Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4895 threat reports
Page 198 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2365–2376 / 4895 reports
CISA Adds CVE-2026-6973 to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds CVE-2026-6973 to Known Exploited Vulnerabilities Catalog

On May 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities (KEV) catalog. This high-severity vulnerability affects Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1, allowing authenticated users with administrative privileges to execute arbitrary code remotely. Ivanti has released patches to address this issue and urges organizations to update their systems promptly. ([redpacketsecurity.com](https://www.redpacketsecurity.com/cve-alert-cve-2026-6973-ivanti-endpoint-manager-mobile/?utm_source=openai)) The inclusion of CVE-2026-6973 in the KEV catalog underscores the ongoing threat posed by vulnerabilities in widely used enterprise management tools. Organizations are advised to prioritize the remediation of such vulnerabilities to mitigate potential risks to their networks and data. ([cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical RCE Vulnerabilities in Microsoft's Semantic Kernel SDK
Computer Software/Engineering6 months ago

Critical RCE Vulnerabilities in Microsoft's Semantic Kernel SDK

In May 2026, Microsoft disclosed critical vulnerabilities in its Semantic Kernel SDK, specifically CVE-2026-26030 and CVE-2026-25592. These flaws allowed remote code execution and arbitrary file writes through AI agent frameworks, posing significant security risks. Attackers could exploit these vulnerabilities to execute unauthorized code and manipulate file systems, potentially leading to full system compromise. The vulnerabilities were promptly addressed in subsequent updates, with Microsoft releasing patches to mitigate the risks. Organizations utilizing the Semantic Kernel SDK were urged to update to the latest versions to protect their systems from potential exploitation. This incident underscores the evolving threat landscape in AI and machine learning applications, highlighting the need for continuous vigilance and proactive security measures in the development and deployment of AI agents. As AI technologies become more integrated into critical systems, ensuring their security is paramount to prevent potential breaches and maintain trust in these advanced solutions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Dirty Frag: Unpatched Linux Vulnerability Grants Root Access
Information Technology/IT6 months ago

Dirty Frag: Unpatched Linux Vulnerability Grants Root Access

On May 7, 2026, a critical Linux kernel vulnerability known as 'Dirty Frag' was publicly disclosed. This flaw allows unprivileged local users to escalate their privileges to root across major Linux distributions, including Ubuntu, RHEL, Fedora, and others. Discovered by security researcher Hyunwoo Kim, Dirty Frag exploits two distinct vulnerabilities within the IPsec ESP and RxRPC modules, enabling attackers to modify read-only files in the page cache, leading to full system compromise. The premature disclosure occurred before patches were available, leaving systems vulnerable without immediate remediation options. The urgency of addressing Dirty Frag is heightened by its similarity to the recently disclosed 'Copy Fail' vulnerability (CVE-2026-31431), which also facilitates local privilege escalation. The public availability of exploit code for both vulnerabilities increases the risk of widespread exploitation. Organizations must prioritize mitigating these vulnerabilities to prevent potential system compromises and data breaches.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CallPhantom Scam: Deceptive Android Apps Exploit User Curiosity
Telecommunications6 months ago

CallPhantom Scam: Deceptive Android Apps Exploit User Curiosity

In November 2025, ESET researchers identified a series of fraudulent Android applications, collectively named 'CallPhantom,' on the Google Play Store. These 28 apps falsely claimed to provide access to call logs, SMS records, and WhatsApp call histories for any phone number. Users were prompted to pay for these services but received only randomly generated, fabricated data. The apps amassed over 7.3 million downloads before being reported to Google and subsequently removed from the store. This incident underscores the persistent threat of deceptive applications exploiting user curiosity and trust. The CallPhantom scam highlights the need for continuous vigilance against fraudulent apps, especially as cybercriminals increasingly target mobile platforms. Users should be cautious of apps requesting payments for services that seem too good to be true and verify the legitimacy of applications before installation.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding the Impact of Recent SSRF Vulnerabilities in MCP Servers
Computer Software/Engineering6 months ago

Understanding the Impact of Recent SSRF Vulnerabilities in MCP Servers

In early 2026, critical vulnerabilities were discovered in MCP servers, notably in Atlassian's mcp-atlassian and Microsoft's MarkItDown. These vulnerabilities, including CVE-2026-27826, allowed unauthenticated attackers to exploit Server-Side Request Forgery (SSRF) flaws, potentially leading to remote code execution and unauthorized access to internal resources. The mcp-atlassian vulnerability stemmed from unvalidated custom HTTP headers, while MarkItDown's flaw involved improper URL validation, enabling access to cloud metadata services. ([pluto.security](https://pluto.security/blog/mcpwnfluence-cve-2026-27825-critical/?utm_source=openai)) These incidents underscore the persistent threat posed by SSRF vulnerabilities in widely used platforms. As organizations increasingly integrate MCP servers into their infrastructure, ensuring robust input validation and implementing strict access controls are imperative to prevent similar exploits and safeguard sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Ivanti EPMM Zero-Day CVE-2026-6973 Exploited in the Wild
Government Administration6 months ago

Critical Ivanti EPMM Zero-Day CVE-2026-6973 Exploited in the Wild

In May 2026, Ivanti disclosed a critical zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw allows authenticated users with administrative privileges to execute remote code, potentially compromising the entire mobile device management infrastructure. The vulnerability has been actively exploited in the wild, with Ivanti confirming limited instances of exploitation. To mitigate this risk, Ivanti released patches for EPMM versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, urging all on-premises EPMM customers to apply these updates immediately. ([thehackernews.com](https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html?utm_source=openai)) This incident underscores the persistent targeting of mobile device management systems by threat actors, highlighting the critical need for organizations to maintain up-to-date security measures and promptly apply vendor-released patches to protect sensitive data and infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Claude Chrome Extension Exposes User Data
Computer Software/Engineering6 months ago

Critical Vulnerability in Claude Chrome Extension Exposes User Data

In May 2026, a critical vulnerability was discovered in Anthropic's Claude AI Chrome extension, allowing any installed browser plugin to issue commands to the AI without user consent. This flaw enabled unauthorized actions such as accessing and exfiltrating sensitive data from Google Drive and GitHub repositories, effectively bypassing Chrome's extension security model. The vulnerability was reported to Anthropic on April 27, 2026, and a partial fix was released on May 6, 2026. However, researchers noted that the fix did not fully mitigate the issue, leaving some attack vectors open. This incident underscores the growing security challenges associated with integrating AI agents into web browsers, highlighting the need for robust security measures to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
Health Care / Life Sciences6 months ago

Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation

In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Fake Claude AI Website Distributes Beagle Windows Malware
Computer Software/Engineering6 months ago

Fake Claude AI Website Distributes Beagle Windows Malware

In May 2026, a fraudulent website mimicking the legitimate Claude AI platform offered a malicious download named 'Claude-Pro Relay,' which installed a previously undocumented Windows backdoor called 'Beagle.' The attackers advertised this software as a high-performance relay service for Claude-Code developers. Upon execution, the installer added files to the Startup folder, enabling persistent remote access through the Beagle backdoor, which supports commands like executing system commands, file manipulation, and directory operations. The campaign utilized DLL sideloading techniques involving a signed G Data updater to deploy the malware, with command-and-control communications secured via AES encryption over TCP and UDP protocols. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/amp/?utm_source=openai)) This incident underscores the growing trend of cybercriminals exploiting the popularity of AI platforms to distribute malware. The use of sophisticated techniques such as DLL sideloading and encrypted communications highlights the evolving nature of threats targeting both individual users and organizations. Vigilance in verifying software sources and monitoring for unusual system behavior remains crucial in mitigating such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)
Financial Services6 months ago

State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)

In early April 2026, Palo Alto Networks identified a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of its PAN-OS software, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. Exploitation attempts began on April 9, with successful breaches occurring a week later. Attackers deployed tools like Earthworm and ReverseSocks5 to establish covert communications and bypass network defenses. This incident underscores a growing trend of state-sponsored actors targeting network edge devices, which often lack comprehensive logging and security measures. Organizations are urged to implement robust access controls and promptly apply security patches to mitigate such vulnerabilities. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Crypto Gang Member Sentenced for $250M Heist Involving Physical Burglaries
Financial Services6 months ago

Crypto Gang Member Sentenced for $250M Heist Involving Physical Burglaries

Between late 2023 and early 2025, a criminal network orchestrated a sophisticated scheme combining social engineering, hacking, and physical burglaries to steal over $250 million in cryptocurrency from victims across the United States. When digital methods failed, the group relied on Marlon Ferro, known online as 'GothFerrari,' to physically break into victims' homes and steal hardware wallets containing substantial digital assets. Ferro's actions included a February 2024 burglary in Texas, where he stole a wallet with approximately 100 Bitcoins, then valued at over $5 million. In May 2026, Ferro was sentenced to 78 months in federal prison, ordered to pay $2.5 million in restitution, and serve three years of supervised release. This case underscores the evolving tactics of cybercriminals who blend online fraud with traditional burglary to exploit vulnerabilities in digital asset security. It highlights the critical need for robust security measures, including physical safeguards for hardware wallets, to protect against such multifaceted threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Americans Sentenced for Operating 'Laptop Farms' Aiding North Korean IT Workers
Information Technology/IT6 months ago

Americans Sentenced for Operating 'Laptop Farms' Aiding North Korean IT Workers

In May 2026, U.S. nationals Matthew Isaac Knoot and Erick Ntekereze Prince were each sentenced to 18 months in prison for operating 'laptop farms' that enabled North Korean IT workers to fraudulently secure remote employment at nearly 70 American companies. Knoot managed a laptop farm from his Nashville residence between July 2022 and August 2023, facilitating over $250,000 in payments to North Korean workers. Prince, through his company Taggcar Inc., assisted at least three North Korean IT workers in obtaining remote positions from June 2020 to August 2024, resulting in more than $943,000 in salaries, with the majority routed overseas. The schemes caused significant financial and security repercussions for the victim companies, including over $1.5 million in remediation costs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/americans-sentenced-for-running-laptop-farms-for-north-korea/?utm_source=openai)) This incident underscores the persistent threat posed by North Korean cyber operations, which exploit remote work opportunities to infiltrate Western companies. The use of 'laptop farms' highlights the evolving tactics employed to circumvent security measures, emphasizing the need for robust identity verification and cybersecurity protocols in remote hiring processes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports