Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 166 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1981–1992 / 4893 reports
Check Point VPN Zero-Day Exploited by Qilin Ransomware
Financial Services5 months ago

Check Point VPN Zero-Day Exploited by Qilin Ransomware

In early May 2026, Check Point identified a critical authentication bypass vulnerability, CVE-2026-50751, in its Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 protocol. This flaw allows unauthenticated remote attackers to establish VPN connections without valid credentials. Exploitation began on May 7, 2026, affecting a limited number of organizations globally, with at least one incident linked to the Qilin ransomware group. Check Point has released patches and mitigation measures to address this vulnerability. The exploitation of CVE-2026-50751 underscores the risks associated with using outdated protocols like IKEv1. Organizations are urged to update their systems promptly and transition to more secure configurations to prevent unauthorized access and potential ransomware attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical UniFi OS Vulnerabilities Enable Remote Code Execution
Information Technology/IT5 months ago

Critical UniFi OS Vulnerabilities Enable Remote Code Execution

In May 2026, Ubiquiti's UniFi OS was found to have three critical vulnerabilities—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—each with a CVSS score of 10.0. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges by chaining improper access control, path traversal, and command injection vulnerabilities. The vulnerabilities affect UniFi OS Server versions 5.0.6 and earlier, potentially compromising network management systems, surveillance cameras, and physical access controls. This incident underscores the escalating risks associated with network management systems as prime targets for cyberattacks. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities, especially given the increasing sophistication of threat actors targeting critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Gogs Vulnerability Patched: Argument Injection Leads to RCE
Computer Software/Engineering5 months ago

Critical Gogs Vulnerability Patched: Argument Injection Leads to RCE

In June 2026, a critical argument injection vulnerability was discovered in Gogs, a self-hosted Git service. This flaw allowed authenticated users to execute remote code, potentially compromising servers, accessing private repositories, stealing credentials, and altering source code. The vulnerability affected all Gogs releases up to and including 0.14.2 and 0.15.0+dev. Rapid7 security researcher Jonah Burgess identified the issue, noting that default configurations with open registration enabled made exploitation easier. Gogs maintainers released version 0.14.3 on June 7, 2026, to address this flaw. This incident underscores the importance of timely patching and vigilant configuration management. The prevalence of similar vulnerabilities highlights the need for organizations to proactively secure their development environments against emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
NFCShare Android Malware: A New Threat Exploiting Fake Banking App Updates
Banking/Mortgage5 months ago

NFCShare Android Malware: A New Threat Exploiting Fake Banking App Updates

In June 2026, the NFCShare Android malware emerged, targeting European banking customers by masquerading as legitimate banking app updates hosted on GitHub. Victims were lured through phishing sites impersonating real banks, prompting them to download malicious APK files. Once installed, the malware displayed fake verification screens, instructing users to place their payment cards near the device's NFC chip. Utilizing Android’s IsoDep interface and EMV commands, NFCShare extracted card details, including numbers, types, expiry dates, and PINs, transmitting this sensitive information to the attackers' command-and-control servers via WebSocket channels. This data facilitated unauthorized NFC payment relay schemes, leading to potential financial losses for the victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github/?utm_source=openai)) The incident underscores a growing trend of sophisticated Android malware exploiting NFC technology to harvest payment card data. Similar campaigns, such as those involving NGate and SuperCard X malware, have been documented, indicating an escalating threat landscape. Organizations must enhance their mobile security measures and educate users on the risks associated with downloading apps from unverified sources to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
Information Technology/IT5 months ago

Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required

In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management
Financial Services5 months ago

SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management

In April 2026, SoFi Hong Kong, a subsidiary of the U.S.-based financial technology company SoFi Technologies, detected unauthorized access to a customer database managed by a third-party vendor. The breach, discovered on April 30, 2026, prompted SoFi to engage a cybersecurity firm to investigate. While the full scope of the incident remains under investigation, the company has advised customers to monitor their accounts for suspicious activity and has implemented additional security measures to protect affected accounts. This incident underscores the critical importance of robust third-party risk management in the financial sector. As financial institutions increasingly rely on external vendors for data management, ensuring these partners adhere to stringent security protocols is essential to prevent unauthorized access and protect sensitive customer information.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980
Financial Services5 months ago

Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980

In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS was exploited to compromise over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. Attackers injected malicious JavaScript into these sites, presenting visitors with fake Cloudflare verification prompts that, when followed, installed malware on their systems. This vulnerability, with a CVSS score of 9.4, allowed unauthenticated attackers to read arbitrary data from the database, leading to widespread data breaches and malware distribution. ([techtimes.com](https://www.techtimes.com/articles/317134/20260525/ghost-cms-sql-injection-hits-700-sites-harvard-duckduckgo-serve-fake-cloudflare-malware.htm?utm_source=openai)) The exploitation of this vulnerability underscores the critical importance of timely patch management. Despite a patch being available since February 2026, many organizations failed to apply it, resulting in significant security incidents. This case highlights the ongoing risks associated with unpatched software and the necessity for organizations to maintain robust vulnerability management practices. ([techradar.com](https://www.techradar.com/pro/security/ghost-cms-flaw-hijacked-to-target-hundreds-of-websites-with-clickfix-attacks-heres-how-to-stay-safe?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents
Information Technology/IT5 months ago

Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents

In May 2026, a security incident involving Microsoft Entra Agent ID's assistive agents was identified. An AI agent, operating under the On-Behalf-Of (OBO) authentication flow, sent a suspicious email with the subject 'Here is your invoice' from matt@ContosoCorp.onmicrosoft.com to an external recipient. The email originated from IP address 51.3.97.221, utilizing the Microsoft Graph beta API. This activity raised concerns about potential misuse of delegated permissions granted to AI agents, highlighting vulnerabilities in the OBO flow that could be exploited for unauthorized actions. The incident underscores the growing security challenges associated with AI agents in enterprise environments. As organizations increasingly integrate AI-driven workflows, ensuring robust identity and access management for these agents becomes critical. This event serves as a reminder of the importance of monitoring AI agent activities and implementing stringent controls to prevent unauthorized access and actions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Hades Campaign: A New Threat to PyPI Security
Computer Software/Engineering5 months ago

Hades Campaign: A New Threat to PyPI Security

In June 2026, a sophisticated supply chain attack targeted the Python Package Index (PyPI), compromising 37 wheels across 19 packages. The attackers, adopting a 'Hades' naming convention, deployed a variant of the Shai-Hulud worm, which is known for its self-propagating and information-stealing capabilities. This malware infects software components, utilizes the access to publish malicious versions, and harvests repository accounts of downstream users. The attack chain's cross-runtime design involved the installation of Bun—a JavaScript runtime—as a heavily obfuscated JavaScript stealer before executing the payload. This incident underscores the persistent and evolving nature of software supply chain threats. The use of cross-runtime techniques and obfuscated payloads highlights the increasing sophistication of attackers, emphasizing the need for robust security measures in open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions
Legal Services5 months ago

UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions

Between January and May 2026, the threat actor UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), targeted numerous U.S. organizations in the professional, legal, and financial sectors. Utilizing voice phishing (vishing) and social engineering tactics, they impersonated IT support to gain remote access via screen-sharing sessions and remote monitoring tools. In some cases, attackers physically infiltrated offices, posing as IT technicians to exfiltrate data using USB devices. Stolen information included proprietary legal agreements, personally identifiable information (PII), and financial records. The group rapidly demanded ransoms, threatening to publish the stolen data if payments were not made promptly. This incident underscores the evolving tactics of cybercriminals, combining traditional social engineering with physical intrusion methods. The rapid execution of these attacks, often completed within a single business day, highlights the need for organizations to enhance their security awareness training and implement robust verification processes for IT support interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
Computer Software/Engineering5 months ago

Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More

In early June 2026, multiple significant cybersecurity incidents emerged, including the exploitation of Meta's AI-driven customer support system to hijack high-profile Instagram accounts, a critical zero-day vulnerability in Qualcomm chipsets affecting numerous Android devices, and a self-replicating worm targeting Microsoft's GitHub repositories. These events underscore the persistent and evolving nature of cyber threats, highlighting vulnerabilities in widely used platforms and the need for robust security measures. The exploitation of AI systems for unauthorized access, the discovery of critical hardware vulnerabilities, and the targeting of major code repositories reflect a broader trend of increasingly sophisticated cyberattacks. Organizations must remain vigilant, continuously update their security protocols, and invest in advanced threat detection to mitigate these evolving risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Red Hat npm Packages Compromised in June 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

Red Hat npm Packages Compromised in June 2026 Supply Chain Attack

In June 2026, a sophisticated supply chain attack was identified, involving the compromise of Red Hat's npm packages. Attackers infiltrated a Red Hat employee's GitHub account, injecting malware into numerous npm packages under the Red Hat Cloud Services namespace. This breach led to over 80,000 downloads of compromised packages within a week, targeting sensitive data such as GitHub Actions secrets, npm tokens, SSH keys, and cloud credentials. The malicious code employed encrypted exfiltration techniques, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks, particularly those exploiting open-source ecosystems. The attackers' use of advanced techniques, including encrypted exfiltration and targeting cloud identities, highlights the need for enhanced vigilance and robust security measures in software development and distribution processes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports