust security measures to prevent cross-tenant data breaches becomes imperative for organizations relying on such technologies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the 'GitLost' Vulnerability in GitHub's Agentic Workflows
Computer Software/Engineering4 months ago

Understanding the 'GitLost' Vulnerability in GitHub's Agentic Workflows

In July 2026, researchers at Noma Security identified a critical vulnerability, dubbed 'GitLost,' in GitHub's Agentic Workflows. This flaw allows unauthenticated attackers to craft issues in public repositories that, when processed by AI-powered automation, can access and leak data from an organization's private repositories. The attack exploits prompt injection techniques, manipulating the AI agent into executing unintended actions, thereby exposing sensitive information without requiring stolen credentials or direct access to the organization. This incident underscores the growing risks associated with integrating AI agents into development workflows. As organizations increasingly adopt AI-driven automation, the potential for such vulnerabilities rises, emphasizing the need for robust security measures and continuous monitoring to prevent unauthorized data access and leakage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Scattered Spider Hacker Traced via Windows Device ID
Luxury Goods/Jewelry4 months ago

Scattered Spider Hacker Traced via Windows Device ID

In May 2025, attackers infiltrated a luxury jewelry retailer by impersonating employees and convincing the IT help desk to reset passwords and multifactor authentication devices. They gained control over three accounts, including two IT administrators, installed tunneling tools, and exfiltrated at least 77 gigabytes of data. Although the attackers attempted to deploy ransomware, the retailer's security team thwarted the effort. The attackers demanded an $8 million ransom, which the company refused to pay, resulting in approximately $2 million in losses due to disruption and remediation efforts. The incident underscores the critical importance of robust identity verification processes for IT support functions. It also highlights the necessity of implementing phishing-resistant multifactor authentication methods and continuous monitoring to detect and prevent unauthorized access attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw
Computer/Network Security4 months ago

FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw

In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a 127-byte stack buffer overflow, leading to immediate kernel panics by overwriting stack canaries. The vulnerability arises from improper validation of the sockaddr length field, enabling attackers to craft malicious requests that exploit this weakness. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-3038/?utm_source=openai)) The discovery of CVE-2026-3038 underscores the persistent challenges in kernel security, particularly concerning input validation and memory management. This incident highlights the necessity for continuous vigilance and prompt patching to mitigate potential exploits that could lead to system crashes or privilege escalation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google's Legal Action Against AI-Driven Phishing: A Case Study
Telecommunications4 months ago

Google's Legal Action Against AI-Driven Phishing: A Case Study

In June 2026, Google filed a lawsuit against a China-based cybercrime network known as 'Outsider Enterprise.' This group utilized Google's Gemini AI to create and distribute phishing websites that impersonated entities like Google, YouTube, and government agencies such as New York's E-ZPass. Operating through Telegram, Outsider Enterprise offered phishing-as-a-service, providing nearly 300 scam templates to individuals lacking technical expertise. Over a two-week period, the group sent approximately 2.5 million fraudulent text messages to Android users, leading to significant financial losses among hundreds of thousands of victims. ([arstechnica.com](https://arstechnica.com/google/2026/06/google-sues-chinese-cybercrime-network-that-used-gemini-to-automate-scams/?utm_source=openai)) This incident underscores the escalating misuse of AI technologies in cybercrime, highlighting the urgent need for enhanced security measures and regulatory frameworks to combat AI-driven phishing schemes. The collaboration between Google, the FBI, and major U.S. carriers exemplifies a proactive approach to dismantling such operations and protecting consumers from sophisticated digital threats. ([techcrunch.com](https://techcrunch.com/2026/06/12/chinese-cybercrime-operation-that-used-ai-to-scam-hundreds-of-thousands-of-victims-sued-by-google/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Sysdig Unveils First AI-Driven Ransomware Attack by JadePuffer
Information Technology/IT4 months ago

Sysdig Unveils First AI-Driven Ransomware Attack by JadePuffer

In late June 2026, Sysdig researchers documented the first known case of agentic ransomware, where an AI agent autonomously executed a comprehensive extortion operation. The threat actor, identified as JadePuffer, exploited a vulnerability in Langflow (CVE-2025-3248) to gain initial access, then proceeded to conduct reconnaissance, credential theft, lateral movement, persistence, encryption, and delivery of a ransom note. The AI agent's ability to rapidly adapt and execute over 600 distinct payloads significantly reduced the complexity and increased the speed of the attack, demonstrating a new level of operational efficiency in cyberattacks. ([sysdig.com](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion?utm_source=openai)) This incident underscores the evolving landscape of cyber threats, highlighting the integration of artificial intelligence in malicious activities. The use of AI agents in cyberattacks lowers the barrier for executing sophisticated operations, posing a significant challenge for cybersecurity defenses. Organizations must adapt to these advancements by implementing robust security measures and staying vigilant against AI-driven threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Adobe ColdFusion Vulnerability CVE-2026-48282: Immediate Action Required
Computer Software/Engineering4 months ago

Critical Adobe ColdFusion Vulnerability CVE-2026-48282: Immediate Action Required

In July 2026, a critical vulnerability identified as CVE-2026-48282 was discovered in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. This path traversal flaw allows unauthenticated attackers to execute arbitrary code remotely without user interaction, posing a significant risk to affected systems. Adobe promptly released security updates to address this issue, urging administrators to apply patches immediately. The rapid exploitation of this vulnerability underscores the increasing speed at which threat actors are leveraging newly disclosed flaws. Organizations must prioritize timely patch management and maintain robust monitoring to mitigate such risks effectively.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cybercriminals Exploit Microsoft Teams to Deploy EtherRAT Malware
Financial Services4 months ago

Cybercriminals Exploit Microsoft Teams to Deploy EtherRAT Malware

In July 2026, threat actors initiated a sophisticated phishing campaign targeting corporate employees by impersonating IT support staff via Microsoft Teams voice calls. The attack began with phishing emails containing malicious PDF attachments labeled as 'Employee Survey.' Shortly after opening the document, victims received Teams calls from external accounts posing as system administrators. Exploiting Teams' screen-sharing feature, attackers convinced employees to install legitimate remote-access tools like HopToDesk and AnyDesk. Subsequently, they deployed a malicious MSI installer that downloaded and executed EtherRAT, a cross-platform remote access trojan written in Node.js, granting full control over compromised systems. EtherRAT enables attackers to execute commands, manipulate files, steal data, and maintain persistence, utilizing Ethereum smart contracts to retrieve its command-and-control server, complicating disruption efforts. This campaign underscores the evolving tactics of cybercriminals leveraging trusted communication platforms to infiltrate corporate networks. Organizations must enhance their security awareness training, implement robust authentication measures, and monitor for unusual activities within collaboration tools to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the 2026 Microsoft Device Code Phishing Attack
Financial Services4 months ago

Understanding the 2026 Microsoft Device Code Phishing Attack

In early 2026, a sophisticated phishing campaign exploited Microsoft's OAuth 2.0 Device Authorization Grant flow to compromise user accounts. Attackers initiated the device code authentication process and tricked victims into entering the provided code on Microsoft's legitimate login page, thereby granting unauthorized access without exposing credentials. This method allowed threat actors to bypass multi-factor authentication (MFA) and maintain persistent access to services like Outlook, OneDrive, and Teams by capturing access and refresh tokens. The campaign, active from April to mid-May 2026, targeted Microsoft 365 users through deceptive emails and malicious attachments, leading to significant data breaches and unauthorized account activities. The incident underscores a growing trend of attackers leveraging legitimate authentication mechanisms to bypass traditional security measures. The rise of device code phishing highlights the need for organizations to reassess their security protocols, especially concerning OAuth flows and MFA implementations. As phishing techniques become more sophisticated, continuous monitoring, user education, and the implementation of conditional access policies are crucial to mitigate such threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports