The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Axios Supply Chain Attack: A Wake-Up Call for Software Security
In late March 2026, attackers compromised the npm account of a primary maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They published two malicious versions, axios@1.14.1 and axios@0.30.4, which included a hidden dependency named 'plain-crypto-js'. This dependency executed a post-install script that deployed a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The RAT connected to a command-and-control server to retrieve platform-specific payloads, performed reconnaissance, and established persistence, with self-deletion capabilities to evade detection. The malicious versions were available for approximately three hours before removal, but the widespread use of Axios means the impact could be significant. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software components are exploited to distribute malware. The sophistication of this attack, including the use of a legitimate maintainer's credentials and the deployment of a cross-platform RAT, highlights the need for enhanced security measures in software development and distribution processes. Organizations must remain vigilant and implement robust monitoring and response strategies to mitigate such risks. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai))
5 months ago
Kill Chain
Anthropic's 2026 Source Code Leak: Lessons in Software Security
In March 2026, Anthropic, an AI company, inadvertently exposed the complete source code of its proprietary coding assistant, Claude Code. The leak occurred when a routine software update mistakenly included a 60 MB source map file (`cli.js.map`) in the NPM package version 2.1.88, allowing reconstruction of approximately 1,900 files and 500,000 lines of TypeScript code. This exposure revealed internal architectures and unreleased features, providing competitors with insights into Anthropic's development roadmap. The company confirmed that no sensitive customer data or credentials were compromised and attributed the incident to human error in the release packaging process. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai)) This incident underscores the critical importance of stringent internal security and release management practices, especially for organizations handling proprietary and sensitive information. The rapid dissemination of the leaked code across platforms like GitHub highlights the challenges in containing such exposures once they occur. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai))
5 months ago
Kill Chain
Google Drive Enhances Security with AI-Powered Ransomware Detection
In April 2026, Google announced the general availability of its AI-powered ransomware detection feature for Google Drive, now enabled by default for all paying users. This feature, initially introduced in beta in September 2025, utilizes advanced AI models to monitor file synchronization activities. Upon detecting ransomware-like behavior, it automatically pauses file syncing, alerts users and IT administrators, and provides detailed instructions for restoring uncorrupted files. This proactive approach aims to minimize the impact of ransomware attacks by safeguarding documents stored in Google Drive and facilitating swift recovery processes. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/?utm_source=openai)) The release of this enhanced security feature underscores the growing threat of ransomware attacks targeting cloud storage services. By integrating AI-driven detection mechanisms, Google addresses the need for robust, automated defenses against increasingly sophisticated cyber threats, highlighting the importance of proactive security measures in protecting organizational data assets.
5 months ago
Kill Chain
Google Chrome's Dawn WebGPU Zero-Day Vulnerability in 2026
In March 2026, Google identified and patched a critical zero-day vulnerability (CVE-2026-5281) in its Chrome browser, marking the fourth such exploit addressed that year. This flaw resided in Dawn, Chrome's implementation of the WebGPU standard, and was actively exploited in the wild. Attackers leveraged this use-after-free vulnerability to cause browser crashes, data corruption, and potentially execute arbitrary code by enticing users to visit maliciously crafted web content. Google promptly released emergency updates for Windows, macOS, and Linux platforms to mitigate the risk. The recurrence of multiple zero-day vulnerabilities within a short timeframe underscores the persistent targeting of widely-used browsers by threat actors. Organizations and individual users are urged to maintain vigilance by promptly applying security updates and adopting robust cybersecurity practices to mitigate the risks associated with such exploits.
5 months ago
Kill Chain
NoVoice Malware: A Wake-Up Call for Android Security
In early 2026, a sophisticated Android malware campaign named 'NoVoice' infiltrated over 50 applications on Google Play, amassing at least 2.3 million downloads. Disguised as legitimate utilities like cleaners, games, and image galleries, these apps functioned as advertised, concealing their malicious intent. Upon installation, the malware exploited known Android vulnerabilities to gain root access, enabling it to inject code into other applications and exfiltrate sensitive data, notably targeting WhatsApp sessions. The malware's persistence mechanisms allowed it to survive standard factory resets, posing a significant threat to user privacy and device integrity. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/novoice-android-malware-on-google-play-infected-23-million-devices/?utm_source=openai)) This incident underscores the evolving sophistication of mobile malware and the critical importance of maintaining up-to-date device security. It highlights the necessity for users to exercise caution when downloading apps, even from trusted sources like Google Play, and for developers to adhere to stringent security practices to prevent such infiltrations.
5 months ago
Kill Chain
Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.
5 months ago
Kill Chain
CrystalX RAT: A New Era of Multifunctional Malware-as-a-Service
In early 2026, a new malware-as-a-service (MaaS) known as CrystalX RAT emerged, offering a comprehensive suite of malicious capabilities including remote access, data theft, keylogging, and clipboard hijacking. Promoted through private Telegram channels and YouTube, CrystalX RAT features a user-friendly control panel and an automated builder tool that supports customization options such as geoblocking and anti-analysis features. Notably, it also includes prankware functionalities designed to disrupt user activities, such as altering display orientation and remapping mouse buttons. The malware's infostealer component targets Chromium-based browsers and desktop applications like Steam, Discord, and Telegram, while its remote access module allows for command execution, file manipulation, and real-time control via VNC. ([securelist.com](https://securelist.com/crystalx-rat-with-prankware-features/119283/?utm_source=openai)) The emergence of CrystalX RAT underscores a growing trend in the cybercriminal ecosystem towards offering multifunctional MaaS platforms that lower the barrier to entry for threat actors. Its combination of traditional malware capabilities with prankware features highlights the evolving nature of cyber threats, emphasizing the need for robust cybersecurity measures and user awareness to mitigate such risks.
5 months ago
Kill Chain
UNC1069's Compromise of Axios npm Package: A 2026 Supply Chain Attack
In late March 2026, the widely used JavaScript library Axios, with approximately 100 million weekly downloads, was compromised in a supply chain attack attributed to the North Korean threat group UNC1069. The attackers gained control of a maintainer's npm account and published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency named 'plain-crypto-js'. This dependency executed a post-installation script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious versions were available for about three hours before removal, but the potential impact is significant due to Axios's extensive use across various projects. ([thehackernews.com](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html?utm_source=openai)) This incident underscores the growing trend of sophisticated supply chain attacks targeting open-source software, emphasizing the need for enhanced security measures in software development and distribution processes. Organizations are urged to audit their dependency trees, implement strict access controls, and monitor for unusual activities to mitigate such risks.
5 months ago
Kill Chain
CrystalX RAT: The 2026 Malware-as-a-Service Blending Espionage and Prankware
In March 2026, cybersecurity researchers identified an active campaign distributing CrystalX RAT, a novel malware offered as Malware-as-a-Service (MaaS) through private Telegram channels. This Remote Access Trojan (RAT) distinguishes itself by combining traditional espionage capabilities—such as spyware, keylogging, and remote control—with stealer functions and unique prankware features designed to disrupt and annoy victims. The malware's control panel allows third-party actors to build customized implants with options like geoblocking, anti-analysis mechanisms, and various malicious functionalities. Initial infection vectors remain unclear, but the campaign has already affected dozens of victims, primarily in Russia, with potential for global spread due to the service's lack of regional restrictions. The ongoing development and active promotion of CrystalX RAT suggest a significant risk of increased infections in the near future.
5 months ago
Kill Chain
Volt Typhoon 2024: A Case Study in Living Off the Land Cyber Attacks
In 2024, the Chinese state-sponsored hacker group known as Volt Typhoon executed a sophisticated Living Off the Land (LOTL) attack targeting critical infrastructure in the United States. By exploiting legitimate system tools and processes, they infiltrated networks without deploying traditional malware, thereby evading standard detection mechanisms. This approach allowed them to conduct prolonged surveillance and data exfiltration, significantly compromising national security and operational integrity. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3669159/combatting-cyber-threat-actors-perpetrating-living-off-the-land-intrusions/?utm_source=openai)) The incident underscores a growing trend among nation-state actors to utilize LOTL techniques, which leverage trusted system utilities to carry out malicious activities. This method not only complicates detection but also challenges traditional cybersecurity defenses, necessitating a shift towards behavior-based monitoring and advanced threat detection strategies.
5 months ago
Kill Chain
Casbaneiro Phishing Campaign Targets Latin America and Europe
In March 2026, a sophisticated phishing campaign orchestrated by the Brazilian cybercrime group Augmented Marauder targeted Spanish-speaking users across Latin America and Europe. The attackers distributed emails with court summons-themed messages containing password-protected PDF attachments. These PDFs directed recipients to malicious links, initiating a multi-stage infection chain that deployed the Horabot malware, which subsequently delivered the Casbaneiro banking trojan. This campaign leveraged dynamic PDF generation and exploited both email and WhatsApp platforms to propagate the malware, resulting in significant financial and data losses for affected organizations. This incident underscores the evolving tactics of cybercriminals who are increasingly using multi-pronged attack vectors and dynamic content to bypass traditional security measures. The use of legitimate communication channels like WhatsApp for malware distribution highlights the need for organizations to implement comprehensive security strategies that address both email and messaging platforms.
5 months ago
Kill Chain
Chrome 2026 Dawn Use-After-Free Vulnerability
In April 2026, Google identified and patched a high-severity zero-day vulnerability, CVE-2026-5281, in its Chrome browser. This use-after-free flaw in Dawn, Chrome's implementation of the WebGPU standard, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to versions 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. ([thehackernews.com](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html?utm_source=openai)) This incident underscores the increasing frequency of zero-day vulnerabilities targeting widely used software. It highlights the critical need for organizations to maintain up-to-date systems and implement robust security measures to mitigate the risks associated with such exploits.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports