Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 176 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2101–2112 / 4893 reports
Critical Vulnerability in KMW CCTV Security Cameras (CVE-2026-5386)
Security/Investigations5 months ago

Critical Vulnerability in KMW CCTV Security Cameras (CVE-2026-5386)

In May 2026, a critical vulnerability (CVE-2026-5386) was identified in KMW CCTV Security Cameras, specifically models KM-IP521 and KM-IP421. This flaw allows unauthenticated attackers to remotely reset the administrator password to a known value, granting full access to camera feeds and settings. The vulnerability poses significant risks to critical infrastructure sectors, including commercial facilities, government services, and financial services. KMW has released firmware updates to address this issue and recommends users apply these updates promptly. ([windowsforum.com](https://windowsforum.com/threads/cisa-icsa-26-148-06-kmw-cctv-critical-password-reset-flaw.420548/?utm_source=openai)) This incident underscores the growing security challenges associated with IoT devices in critical infrastructure. The ease of exploitation and potential impact highlight the necessity for robust security measures, including regular firmware updates and network segmentation, to protect against unauthorized access and potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026
Computer Software/Engineering5 months ago

Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026

In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
The Hidden Dangers of AI-Generated Applications: A 2026 Security Analysis
Financial Services5 months ago

The Hidden Dangers of AI-Generated Applications: A 2026 Security Analysis

In May 2026, cybersecurity firm RedAccess identified over 380,000 publicly accessible web assets created using AI-driven development platforms, commonly referred to as 'vibe coding' tools. Among these, approximately 5,000 assets appeared to be corporate-related, with more than 2,000 containing sensitive corporate, operational, or personal data. These applications were often deployed without basic access controls, granting administrative access to anyone who accessed the URL. This widespread exposure underscores the significant security risks associated with the rapid adoption of AI-generated code without proper oversight. The incident highlights the urgent need for organizations to implement robust security measures and governance frameworks to manage the risks posed by unauthorized AI-generated applications. As AI-driven development becomes more prevalent, ensuring the security and integrity of these applications is paramount to prevent data breaches and maintain compliance with regulatory standards.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious Sicoob NuGet Package Compromises Banking Credentials
Banking/Mortgage5 months ago

Malicious Sicoob NuGet Package Compromises Banking Credentials

In May 2026, cybersecurity researchers discovered a malicious NuGet package named 'Sicoob.Sdk' that impersonated a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 of this package were found to exfiltrate sensitive information, including client IDs and PFX certificates, which are crucial for secure communications. This incident underscores the growing trend of supply chain attacks targeting software development ecosystems to steal sensitive data. The discovery of 'Sicoob.Sdk' aligns with a series of recent supply chain attacks where malicious packages infiltrate trusted repositories. For instance, the 'TrapDoor' campaign targeted npm, PyPI, and Crates.io ecosystems to distribute credential-stealing malware. These incidents highlight the urgent need for enhanced vigilance and security measures within software supply chains to protect against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI Agents Exploit Marimo Vulnerability CVE-2026-39987
Computer Software/Engineering5 months ago

AI Agents Exploit Marimo Vulnerability CVE-2026-39987

In May 2026, an unidentified threat actor exploited a critical vulnerability (CVE-2026-39987) in Marimo, an open-source Python notebook platform, to gain unauthorized access to a publicly accessible Marimo instance. Utilizing a large language model (LLM) agent, the attacker extracted cloud credentials, retrieved an SSH private key from AWS Secrets Manager, and conducted multiple SSH sessions to exfiltrate the schema and full contents of an internal PostgreSQL database within a short timeframe. This incident underscores the rapid weaponization of AI-driven tools in cyberattacks, enabling sophisticated post-exploitation activities with minimal prior knowledge of the target environment. Organizations must prioritize patching known vulnerabilities and enhance monitoring to detect and mitigate such advanced threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Typosquatted npm Packages Lead to Cloud and CI/CD Credential Theft
Computer Software/Engineering5 months ago

Typosquatted npm Packages Lead to Cloud and CI/CD Credential Theft

In May 2026, a threat actor using the alias 'vpmdhaj' published 14 malicious npm packages that mimicked popular OpenSearch and ElasticSearch libraries. These packages, once installed, executed scripts to harvest sensitive credentials, including AWS keys, HashiCorp Vault tokens, and CI/CD pipeline secrets, from the host environment. The attack leveraged typosquatting and spoofed metadata to appear legitimate, facilitating unauthorized access and potential lateral movement within cloud infrastructures. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Organizations must remain vigilant, as such attacks can lead to significant data breaches and operational disruptions. Implementing stringent package validation processes and monitoring for anomalous activities are crucial to mitigating these risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Canon Printer Vulnerability Exposes Credentials - 2026
Health Care / Life Sciences5 months ago

Canon Printer Vulnerability Exposes Credentials - 2026

In April 2026, a critical vulnerability (CVE-2026-1789) was discovered in Canon's browser-based remote management interface for certain production printers and office multifunction printers. This flaw allowed attackers with administrative access to extract sensitive information, including plaintext credentials, by manipulating client-side encryption parameters during configuration exports. Exploiting this vulnerability enabled lateral movement within networks, potentially leading to complete domain compromise. This incident underscores the persistent risks associated with default credentials and inadequate security measures in networked devices. It highlights the necessity for organizations to enforce robust password policies, regularly update firmware, and implement stringent network segmentation to mitigate such vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Harnessing AI: LLMs in EDR Evasion Techniques
Computer/Network Security5 months ago

Harnessing AI: LLMs in EDR Evasion Techniques

In May 2026, Praetorian published a blog post titled 'Adversarial Oracles: LLM-Guided EDR Signature Reduction,' detailing the use of Large Language Models (LLMs) to automate the evasion of Endpoint Detection and Response (EDR) signatures. The post describes a methodology where LLMs analyze detection patterns from services like VirusTotal, identify specific triggers in offensive security tools, and suggest code modifications to reduce detection rates. This approach was applied to tools like 'goffloader,' resulting in a significant decrease in antivirus detections without altering the tools' core functionalities. This development is significant as it highlights the evolving arms race between offensive and defensive cybersecurity measures. The use of AI to circumvent EDR systems underscores the need for adaptive defense strategies and raises ethical considerations regarding the deployment of AI in cybersecurity.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Google Engineer Arrested for Insider Trading on Polymarket
Information Technology/IT5 months ago

Google Engineer Arrested for Insider Trading on Polymarket

In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was arrested in New York for allegedly using confidential internal data to profit on the Polymarket prediction platform. Spagnuolo accessed nonpublic 'Year in Search' data to place bets on the most searched individuals of 2025, resulting in over $1.2 million in gains. He faces charges including commodities fraud, wire fraud, and money laundering, with potential sentences totaling up to 50 years in prison. This incident underscores the growing scrutiny of insider trading within emerging financial platforms like prediction markets. It highlights the critical need for robust internal controls and monitoring to prevent the misuse of proprietary information, especially as digital platforms become increasingly integrated into financial activities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Romanian Hacker Sentenced for Breaching Oregon Government Network
Government Administration5 months ago

Romanian Hacker Sentenced for Breaching Oregon Government Network

In June 2021, Catalin Dragomir, a Romanian national operating under the alias "inthematrixl," unlawfully accessed the Oregon Department of Emergency Management's network. He extracted personally identifiable information, including names, email addresses, dates of birth, and passport numbers, and sold this data alongside unauthorized network access to potential buyers. Dragomir extended his cybercriminal activities by compromising nearly a dozen other U.S. networks, resulting in cumulative losses exceeding $250,000. Following his arrest in Romania in November 2024 and subsequent extradition to the United States in January 2025, Dragomir pleaded guilty to charges of aggravated identity theft and obtaining information from a protected computer. In May 2026, he was sentenced to 56 months in federal prison and ordered to forfeit approximately 23 Monero (XMR) cryptocurrency, valued at roughly $8,500. This case underscores the persistent threat posed by cybercriminals targeting government infrastructures and the critical need for robust cybersecurity measures to protect sensitive data. The incident also highlights the importance of international cooperation in apprehending and prosecuting cyber offenders.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Gogs Zero-Day Vulnerability Exposes Code Repositories to Remote Code Execution
Computer Software/Engineering5 months ago

Critical Gogs Zero-Day Vulnerability Exposes Code Repositories to Remote Code Execution

In May 2026, a critical zero-day vulnerability was discovered in Gogs, a self-hosted Git service. This argument injection flaw allows authenticated users to execute arbitrary code on servers running Gogs versions 0.14.2 and 0.15.0+dev. Exploitation involves creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. This vulnerability enables attackers to compromise the server, access all repositories, extract credentials, and potentially pivot to other systems. The incident underscores the persistent risks associated with self-hosted code repositories, especially those with default configurations that permit open registration. Organizations relying on Gogs should assess their exposure, apply available patches promptly, and consider implementing stricter access controls to mitigate similar threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
FortiClient EMS Vulnerability Leads to EKZ Infostealer Deployment
Government Administration5 months ago

FortiClient EMS Vulnerability Leads to EKZ Infostealer Deployment

In May 2026, threat actors exploited a critical authentication bypass vulnerability (CVE-2026-35616) in Fortinet's FortiClient Enterprise Management Server (EMS) versions 7.4.5 and 7.4.6. This flaw allowed unauthenticated remote attackers to execute arbitrary code via specially crafted requests. Leveraging this vulnerability, attackers delivered the EKZ infostealer malware, disguised as a legitimate Fortinet endpoint update, through FortiClient-managed VPN scripting workflows. The malware targeted credentials and sensitive data stored in web browsers, exfiltrating them to attacker-controlled servers. Fortinet released emergency patches to address this issue, and organizations were urged to apply them promptly to mitigate the risk of compromise. This incident underscores the critical importance of timely patch management and vigilance against sophisticated social engineering tactics. The exploitation of trusted security infrastructure highlights the evolving strategies of threat actors, emphasizing the need for organizations to adopt a proactive and layered security approach to protect against such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports