Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 155 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1849–1860 / 4893 reports
FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices
Government Administration4 months ago

FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices

In June 2026, a significant data breach known as 'FortiBleed' exposed VPN credentials for approximately 73,000 Fortinet devices worldwide. Security researcher Bob Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords. The leaked data encompassed entries from major organizations such as Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, and State Grid. The breach was attributed to a Russian-speaking threat group that conducted extensive credential harvesting campaigns against FortiGate SSL VPN devices, leading to unauthorized access and potential lateral movement within affected networks. This incident underscores the escalating threat posed by sophisticated cyber actors targeting critical infrastructure through credential harvesting and exploitation of VPN vulnerabilities. Organizations are urged to implement robust security measures, including regular credential rotation, enforcement of multi-factor authentication, and continuous monitoring for unauthorized access attempts, to mitigate the risk of similar breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Meta's Instagram Account Takeover Incident: Lessons in AI Security
Financial Services4 months ago

Meta's Instagram Account Takeover Incident: Lessons in AI Security

In April 2026, Meta disclosed a significant security incident affecting over 20,000 Instagram accounts. Attackers exploited a vulnerability in Instagram's AI-assisted account recovery tool, High Touch Support, to generate unauthorized password reset links. This flaw allowed them to bypass standard authentication measures, leading to unauthorized access to user accounts. The breach potentially exposed sensitive user data, including contact details, private messages, and linked services. Meta identified the issue on May 31, 2026, and took immediate steps to mitigate the vulnerability and notify affected users. This incident underscores the evolving tactics of cyber attackers who are increasingly targeting automated support systems to facilitate account takeovers. Organizations must enhance the security of their AI-driven tools and implement robust monitoring to detect and prevent such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Defender 'RoguePlanet' Zero-Day Vulnerability (CVE-2026-50656)
Computer/Network Security4 months ago

Microsoft Defender 'RoguePlanet' Zero-Day Vulnerability (CVE-2026-50656)

In June 2026, a security researcher known as Nightmare-Eclipse publicly disclosed a zero-day vulnerability in Microsoft Defender, dubbed 'RoguePlanet'. This flaw, identified as CVE-2026-50656 with a CVSS score of 7.8, exploits a race condition within the Microsoft Malware Protection Engine, allowing attackers to escalate privileges to SYSTEM level on fully patched Windows 10 and 11 systems. The exploit's success rate varies across different machines, but when successful, it grants attackers full control over the affected system. Microsoft has acknowledged the vulnerability and is actively developing a security update to address the issue. ([securityweek.com](https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/?utm_source=openai)) The disclosure of 'RoguePlanet' underscores the ongoing challenges in securing endpoint protection tools, which are often targeted by attackers due to their deep integration with system processes. This incident highlights the critical need for organizations to implement robust security measures, including application allowlisting and continuous monitoring, to mitigate the risks associated with privilege escalation vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cybercriminals Exploit Remote Access Tools in 2026 Attacks
Information Technology/IT4 months ago

Cybercriminals Exploit Remote Access Tools in 2026 Attacks

Between January and March 2026, cybercriminals exploited legitimate remote access tools such as LogMeIn and ScreenConnect to gain unauthorized access to victim devices. These attacks, detailed in HP's Threat Insights Report, involved phishing emails that tricked users into installing these tools, allowing attackers to control systems without triggering security alerts. The abuse of trusted software enabled threat actors to blend malicious activities with normal IT operations, complicating detection and response efforts. This incident underscores a growing trend where attackers leverage legitimate remote monitoring and management (RMM) tools to establish persistent access and deploy malware. The increasing sophistication of such tactics highlights the need for organizations to enhance monitoring of software installations, enforce strict privilege controls, and update defenses to detect and prevent misuse of trusted applications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices
Telecommunications4 months ago

FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices

In June 2026, a large-scale credential harvesting operation, dubbed 'FortiBleed,' targeted Fortinet firewalls and VPN gateways, compromising over 30,000 internet-facing devices across nearly 200 countries. The attackers, suspected to be Russian-speaking threat actors, utilized automated tools to collect and verify login credentials, exploiting weak or default passwords without leveraging any known Fortinet vulnerabilities. This campaign affected various sectors, including government, telecommunications, healthcare, education, financial services, and critical infrastructure, with significant concentrations in India and the United States. The operation underscores the critical importance of robust password policies and the implementation of multi-factor authentication to safeguard network security devices. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phantom Stealer: The Rise of Fileless Malware Targeting Financial Institutions
Banking/Mortgage4 months ago

Phantom Stealer: The Rise of Fileless Malware Targeting Financial Institutions

In June 2026, a sophisticated phishing campaign targeted banks and high-value organizations, deploying Phantom Stealer—a fileless malware designed to evade traditional endpoint defenses. The attack began with phishing emails containing seemingly legitimate business documents. Upon opening, a heavily obfuscated batch file initiated a multistage infection chain, injecting Phantom Stealer into the Windows Explorer process. Operating entirely in memory, the malware silently exfiltrated browser credentials, session cookies, and financial data through multiple channels, including Telegram, Discord, FTP, and SMTP. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing use of fileless malware and advanced evasion techniques. Organizations must enhance their security posture by adopting behavior-based detection systems and educating employees on recognizing sophisticated phishing attempts to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Issues Warning on Actively Exploited Joomla JCE Vulnerability
Computer Software/Engineering4 months ago

CISA Issues Warning on Actively Exploited Joomla JCE Vulnerability

In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-48907, affecting the Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities catalog. This flaw, present in JCE versions 1.0.0 through 2.9.99.4, allows unauthenticated users to create new editor profiles, enabling the upload and execution of arbitrary PHP code on the server. The vulnerability has been actively exploited, with attackers leveraging it to gain unauthorized access and control over affected Joomla installations. The active exploitation of this vulnerability underscores the persistent threat posed by improper access controls in widely used content management systems. Organizations utilizing Joomla with the JCE extension are urged to update to version 2.9.99.5 or later to mitigate this risk. Additionally, administrators should audit their systems for unauthorized editor profiles and monitor server logs for suspicious activity to prevent potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling the VHDX-Based Remcos RAT Attack: A 2026 Cybersecurity Challenge
Financial Services4 months ago

Unveiling the VHDX-Based Remcos RAT Attack: A 2026 Cybersecurity Challenge

In June 2026, a sophisticated malware campaign was identified, utilizing a VHDX disk image within a ZIP archive to deliver the Remcos Remote Access Trojan (RAT). Upon extraction, the VHDX file auto-mounted on Windows systems, revealing an obfuscated JavaScript file named 'Partnerschaft_fur_neue_Angebotsanfrage.js', indicating potential targeting of German-speaking users. This JavaScript initiated a multi-stage infection chain involving PowerShell scripts and .NET loaders, ultimately injecting the Remcos RAT into the 'backgroundTaskHost.exe' process. The malware established communication with a command-and-control server at animal342[.]duckdns[.]org:53552, enabling remote surveillance and data exfiltration. Notably, the campaign employed techniques such as WMI for process execution and Base64 encoding with XOR decryption to evade detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals who leverage legitimate system features and complex obfuscation methods to bypass security controls. The use of VHDX files as malware containers highlights the need for enhanced vigilance and advanced detection mechanisms to counter such sophisticated threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mastra npm Supply Chain Attack: 144 Packages Compromised
Computer Software/Engineering4 months ago

Mastra npm Supply Chain Attack: 144 Packages Compromised

In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising 144 packages associated with the '@mastra' namespace. The attack was initiated through the hijacking of a former contributor's npm account, 'ehindero'. The attackers introduced a malicious dependency named 'easy-day-js', which masqueraded as the legitimate 'dayjs' library. Initially, 'easy-day-js' appeared benign, but subsequent versions contained obfuscated post-install scripts designed to exfiltrate sensitive information from developers' systems. This incident underscores the vulnerabilities inherent in open-source software supply chains, particularly when trusted contributor accounts are compromised. The Mastra framework, widely used for building AI applications, saw its core components, such as '@mastra/core', affected, amplifying the potential impact on downstream projects and organizations. The attack highlights the critical need for robust security measures in package management and dependency verification processes. The increasing frequency of such supply chain attacks emphasizes the urgency for the developer community to adopt stringent security practices, including regular audits of dependencies, implementation of multi-factor authentication for contributor accounts, and continuous monitoring for anomalous activities within software ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Malicious JetBrains Plugins Compromise AI API Keys in 2026
Computer Software/Engineering4 months ago

Malicious JetBrains Plugins Compromise AI API Keys in 2026

In June 2026, cybersecurity researchers identified a coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace. These plugins, masquerading as AI coding assistants built on DeepSeek and other large language models, were designed to exfiltrate artificial intelligence (AI) provider keys. The plugins offered functionalities such as chat, commit messages, code review, bug finding, and unit tests, thereby enticing developers to install them. Once installed, the plugins covertly transmitted sensitive API keys to attacker-controlled servers, potentially compromising the security of AI-driven applications and services. This incident underscores a growing trend where threat actors exploit the trust in developer tools and marketplaces to distribute malicious software. The increasing integration of AI into development workflows makes such platforms attractive targets. Organizations must remain vigilant, ensuring the integrity of the tools they incorporate and regularly auditing their development environments to prevent unauthorized access and data exfiltration.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Understanding the MongoBleed Vulnerability (CVE-2025-14847) and Its Impact
Banking/Mortgage4 months ago

Understanding the MongoBleed Vulnerability (CVE-2025-14847) and Its Impact

In December 2025, a critical vulnerability known as MongoBleed (CVE-2025-14847) was disclosed, affecting multiple versions of MongoDB Server from 3.6 through 8.2.3. This flaw allows unauthenticated attackers to exploit improper handling of zlib-compressed network traffic, leading to the leakage of uninitialized heap memory. As a result, sensitive data such as credentials, session tokens, and API keys could be exfiltrated from affected servers. The vulnerability has been actively exploited in the wild, with approximately 87,000 MongoDB instances exposed globally, primarily in the United States, China, and Germany. Organizations are strongly advised to apply security patches immediately or disable compression and restrict network exposure to mitigate the risk. ([infoq.com](https://www.infoq.com/news/2026/01/mongodb-mongobleed-vulnerability/?utm_source=openai)) The MongoBleed incident underscores the critical importance of timely patch management and the need for robust security measures to protect against vulnerabilities in widely used database systems. The rapid exploitation of this flaw highlights the evolving threat landscape and the necessity for organizations to remain vigilant in securing their infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Introducing Sulla: Praetorian's Open-Source SMB Secret Scanner
Financial Services4 months ago

Introducing Sulla: Praetorian's Open-Source SMB Secret Scanner

In June 2026, Praetorian released Sulla, an open-source tool designed to scan SMB shares for exposed credentials across enterprise networks. Sulla automates the discovery of readable SMB shares, traverses their file structures, and scans contents for sensitive information using the Titus detection library. This tool addresses the challenge of manually reviewing numerous network shares, which is often tedious and inefficient. By integrating Sulla into their Continuous Threat Exposure Management platform, Guard, Praetorian ensures that SMB secrets are identified promptly as they appear in environments. The release of Sulla highlights the growing need for automated tools to detect and mitigate the risks associated with exposed credentials in network shares. As organizations increasingly rely on complex network infrastructures, tools like Sulla become essential in proactively identifying and addressing security vulnerabilities, thereby enhancing overall cybersecurity posture.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports