Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4901 threat reports
Page 203 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2425–2436 / 4901 reports
Microsoft Edge's Cleartext Password Storage: A Security Wake-Up Call
Financial Services6 months ago

Microsoft Edge's Cleartext Password Storage: A Security Wake-Up Call

In May 2026, security researcher Tom Jøran Sønstebyseter Rønning disclosed that Microsoft Edge decrypts and stores all saved user passwords in cleartext within process memory upon browser launch, retaining them throughout the session. This design allows attackers with administrative privileges to access these credentials, posing significant risks in shared and enterprise environments. Microsoft confirmed this behavior is intentional, stating it is 'by design.' This incident underscores the critical need for organizations to reassess their reliance on browser-based password storage solutions. The exposure of credentials in memory highlights vulnerabilities that can be exploited, emphasizing the importance of adopting dedicated password management tools and implementing robust security policies to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Phishing Campaign April 2026: A Deep Dive into AiTM Credential Theft
Financial Services6 months ago

Microsoft Phishing Campaign April 2026: A Deep Dive into AiTM Credential Theft

In April 2026, Microsoft identified a sophisticated phishing campaign that targeted over 35,000 users across 13,000 organizations in 26 countries, with 92% of the targets located in the United States. The attackers employed code of conduct-themed lures, using polished HTML templates and legitimate email services to enhance credibility. Victims were directed through multiple CAPTCHA and intermediate pages, culminating in adversary-in-the-middle (AiTM) phishing tactics that harvested Microsoft credentials and authentication tokens, effectively bypassing multi-factor authentication (MFA). The campaign primarily targeted sectors such as healthcare, financial services, professional services, and technology. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/?utm_source=openai)) This incident underscores the evolving sophistication of phishing attacks, highlighting the need for organizations to enhance their security measures. The use of legitimate services and advanced techniques like AiTM phishing to bypass MFA indicates a significant escalation in threat actor capabilities, necessitating continuous vigilance and adaptation of security protocols. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical RCE Vulnerability in Weaver E-cology: CVE-2026-22679
Government Administration6 months ago

Critical RCE Vulnerability in Weaver E-cology: CVE-2026-22679

In March 2026, a critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-22679, was discovered in Weaver (Fanwei) E-cology 10.0 versions prior to 20260312. This flaw resides in the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint, allowing attackers to execute arbitrary commands by exploiting exposed debug functionality without authentication. The vulnerability has a CVSS score of 9.8, indicating its severity. ([thehackernews.com](https://thehackernews.com/2026/05/weaver-e-cology-rce-flaw-cve-2026-22679.html?utm_source=openai)) Active exploitation of this vulnerability was first observed on March 31, 2026, with attackers leveraging it to gain full control over affected systems. The exploitation involves crafting POST requests with malicious parameters to invoke command-execution helpers. Organizations using vulnerable versions are urged to update to version 20260312 or later to mitigate this risk. ([thehackernews.com](https://thehackernews.com/2026/05/weaver-e-cology-rce-flaw-cve-2026-22679.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Persistent OAuth Tokens: The Unseen Backdoor in Enterprise Security
Financial Services6 months ago

Persistent OAuth Tokens: The Unseen Backdoor in Enterprise Security

In May 2026, a significant security concern emerged regarding the widespread use of OAuth tokens in enterprise environments. Employees frequently connect AI tools, workflow automations, and productivity applications to platforms like Google and Microsoft, generating persistent OAuth tokens that often lack expiration dates and are not subject to automatic cleanup. This practice creates a substantial security gap, as these tokens can grant attackers unauthorized access without the need for passwords, bypassing traditional security measures such as multi-factor authentication. The inherent design of OAuth, which does not automatically revoke tokens when employees depart or change passwords, exacerbates this vulnerability. The urgency of addressing this issue is underscored by recent incidents where threat actors exploited OAuth tokens to gain unauthorized access to sensitive data. For instance, in August 2025, attackers used compromised OAuth tokens from the Salesloft-Drift integration to access Salesforce environments of over 700 organizations, leading to significant data exfiltration. ([checkred.com](https://checkred.com/resources/blog/when-oauth-tokens-go-rogue-lessons-from-the-salesloft-drift-breach/?utm_source=openai)) These events highlight the critical need for organizations to implement robust monitoring and management of OAuth grants to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
DarkSword Malware: A New Threat to iOS Devices
Government Administration6 months ago

DarkSword Malware: A New Threat to iOS Devices

In March 2026, Google's Threat Intelligence Group (GTIG) identified 'DarkSword,' a sophisticated iOS exploit chain targeting devices running iOS versions 18.4 through 18.7. This exploit leverages six vulnerabilities to achieve full device compromise, deploying malware families such as GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Initially observed in November 2025, DarkSword has been utilized by multiple threat actors, including state-sponsored groups like UNC6353, to target users in countries such as Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit is delivered through malicious or compromised websites, enabling attackers to steal sensitive data and execute unauthorized code on affected devices. ([malwarebytes.com](https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones?utm_source=openai)) The widespread adoption of DarkSword by various threat actors underscores a significant shift in the cyber threat landscape, highlighting the increasing accessibility and deployment of advanced mobile exploits. This incident emphasizes the critical importance of timely software updates and robust security practices to mitigate emerging threats. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-darksword-ios-fullchain-zeroday-multiactor/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Alerts on Active Exploitation of 'Copy Fail' Linux Vulnerability (CVE-2026-31431)
Government Administration6 months ago

CISA Alerts on Active Exploitation of 'Copy Fail' Linux Vulnerability (CVE-2026-31431)

In late April 2026, a critical vulnerability known as 'Copy Fail' (CVE-2026-31431) was disclosed, affecting Linux kernels released since 2017. This flaw resides in the algif_aead cryptographic interface, allowing unprivileged local users to escalate privileges to root by writing controlled bytes to the page cache of any readable file. Theori researchers released a proof-of-concept exploit demonstrating the vulnerability's reliability across major distributions, including Ubuntu, Amazon Linux, RHEL, and SUSE. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching to mitigate active exploitation risks. The rapid public disclosure and availability of a reliable exploit underscore the urgency for organizations to update their systems promptly. Given the widespread use of affected Linux distributions in enterprise and cloud environments, unpatched systems are at significant risk of compromise, potentially leading to unauthorized access and control over critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Authentication Bypass Vulnerability in MOVEit Automation: CVE-2026-4670
Financial Services6 months ago

Critical Authentication Bypass Vulnerability in MOVEit Automation: CVE-2026-4670

In April 2026, Progress Software disclosed a critical authentication bypass vulnerability (CVE-2026-4670) in its MOVEit Automation managed file transfer application. This flaw allows unauthenticated remote attackers to gain unauthorized access to affected systems without user interaction. The vulnerability impacts MOVEit Automation versions prior to 2025.1.5, 2025.0.9, and 2024.1.8. Exploitation could lead to unauthorized access, administrative control, and potential data exposure. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670/?utm_source=openai)) Given the widespread use of MOVEit Automation in enterprise environments, this vulnerability poses a significant risk. Organizations are urged to upgrade to the latest patched versions immediately to mitigate potential exploitation. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
PyTorch Lightning Supply Chain Attack: A Wake-Up Call for Developers
Computer Software/Engineering6 months ago

PyTorch Lightning Supply Chain Attack: A Wake-Up Call for Developers

In April 2026, versions 2.6.2 and 2.6.3 of the PyTorch Lightning package were compromised and published on the Python Package Index (PyPI). These versions contained malicious code that, upon import, initiated a background process to download and execute an obfuscated JavaScript payload. This payload targeted sensitive information, including environment files, API keys, GitHub tokens, and credentials stored in browsers such as Chrome, Firefox, and Brave. Additionally, it interacted with cloud service APIs (AWS, Azure, GCP) to exfiltrate credentials and had the capability to execute arbitrary system commands. This incident underscores the escalating threat of supply chain attacks in the software development ecosystem. The compromise of widely-used packages like PyTorch Lightning highlights the need for enhanced vigilance and robust security measures in managing software dependencies to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Fraudsters Exploit Credit Union Verification Processes in 2026
Banking/Mortgage6 months ago

Fraudsters Exploit Credit Union Verification Processes in 2026

In May 2026, cybersecurity researchers uncovered a sophisticated fraud scheme targeting small to mid-sized credit unions. Threat actors utilized stolen personal data to impersonate legitimate borrowers, navigating through credit checks and identity verification processes without triggering security alerts. This methodical approach exploited perceived weaknesses in the verification systems of smaller financial institutions, leading to unauthorized loan approvals and significant financial losses. This incident underscores a growing trend where cybercriminals focus on process exploitation rather than technical vulnerabilities. The increasing availability of personal data on underground forums, combined with advanced social engineering tactics, poses a heightened risk to financial institutions, especially those with limited fraud prevention resources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Weaver E-cology CVE-2026-22679 Exploitation: A Critical Security Alert
Information Technology/IT6 months ago

Weaver E-cology CVE-2026-22679 Exploitation: A Critical Security Alert

In mid-March 2026, attackers began exploiting CVE-2026-22679, a critical unauthenticated remote code execution vulnerability in Weaver E-cology 10.0, an enterprise office automation platform. The flaw resides in an exposed debug API endpoint that allows user-supplied parameters to reach backend Remote Procedure Call (RPC) functionality without authentication or input validation. This enables attackers to execute arbitrary system commands on the server. The attacks commenced five days after the vendor released a security update on March 12, 2026, and two weeks before the vulnerability was publicly disclosed. The exploitation involved multiple phases, including initial reconnaissance through ping commands, attempts to deploy PowerShell-based payloads, and the use of obfuscated, fileless PowerShell scripts to fetch remote scripts. Despite these efforts, the attackers did not establish a persistent session on the targeted hosts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Rising Threat: Amazon SES Phishing Abuse in 2026
Financial Services6 months ago

Rising Threat: Amazon SES Phishing Abuse in 2026

In May 2026, cybersecurity researchers identified a significant increase in phishing campaigns exploiting Amazon Simple Email Service (SES). Attackers leveraged exposed AWS Identity and Access Management (IAM) access keys, often found in public GitHub repositories, .ENV files, Docker images, and publicly accessible S3 buckets, to send convincing phishing emails that bypass standard security filters. These emails, appearing to originate from trusted sources, included fake document-signing notifications and sophisticated business email compromise (BEC) attacks, leading to unauthorized access and financial losses. This trend underscores the critical need for organizations to implement stringent security measures, such as enforcing least-privilege IAM policies, enabling multi-factor authentication, regularly rotating access keys, and applying IP-based access restrictions. The rise in such attacks highlights the evolving tactics of cybercriminals and the importance of proactive defense strategies to protect sensitive information and maintain trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Progress Software Patches Critical MOVEit Automation Vulnerabilities
Financial Services6 months ago

Progress Software Patches Critical MOVEit Automation Vulnerabilities

In April 2026, Progress Software identified and patched two critical vulnerabilities in MOVEit Automation, a managed file transfer solution widely used in enterprise environments. The most severe, CVE-2026-4670, is an authentication bypass flaw with a CVSS score of 9.8, allowing unauthenticated remote attackers to gain unauthorized access. The second, CVE-2026-5174, involves improper input validation that could lead to privilege escalation. Exploitation of these vulnerabilities could result in unauthorized access, administrative control, and potential data exposure. ([thehackernews.com](https://thehackernews.com/2026/05/progress-patches-critical-moveit.html?utm_source=openai)) This incident underscores the persistent threat posed by vulnerabilities in widely deployed enterprise software. Organizations are reminded of the importance of timely patch management and vigilant monitoring to mitigate risks associated with such critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports