Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 177 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2113–2124 / 4893 reports
FBI Issues Warning on Fake FIFA Websites Targeting 2026 World Cup Fans
Sports5 months ago

FBI Issues Warning on Fake FIFA Websites Targeting 2026 World Cup Fans

In May 2026, the FBI issued a warning about cybercriminals creating fake websites impersonating FIFA ahead of the 2026 World Cup. These fraudulent sites, often with minor spelling variations or alternative top-level domains, aim to steal personal and financial information, sell counterfeit tickets, and perpetrate other scams. The threat actors employ techniques like typo squatting to deceive users into believing they are interacting with legitimate FIFA platforms. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260527?utm_source=openai)) This incident underscores the increasing sophistication of phishing and social engineering attacks targeting major global events. As the World Cup approaches, the prevalence of such scams is expected to rise, highlighting the need for heightened vigilance and robust cybersecurity measures among fans and organizations involved. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fifa-websites-running-world-cup-fraud-schemes/amp/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
BTMOB: The No-Code Android Malware Service Empowering Cybercriminals
Banking/Mortgage5 months ago

BTMOB: The No-Code Android Malware Service Empowering Cybercriminals

In May 2026, cybersecurity researchers identified BTMOB, an Android remote access trojan (RAT) offered as a malware-as-a-service (MaaS) platform. BTMOB provides cybercriminals with a no-code APK builder, enabling the creation of customized phishing payloads without programming expertise. The malware grants attackers extensive control over infected devices, including data exfiltration, financial transaction interception, screenshot capture, and remote operation. Distributed primarily through phishing websites impersonating legitimate services, BTMOB has been notably active in Brazil and Latin America. Its accessibility and comprehensive feature set pose a significant threat to Android users globally. The emergence of BTMOB underscores a concerning trend in the cyber threat landscape: the commoditization of sophisticated malware through MaaS platforms. This development lowers the barrier to entry for cybercriminals, facilitating the rapid proliferation of advanced threats. Organizations must remain vigilant, as the ease of deploying such malware increases the risk of widespread attacks targeting mobile devices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Exploitation of FortiClient EMS Vulnerability Leads to Credential Theft
Computer/Network Security5 months ago

Exploitation of FortiClient EMS Vulnerability Leads to Credential Theft

In May 2026, threat actors exploited a critical vulnerability (CVE-2026-35616) in Fortinet's FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware across managed endpoints. By abusing the trusted endpoint management infrastructure, attackers disguised the malicious payload as a legitimate Fortinet update, executing it via PowerShell. This allowed them to harvest sensitive data, including passwords and autofill details from web browsers, and exfiltrate the information to attacker-controlled servers. The exploitation of this vulnerability underscores the risks associated with unpatched management systems and the potential for widespread compromise through centralized infrastructure. Organizations are urged to apply the latest patches and review endpoint management configurations to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Gogs RCE Vulnerability Discovered in 2026
Computer Software/Engineering5 months ago

Critical Gogs RCE Vulnerability Discovered in 2026

In May 2026, a critical remote code execution (RCE) vulnerability was identified in Gogs, an open-source self-hosted Git service. This flaw allows authenticated users to execute arbitrary code on the server by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. The vulnerability, rated 9.4 on the CVSS scale, does not require administrative privileges or interaction with other users, making exploitation straightforward for any registered user. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with self-hosted development tools. Organizations relying on Gogs should promptly implement recommended mitigations, such as restricting user registration and repository creation, to prevent potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Silent Ransom Group's In-Person Data Theft Tactics Target Law Firms
Law Practice/Law Firms5 months ago

Silent Ransom Group's In-Person Data Theft Tactics Target Law Firms

In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked extortion gang targeting U.S. law firms. SRG employs sophisticated social engineering tactics, including impersonating IT support staff via phone calls and phishing emails to gain remote access. When these methods fail, they escalate to in-person visits, where operatives physically infiltrate offices, connect external storage devices to computers, and exfiltrate sensitive client data. This data is then used to extort firms, with threats to publish or sell the information if ransoms are not paid. ([techtimes.com](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional cyber attacks with physical intrusion. The legal sector's sensitive data makes it a prime target, highlighting the urgent need for robust security protocols, employee training, and vigilance against both digital and physical social engineering threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BTMOB RAT: A New Android Malware-as-a-Service Threat
Banking/Mortgage5 months ago

BTMOB RAT: A New Android Malware-as-a-Service Threat

In May 2026, cybersecurity researchers identified BTMOB, an Android Remote Access Trojan (RAT), actively targeting users in Brazil and Latin America. Distributed through phishing campaigns that mimic legitimate services, BTMOB is sold as a malware-as-a-service (MaaS), allowing attackers to create malicious apps without coding expertise. Once installed, it exploits Android's Accessibility Services to gain elevated permissions, enabling data exfiltration, screen capture, and full remote control of infected devices. This comprehensive access poses significant risks, including financial theft and privacy breaches. The emergence of BTMOB underscores a growing trend in the commoditization of sophisticated malware, lowering the barrier for cybercriminals and expanding the threat landscape. Its MaaS model facilitates rapid adaptation and distribution, making it a formidable challenge for cybersecurity defenses worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
JINX-0164's Sophisticated Attack on Cryptocurrency Firms
Internet5 months ago

JINX-0164's Sophisticated Attack on Cryptocurrency Firms

In mid-2025, a previously unidentified threat actor, JINX-0164, initiated a campaign targeting cryptocurrency organizations. Utilizing sophisticated social engineering tactics, the attackers posed as recruiters on LinkedIn, inviting victims to virtual meetings on counterfeit domains resembling legitimate teleconference services. During these meetings, victims were deceived into downloading a malicious file disguised as a meeting client, leading to the installation of a Python-based macOS malware named AUDIOFIX. This malware harvested sensitive data, including credentials from password managers, web browsers, and cryptocurrency wallet extensions, and facilitated lateral movement within the organizations' development infrastructure. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai)) The campaign's relevance persists due to the increasing sophistication of social engineering attacks targeting the cryptocurrency sector. The use of custom macOS malware and the focus on compromising development pipelines underscore the evolving tactics of financially motivated threat actors. Organizations must remain vigilant against such multifaceted attacks to safeguard their digital assets. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Addresses Risks of Uncoordinated Zero-Day Disclosures
Computer Software/Engineering5 months ago

Microsoft Addresses Risks of Uncoordinated Zero-Day Disclosures

In May 2026, security researcher Chaotic Eclipse publicly disclosed multiple zero-day vulnerabilities affecting Windows components such as Defender and BitLocker. These disclosures were made without prior notification to Microsoft, leading to active exploitation of vulnerabilities like BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498). Microsoft criticized this uncoordinated approach, emphasizing the risks posed to customers and advocating for Coordinated Vulnerability Disclosure (CVD) to allow vendors time to address issues before public release. This incident underscores the ongoing tension between independent security researchers and software vendors regarding disclosure practices. The rapid exploitation of these vulnerabilities highlights the critical need for timely and coordinated communication to mitigate risks and protect end-users effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Akira Ransomware 2026 Attack: Lessons for Mid-Sized Organizations
Health Care / Life Sciences5 months ago

Akira Ransomware 2026 Attack: Lessons for Mid-Sized Organizations

In May 2026, a mid-sized organization fell victim to an Akira ransomware attack. The intrusion began with the exploitation of a forgotten local VPN account lacking multi-factor authentication, allowing attackers to gain initial access. Subsequently, they conducted network reconnaissance, escalated privileges, and moved laterally across systems. The attackers exfiltrated sensitive data before deploying ransomware to encrypt files, culminating in a ransom demand. This incident underscores the critical need for robust access controls and vigilant monitoring of network activities to prevent such breaches. The Akira ransomware group has demonstrated a rapid escalation in attack sophistication and frequency, particularly targeting organizations with vulnerable VPN configurations. Their ability to swiftly transition from initial access to full data encryption within hours highlights the urgency for organizations to implement comprehensive cybersecurity measures, including timely patching, multi-factor authentication, and continuous network monitoring.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Zapier Vulnerabilities Exposed: Potential Account Takeover Risks
Computer Software/Engineering5 months ago

Zapier Vulnerabilities Exposed: Potential Account Takeover Risks

In May 2026, security researchers from Token Security identified a chain of five vulnerabilities within Zapier, a widely-used workflow automation service. Exploiting these flaws required only a free Zapier account and could have allowed attackers to impersonate any signed-in user, potentially accessing millions of user accounts and their connected applications. The attack vector involved manipulating user-generated code, retrieving discarded login credentials, and accessing internal storage systems containing private software images. One such image included a publishing key for code running in every logged-in user's browser, enabling attackers to create or alter automations and interact with connected services as legitimate users. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai)) This incident underscores the critical importance of securing automation platforms, especially as they gain increased authority to act on behalf of users across multiple services. The vulnerabilities were promptly reported and patched, with no evidence of exploitation. However, organizations are advised to review their automation logs for unauthorized activities and reauthorize connections to sensitive systems to mitigate potential risks. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Mandates Urgent Patching of LiteSpeed cPanel Plugin Vulnerability CVE-2026-48172
Government Administration5 months ago

CISA Mandates Urgent Patching of LiteSpeed cPanel Plugin Vulnerability CVE-2026-48172

In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows unauthenticated remote attackers to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function, which mishandles Redis enable/disable features. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected servers. LiteSpeed released urgent security updates to address the issue, urging users to update to version 2.4.5 or later. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48172/?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the critical importance of timely patch management and the need for robust privilege assignment mechanisms in web hosting environments. The incident highlights the potential risks associated with shared hosting platforms, where a single compromised account can lead to server-wide breaches. Organizations are advised to prioritize the implementation of security patches and to conduct thorough audits of their systems to prevent similar vulnerabilities from being exploited.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
Law Practice/Law Firms5 months ago

FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics

In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), an extortion gang targeting U.S. law firms through sophisticated social engineering tactics. SRG actors impersonate IT support personnel via phone calls and phishing emails to gain remote access to victim computers. If these attempts fail, they escalate their efforts by sending individuals in person to the victim's location to physically access computers and exfiltrate sensitive data using external storage devices. The stolen data is then used to extort victims, with threats to sell or publicly disclose the information if ransom demands are not met. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-silent-ransom-group-in-person-data-theft-attacks/?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional phishing with physical infiltration to bypass digital defenses. The legal sector, known for handling highly sensitive information, is particularly vulnerable to such targeted attacks. Organizations must enhance their security protocols, including employee training on social engineering, strict access controls, and monitoring for unauthorized physical access, to mitigate the risks posed by such multifaceted threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports