Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 146 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1741–1752 / 4893 reports
Persistent Cyber Scam Centers in Asia Despite Crackdowns
Financial Services4 months ago

Persistent Cyber Scam Centers in Asia Despite Crackdowns

In June 2026, reports from INTERPOL and Amnesty International highlighted the persistent and escalating issue of cyber scam centers across Asia, particularly in Cambodia, Myanmar, Laos, and the Philippines. Despite high-profile crackdowns and arrests, these operations continue to thrive, generating an estimated $40 billion annually through schemes like romance fraud and investment scams. The resilience of these criminal enterprises is largely attributed to local corruption and collusion with law enforcement, which undermine efforts to dismantle them. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific?utm_source=openai)) This situation underscores the urgent need for enhanced international cooperation and robust anti-corruption measures. The continued operation of these scam centers not only results in significant financial losses globally but also involves severe human rights abuses, including human trafficking and forced labor. Addressing this issue is critical to protecting vulnerable populations and maintaining global cybersecurity. ([amnesty.org](https://www.amnesty.org/en/latest/news/2026/06/cambodia-evidence-suggests-scamming-compounds-bypassed-despite-high-profile-crackdown/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026
Telecommunications4 months ago

Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026

In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai)) This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Alerts Hospitality Sector to Advanced Phishing Threat
Hospitality4 months ago

Microsoft Alerts Hospitality Sector to Advanced Phishing Threat

Since April 2026, a sophisticated phishing campaign has been targeting hotel and hospitality organizations across Europe and Asia. Attackers send emails impersonating 'Booking Manager (via Calendly)' with subjects referencing guest complaints or health inspections. These emails contain links leading to ZIP files named 'photo-<numbers>.zip,' which, when opened, execute a Node.js-based remote access trojan (RAT) called TonRAT. The malware establishes command-and-control channels through the TON blockchain API, complicating detection and mitigation efforts. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms like Calendly and Google’s URL redirect services to bypass traditional email security measures. The use of Node.js implants and blockchain-based command-and-control mechanisms highlights the need for organizations to enhance their cybersecurity defenses against increasingly sophisticated phishing campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Computer Software/Engineering4 months ago

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

In June 2026, a sophisticated supply chain attack known as 'Miasma' compromised 32 npm packages under Red Hat's @redhat-cloud-services namespace. The attackers gained access through a compromised Red Hat employee's GitHub account, allowing them to push malicious commits that bypassed standard peer reviews. These commits exploited GitHub Actions workflows to publish trojanized package versions to the public npm registry. Upon installation, these packages executed an obfuscated payload designed to steal credentials from various platforms, including GitHub, AWS, Azure, and Google Cloud Platform. The malware also attempted to propagate by compromising additional maintainer packages and, in some cases, could destroy the maintainer’s home directory. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The Miasma campaign highlights the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package repositories to prevent unauthorized access and mitigate the risk of widespread credential theft and system compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding the DirtyClone Linux Kernel Vulnerability (CVE-2026-43503)
Information Technology/IT4 months ago

Understanding the DirtyClone Linux Kernel Vulnerability (CVE-2026-43503)

In June 2026, a critical Linux kernel vulnerability known as 'DirtyClone' (CVE-2026-43503) was disclosed, allowing local users to escalate privileges to root by exploiting cloned network packets. This flaw, part of the DirtyFrag family, arises from the kernel's mishandling of shared memory flags during packet cloning, enabling unauthorized memory corruption. The vulnerability affects systems with unpatched kernels prior to May 21, 2026, particularly those with unprivileged user namespaces enabled, such as Debian, Ubuntu, and Fedora. The disclosure of DirtyClone underscores the persistent challenges in securing kernel-level code, especially concerning memory management and privilege escalation. This incident highlights the necessity for organizations to promptly apply security patches and reassess configurations that permit unprivileged user namespaces, to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Amazon Q Developer Vulnerability CVE-2026-12957: What You Need to Know
Computer Software/Engineering4 months ago

Amazon Q Developer Vulnerability CVE-2026-12957: What You Need to Know

In June 2026, a critical vulnerability (CVE-2026-12957) was identified in Amazon Q Developer's handling of Model Context Protocol (MCP) servers. This flaw allowed malicious repositories to execute arbitrary commands on a developer's machine upon opening and trusting a workspace, potentially leading to unauthorized access to cloud credentials. The issue was promptly addressed by Amazon with the release of Language Servers for AWS version 1.69.0, mitigating the risk of exploitation. This incident underscores the growing security challenges associated with AI-powered development tools. As these tools become more integrated into the software development lifecycle, ensuring robust security measures and prompt patching of vulnerabilities is imperative to protect sensitive data and maintain trust in development environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Linux Kernel Vulnerability 'pedit COW' (CVE-2026-46331) Allows Root Access
Information Technology/IT4 months ago

Critical Linux Kernel Vulnerability 'pedit COW' (CVE-2026-46331) Allows Root Access

In June 2026, a critical vulnerability identified as CVE-2026-46331, also known as 'pedit COW,' was discovered in the Linux kernel's traffic control subsystem. This flaw allows local unprivileged users to escalate their privileges to root by exploiting an out-of-bounds write in the packet-editing action (act_pedit), leading to corruption of shared page-cache memory. A public, working exploit was released shortly after the CVE assignment, raising significant security concerns across various Linux distributions. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-46331?utm_source=openai)) The rapid public disclosure and availability of exploit code for CVE-2026-46331 underscore the critical need for organizations to promptly apply security patches. This incident highlights the ongoing risks associated with kernel-level vulnerabilities and the importance of maintaining up-to-date systems to mitigate potential privilege escalation attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Massive 2026 Data Breach Exposes One Million Passport Records
Government Administration4 months ago

Massive 2026 Data Breach Exposes One Million Passport Records

In June 2026, a significant data breach exposed nearly one million passport records worldwide. The compromised data originated from an ID verification system used by cannabis dispensaries, where high-value credentials like passports were utilized for authentication. Attackers exploited vulnerabilities in this ancillary system, leading to the unauthorized disclosure of sensitive personal information. This incident underscores the critical need for robust security measures across all systems handling sensitive data, regardless of their primary function. It highlights the risks associated with using high-value credentials in less secure, ancillary systems and the potential for such breaches to have widespread implications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Bluekit's Evolution: Browser-in-the-Middle Phishing Attacks
Financial Services4 months ago

Bluekit's Evolution: Browser-in-the-Middle Phishing Attacks

In June 2026, the Bluekit phishing-as-a-service platform introduced browser-in-the-middle (BitM) capabilities, enhancing its ability to steal user credentials. This method involves the attacker controlling a browser session that loads legitimate login pages, intercepting user inputs and session tokens. By leveraging the open-source JavaScript library 'rrweb,' Bluekit streams the page's DOM over a WebSocket connection, allowing real-time interaction and data theft. This evolution signifies a shift towards more sophisticated phishing techniques that can bypass traditional security measures, including multi-factor authentication (MFA). Organizations must be aware of these advanced tactics to bolster their defenses against such threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Gaslight Malware: A New Challenge for AI-Based Security on macOS
Computer Software/Engineering4 months ago

Gaslight Malware: A New Challenge for AI-Based Security on macOS

In June 2026, cybersecurity researchers identified a new macOS malware named 'Gaslight,' attributed to a North Korean-linked threat actor. This Rust-based malware functions as a backdoor and information stealer, embedding 38 fabricated system messages within its binary. These messages, formatted to resemble legitimate developer logs and error reports, aim to mislead AI-assisted malware analysis tools by simulating analysis errors, potentially causing the tools to abort or misinterpret the malware's behavior. The emergence of 'Gaslight' underscores a growing trend where threat actors develop sophisticated techniques to evade detection by AI-driven security solutions. This incident highlights the need for continuous advancement in cybersecurity defenses to counteract evolving obfuscation methods employed by adversaries.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cybercriminals Exploit Shop App in Advanced Phishing Attack - June 2026
Retail Industry4 months ago

Cybercriminals Exploit Shop App in Advanced Phishing Attack - June 2026

In June 2026, threat actors exploited Shopify's order-tracking app, Shop, by inserting fraudulent purchase receipts into users' order histories. These fake receipts, impersonating brands like Norton and PayPal, included phone numbers leading to scammers posing as support agents. Victims were deceived into disclosing sensitive information or installing remote access software, facilitating unauthorized access to their devices. This method leverages the inherent trust users place in the Shop app, making the scam particularly effective. This incident underscores a significant evolution in phishing tactics, moving beyond traditional email-based schemes to infiltrate trusted applications directly. The rise of such sophisticated social engineering attacks highlights the urgent need for enhanced security measures and user vigilance within digital platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Poland's Crackdown on SIM-Swap Crypto Theft: A 2026 Case Study
Telecommunications4 months ago

Poland's Crackdown on SIM-Swap Crypto Theft: A 2026 Case Study

In June 2026, Polish authorities, with support from the FBI and Homeland Security Investigations, arrested four individuals involved in a sophisticated SIM-swapping scheme targeting cryptocurrency exchanges. The perpetrators breached IT systems of entities collaborating with telecom operators, using specialized software and social engineering to access employee email accounts. This enabled them to hijack victims' phone numbers, intercept SMS messages, and gain control over cryptocurrency exchange accounts, resulting in the theft and laundering of digital assets exceeding tens of millions of Polish zloty. ([thecoinomist.com](https://thecoinomist.com/news/poland-detains-four-sim-swap-crypto-heist-merry-linked/?utm_source=openai)) This incident underscores the escalating threat of SIM-swapping attacks in the cryptocurrency sector, highlighting the need for enhanced security measures beyond SMS-based two-factor authentication. The collaboration between Polish authorities and U.S. agencies reflects the global nature of cybercrime and the importance of international cooperation in combating such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports