Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 186 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2221–2232 / 4893 reports
Shai-Hulud Malware Compromises 600+ npm Packages in May 2026
Computer Software/Engineering5 months ago

Shai-Hulud Malware Compromises 600+ npm Packages in May 2026

In May 2026, a significant supply chain attack known as the Shai-Hulud campaign compromised over 600 npm packages, primarily targeting the @antv ecosystem. Threat actors infiltrated developer accounts to publish malicious versions of popular JavaScript libraries, including echarts-for-react, @antv/g2, and timeago.js. The malware harvested sensitive information from developer environments and CI/CD pipelines, exfiltrating data via encrypted channels to evade detection. This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in software development pipelines. The attackers' use of valid Sigstore provenance attestations to lend credibility to malicious packages represents a concerning evolution in attack methodologies, emphasizing the urgency for developers and organizations to implement robust verification processes and maintain vigilance against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach
Financial Services5 months ago

Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach

In May 2026, the threat actor known as Storm-2949 executed a sophisticated attack targeting Microsoft 365 and Azure environments. Utilizing social engineering tactics, they impersonated IT support to exploit the Self-Service Password Reset (SSPR) feature, gaining unauthorized access to privileged accounts. This access enabled them to exfiltrate sensitive data from OneDrive, SharePoint, and Azure resources, including virtual machines, storage accounts, key vaults, app services, and SQL databases. The attackers leveraged legitimate administrative tools to blend into normal operations, complicating detection efforts. This incident underscores the evolving threat landscape where attackers increasingly exploit identity management systems and cloud services. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Disrupts Fox Tempest: A Cybercrime Service Exploiting Trusted Platforms
Computer Software/Engineering5 months ago

Microsoft Disrupts Fox Tempest: A Cybercrime Service Exploiting Trusted Platforms

In May 2026, Microsoft disrupted a cybercrime operation known as Fox Tempest, which had been abusing Microsoft's Artifact Signing service to generate fraudulent code-signing certificates. These certificates allowed malware to be digitally signed, making it appear as legitimate software to users and operating systems. Fox Tempest created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. The service was linked to various malware and ransomware campaigns, including those involving Oyster, Lumma Stealer, Vidar, and ransomware families such as Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft seized the domain signspace[.]cloud, took hundreds of virtual machines offline, and blocked access to the infrastructure hosting the cybercrime platform. This action underscores the evolving tactics of cybercriminals who exploit trusted platforms to distribute malware, highlighting the need for continuous vigilance and adaptive security measures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution
Computer Software/Engineering5 months ago

Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution

In May 2026, a critical vulnerability identified as CVE-2026-45829 was discovered in ChromaDB's Python FastAPI server, affecting versions 1.0.0 and later. This flaw allows unauthenticated attackers to execute arbitrary code on exposed servers by sending crafted requests that exploit the server's handling of model repositories. The vulnerability arises from improper authentication checks, enabling attackers to load and execute malicious models from external sources like Hugging Face before any authentication is performed. This can lead to full server compromise, data exfiltration, and disruption of AI/ML workflows. The incident underscores the growing risks associated with AI infrastructure vulnerabilities, especially as AI applications become more integrated into critical business operations. Organizations must prioritize securing their AI systems by implementing robust authentication mechanisms, conducting regular security audits, and staying vigilant against emerging threats targeting AI platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme
Marketing/Advertising/Sales5 months ago

Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme

In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT
Financial Services5 months ago

Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT

In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like `organizations:LeaveOrganization` to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization. This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for `organizations:LeaveOrganization` API calls to detect and mitigate such threats promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Driven Vulnerability Discovery: Transforming Cybersecurity in 2026
Financial Services5 months ago

AI-Driven Vulnerability Discovery: Transforming Cybersecurity in 2026

In April 2026, Anthropic's AI model, Mythos, identified thousands of previously unknown vulnerabilities across major operating systems and web browsers, including a 27-year-old flaw in OpenBSD. This unprecedented discovery underscores the transformative impact of AI in cybersecurity, enabling rapid identification of critical vulnerabilities that had remained undetected for decades. ([ibm.com](https://www.ibm.com/think/insights/the-mythos-moment-when-discovery-outpaces-defense?utm_source=openai)) The rapid pace of AI-driven vulnerability discovery has compressed the timeline between identification and potential exploitation, necessitating immediate and robust defensive measures. Organizations must adapt to this accelerated threat landscape by integrating AI-powered tools into their security protocols to effectively manage and mitigate emerging risks. ([sans.org](https://www.sans.org/press/announcements/emergency-strategy-briefing-ai-driven-vulnerability-discovery-compresses-exploit-timelines?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Claw Chain Vulnerabilities: A Wake-Up Call for AI Agent Security
Computer Software/Engineering5 months ago

Claw Chain Vulnerabilities: A Wake-Up Call for AI Agent Security

In April 2026, security researchers identified four critical vulnerabilities in the OpenClaw AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—allowed attackers to exploit race conditions and logic errors to gain unauthorized access, escalate privileges, and establish persistent control over affected systems. The vulnerabilities impacted all OpenClaw versions prior to 2026.4.22, enabling adversaries to manipulate system configurations, exfiltrate sensitive data, and bypass sandbox restrictions. The discovery of 'Claw Chain' underscores the escalating security challenges associated with rapidly adopted AI agent platforms. As organizations increasingly integrate such frameworks into critical workflows, the potential attack surface expands, necessitating vigilant security assessments and prompt patch management to mitigate emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Microsoft Exchange Zero-Day CVE-2026-42897 Exploited in the Wild
Financial Services5 months ago

Critical Microsoft Exchange Zero-Day CVE-2026-42897 Exploited in the Wild

In May 2026, Microsoft disclosed a zero-day vulnerability, CVE-2026-42897, affecting on-premises versions of Exchange Server 2016, 2019, and Subscription Edition. This cross-site scripting (XSS) flaw allows attackers to execute arbitrary JavaScript in a user's browser by sending a specially crafted email, which, when opened in Outlook Web Access (OWA), triggers the exploit. The vulnerability has been actively exploited in the wild, leading to potential unauthorized access to users' mailboxes and session tokens. Microsoft has provided temporary mitigations through the Exchange Emergency Mitigation Service (EEMS) and manual scripts, but a permanent patch is still pending. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-Exchange-Server-zero-day-exploited-via-crafted-email.1298885.0.html?utm_source=openai)) The exploitation of CVE-2026-42897 underscores the persistent threat posed by XSS vulnerabilities, even in widely used enterprise applications. Organizations relying on on-premises Exchange Servers must remain vigilant, apply available mitigations promptly, and monitor for any signs of compromise to protect sensitive information and maintain operational integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026
Computer Software/Engineering5 months ago

Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026

In May 2026, the 'Mini Shai-Hulud' supply chain attack compromised over 300 npm packages within the @antv ecosystem by exploiting a maintainer's account. The attackers published 639 malicious versions across 323 packages, embedding malware designed to steal developer credentials and cloud secrets. This breach affected widely used packages like echarts-for-react, impacting millions of weekly downloads. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation and sophisticated techniques employed highlight the need for enhanced security measures in package management and developer workflows to prevent similar future compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities
Computer Software/Engineering5 months ago

GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities

In May 2026, threat actors compromised the GitHub Actions workflow 'actions-cool/issues-helper' by redirecting existing tags to an imposter commit containing malicious code. This code, when executed within CI/CD pipelines, harvested sensitive credentials and exfiltrated them to an attacker-controlled server. The attack involved downloading the Bun JavaScript runtime, reading memory from the Runner.Worker process to extract credentials, and transmitting the stolen data to 't.m-kosche[.]com'. GitHub has since disabled access to the affected repository due to violations of its terms of service. This incident underscores the escalating trend of software supply chain attacks targeting CI/CD pipelines. The use of imposter commits to inject malicious code highlights the need for organizations to implement stringent security measures, such as pinning dependencies to known-good commit SHAs and continuously monitoring for unauthorized changes in their development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Nx Console Extension Compromised: A Wake-Up Call for Developer Security
Computer Software/Engineering5 months ago

Nx Console Extension Compromised: A Wake-Up Call for Developer Security

On May 18, 2026, a compromised version of the Nx Console extension (version 18.95.0) was published to the Microsoft Visual Studio Code Marketplace. This extension, widely used by over 2.2 million developers, was altered to include a credential-stealing payload. Upon opening any workspace, the malicious extension fetched and executed an obfuscated payload from a hidden commit within the official nrwl/nx GitHub repository. This payload harvested sensitive information, including tokens and secrets from platforms such as GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, exfiltrating them via multiple channels. ([stepsecurity.io](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting developer tools. The sophisticated method of embedding malicious code within trusted extensions highlights the need for enhanced vigilance and security measures in software development environments. Developers and organizations must prioritize the integrity of their toolchains to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports