Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 174 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2077–2088 / 4893 reports
Carnival Corporation's 2026 Data Breach: A ShinyHunters Operation
Leisure/Travel5 months ago

Carnival Corporation's 2026 Data Breach: A ShinyHunters Operation

In April 2026, Carnival Corporation, the world's largest cruise operator, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers employed social engineering tactics to deceive an employee, gaining unauthorized access to the company's IT systems. This intrusion led to the exfiltration of personal data belonging to nearly 6 million individuals, including names, birthdates, genders, and loyalty program details. The breach was publicly disclosed on May 27, 2026, over a month after the initial compromise. ([prnewswire.com](https://www.prnewswire.com/news-releases/carnival-corporation-notice-of-data-breach-302783524.html?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated cybercriminal groups like ShinyHunters, who have been linked to multiple high-profile data breaches in 2026. The delay in disclosure highlights the challenges organizations face in promptly notifying affected individuals, emphasizing the need for robust cybersecurity measures and transparent communication strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters' 2026 Data Breaches: A Wake-Up Call for Cybersecurity
Health Care / Life Sciences5 months ago

ShinyHunters' 2026 Data Breaches: A Wake-Up Call for Cybersecurity

In May 2026, the cybercriminal group ShinyHunters executed a series of data breaches targeting multiple organizations, including DentaQuest, a prominent dental benefits administrator in the United States. The attackers employed sophisticated social engineering techniques, such as voice phishing, to compromise employee credentials and gain unauthorized access to sensitive systems. This led to the exfiltration of substantial volumes of personal and proprietary data, which ShinyHunters subsequently threatened to release unless ransom demands were met. The breaches have raised significant concerns regarding data security practices and the effectiveness of current defensive measures against such targeted attacks. The recent surge in ShinyHunters' activities underscores a troubling trend in cybercrime, where threat actors increasingly leverage social engineering to bypass technical defenses. Organizations across various sectors are now facing heightened risks of data breaches, emphasizing the urgent need for enhanced security protocols, employee training, and robust incident response strategies to mitigate the impact of such sophisticated cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent: Palo Alto Networks GlobalProtect VPN Vulnerability (CVE-2026-0257) Under Active Exploitation
Financial Services5 months ago

Urgent: Palo Alto Networks GlobalProtect VPN Vulnerability (CVE-2026-0257) Under Active Exploitation

In May 2026, Palo Alto Networks disclosed CVE-2026-0257, an authentication bypass vulnerability in its PAN-OS GlobalProtect VPN technology. This flaw allows unauthenticated attackers to establish unauthorized VPN connections, potentially exposing internal networks. Despite an initial CVSS score of 7.8, the vulnerability has been actively exploited since mid-May, leading to its inclusion in CISA's Known Exploited Vulnerabilities catalog. Organizations are urged to apply patches or mitigations immediately to prevent unauthorized access. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0257?utm_source=openai)) The active exploitation of CVE-2026-0257 underscores the critical need for timely vulnerability management and patching, especially for edge-facing enterprise VPN appliances. This incident highlights the evolving threat landscape where attackers rapidly exploit known vulnerabilities, emphasizing the importance of proactive cybersecurity measures. ([rapid7.com](https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Malicious npm Package 'codexui-android' Compromises OpenAI Codex Tokens
Computer Software/Engineering5 months ago

Malicious npm Package 'codexui-android' Compromises OpenAI Codex Tokens

In May 2026, a malicious supply chain attack targeted developers using OpenAI Codex through a seemingly legitimate npm package named 'codexui-android'. This package, advertised as a remote web UI for OpenAI Codex, amassed over 29,000 weekly downloads. Approximately a month after its initial release, the package began exfiltrating users' Codex authentication tokens to an attacker-controlled server, granting unauthorized access to developers' accounts. The malicious code was embedded into a functional npm package that had undergone active development, making it particularly insidious. The associated GitHub repository remained clean, further complicating detection. ([thehackernews.com](https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html?utm_source=openai)) This incident underscores the growing sophistication of supply chain attacks, where threat actors leverage trusted development tools to infiltrate systems. The use of a functional and actively developed package to distribute malicious code highlights the need for heightened vigilance in the software development community. Developers are urged to scrutinize third-party packages, even those with established reputations, to mitigate the risk of credential theft and unauthorized access.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Operation Dragon Weave: Unveiling a Sophisticated Cyber Espionage Campaign
Government Administration5 months ago

Operation Dragon Weave: Unveiling a Sophisticated Cyber Espionage Campaign

Operation Dragon Weave is a cyber espionage campaign identified in May 2026, targeting officials and citizens in the Czech Republic and Taiwan. The attackers employed spear-phishing emails with ZIP attachments to initiate an infection chain that utilized a Rust-based loader to deploy the AdaptixC2 agent, known as AZUREVEIL. This agent facilitated data exfiltration and remote control by leveraging Microsoft Azure Blob Storage for command-and-control communications, effectively blending malicious traffic with legitimate cloud activity. The campaign specifically targeted sectors such as government, research, academia, technology, and financial services, indicating a strategic focus on sensitive information. The use of AdaptixC2 in this campaign underscores a growing trend where open-source penetration testing tools are repurposed by threat actors for malicious activities. This incident highlights the need for organizations to enhance their detection capabilities and adopt proactive defense measures to counter sophisticated attack vectors that exploit legitimate cloud services for covert operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SmartApeSG Campaign's Multi-Stage Attack Delivers Unidentified RAT and NetSupport RAT
Financial Services5 months ago

SmartApeSG Campaign's Multi-Stage Attack Delivers Unidentified RAT and NetSupport RAT

In late May 2026, the SmartApeSG campaign employed a ClickFix-style fake CAPTCHA page to deliver an unidentified Remote Access Trojan (RAT) to Windows systems. This initial RAT established a connection to a command and control server at 89.110.110[.]119 over TCP port 443, facilitating the subsequent download and installation of the NetSupport Manager RAT. The infection chain involved multiple stages, including the execution of malicious scripts and the deployment of various files to ensure persistence on the compromised host. This incident underscores the evolving tactics of threat actors who leverage social engineering techniques, such as fake verification pages, to deceive users into executing malicious code. The use of legitimate tools like NetSupport Manager for malicious purposes highlights the challenges in detecting and mitigating such threats, emphasizing the need for continuous monitoring and advanced threat detection mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
Information Technology/IT5 months ago

Dutch Authorities Dismantle Massive 17 Million-Device Botnet

In May 2026, Dutch authorities dismantled a massive botnet comprising over 17 million infected devices, including computers, smartphones, and IoT devices. The operation, conducted by the Dutch National Police and the National Cyber Security Centre (NCSC), involved seizing more than 200 servers located in the Netherlands that controlled the botnet's infrastructure. The botnet was reportedly linked to Asocks, a company offering residential proxy services, which had been exploited for various cybercriminal activities such as DDoS attacks, phishing, and malware distribution. ([arstechnica.com](https://arstechnica.com/security/2026/05/botnet-of-more-than-17-million-devices-dismantled/?utm_source=openai)) This incident underscores the growing threat posed by large-scale botnets leveraging residential proxy networks to mask malicious activities. The takedown highlights the importance of international cooperation in combating cybercrime and the need for robust security measures to protect consumer devices from being co-opted into such networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Palo Alto GlobalProtect VPN Auth Bypass Flaw (CVE-2026-0257) Exploited in Attacks
Banking/Mortgage5 months ago

Palo Alto GlobalProtect VPN Auth Bypass Flaw (CVE-2026-0257) Exploited in Attacks

In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in their PAN-OS GlobalProtect portal and gateway, allowing unauthenticated attackers to establish unauthorized VPN connections. Initially rated as medium severity, the flaw's risk escalated when active exploitation was observed starting May 17, 2026, leading to unauthorized access attempts on corporate networks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0257?utm_source=openai)) The active exploitation of CVE-2026-0257 underscores the critical need for organizations to promptly apply security patches and review VPN configurations to prevent unauthorized access, especially as attackers increasingly target remote access solutions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CIFSwitch Vulnerability: A Critical Threat to Linux Systems
Information Technology/IT5 months ago

CIFSwitch Vulnerability: A Critical Threat to Linux Systems

In May 2026, a critical local privilege escalation vulnerability named 'CIFSwitch' was discovered in the Linux kernel's CIFS subsystem. This flaw allows unprivileged users to forge CIFS authentication key descriptions, exploit the kernel's key request mechanism, and gain root privileges. The vulnerability affects multiple Linux distributions, including Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15 SP7, particularly those with cifs-utils versions 6.14 and higher. The issue arises from the kernel's failure to verify that cifs.spnego key requests originate from its CIFS client, enabling attackers to manipulate the authentication workflow and execute arbitrary code with root privileges. The discovery of CIFSwitch underscores the persistent risks associated with longstanding vulnerabilities in widely used systems. Its exploitation highlights the necessity for organizations to promptly apply security patches, review system configurations, and implement robust monitoring to detect and mitigate potential threats arising from such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Polish Water Treatment Plant Breach: A Wake-Up Call for Critical Infrastructure Security
Utilities5 months ago

Polish Water Treatment Plant Breach: A Wake-Up Call for Critical Infrastructure Security

Between 2024 and 2025, Poland's Internal Security Agency (ABW) reported that state-sponsored threat actors, including APT28 and APT29, infiltrated industrial control systems (ICS) at five municipal water treatment facilities. The attackers exploited weak passwords and internet-exposed systems, gaining the capability to manipulate operational parameters, potentially compromising water quality and public safety. This breach underscores the critical vulnerabilities in essential infrastructure and the pressing need for robust cybersecurity measures. The incident highlights a growing trend of cyberattacks targeting operational technology (OT) systems within critical infrastructure sectors. As adversaries increasingly focus on these sectors, organizations must prioritize securing OT environments to prevent potential disruptions and safeguard public health.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent: PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) Exploited in the Wild
Financial Services5 months ago

Urgent: PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) Exploited in the Wild

In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in its PAN-OS software, affecting GlobalProtect portals and gateways. This flaw allows unauthenticated attackers to establish unauthorized VPN connections, potentially exposing internal networks. The vulnerability impacts specific PAN-OS versions and configurations where authentication override cookies are enabled. Exploitation was observed as early as May 17, 2026, with attackers gaining VPN access to internal networks. While no lateral movement was detected, the unauthorized access poses significant security risks. Organizations are urged to apply patches or mitigations promptly to prevent potential breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds CVE-2026-0257 to Known Exploited Vulnerabilities Catalog
Government Administration5 months ago

CISA Adds CVE-2026-0257 to Known Exploited Vulnerabilities Catalog

In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects the GlobalProtect portal and gateway components of Palo Alto Networks' PAN-OS software, allowing unauthenticated attackers to bypass security restrictions and establish unauthorized VPN connections. The flaw is present in multiple versions of PAN-OS, with patches available for affected systems. Organizations using vulnerable versions are urged to apply the necessary updates promptly to mitigate potential risks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0257?utm_source=openai)) The inclusion of CVE-2026-0257 in the KEV Catalog underscores the ongoing threat posed by authentication bypass vulnerabilities in widely used network security products. As attackers continue to exploit such flaws, it is imperative for organizations to maintain vigilant patch management practices and monitor for emerging threats to safeguard their networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports