Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 224 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2677–2688 / 4903 reports
Anthropic's Claude Mythos Preview: A Game-Changer in AI-Driven Cybersecurity
Computer Software/Engineering6 months ago

Anthropic's Claude Mythos Preview: A Game-Changer in AI-Driven Cybersecurity

In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying thousands of zero-day vulnerabilities across major operating systems and web browsers. This model discovered critical flaws, some existing for decades, and demonstrated the ability to chain multiple vulnerabilities into sophisticated exploits. Due to its potential for misuse, Anthropic restricted access to select organizations under Project Glasswing, aiming to bolster defensive cybersecurity measures. The emergence of AI models like Claude Mythos Preview signifies a paradigm shift in cybersecurity, where AI can both uncover and potentially exploit vulnerabilities at an unprecedented scale. This development underscores the urgency for organizations to adopt continuous, AI-augmented security testing and to reassess their remediation strategies to keep pace with rapidly evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Black Basta Affiliates Resurface with Targeted Social Engineering Attacks in 2026
Manufacturing6 months ago

Black Basta Affiliates Resurface with Targeted Social Engineering Attacks in 2026

In April 2026, a group of former Black Basta affiliates initiated a sophisticated social engineering campaign targeting over 100 employees across multiple organizations. The attackers employed mass email bombing and impersonated IT support via Microsoft Teams to gain unauthorized access to networks, aiming for data theft, ransomware deployment, and extortion. Notably, approximately 75% of the targets were senior executives, directors, and managers, indicating a strategic focus on high-privilege accounts. ([cyberscoop.com](https://cyberscoop.com/black-basta-affiliates-senior-executives-reliaquest/?utm_source=openai)) This resurgence underscores the persistent threat posed by disbanded cybercriminal groups reassembling or reusing effective tactics. The campaign's rapid execution and automation highlight the evolving sophistication of social engineering attacks, emphasizing the need for organizations to bolster their cybersecurity defenses and employee awareness programs. ([cyberscoop.com](https://cyberscoop.com/black-basta-affiliates-senior-executives-reliaquest/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's April 2026 Patch Tuesday: A Critical Security Update
Information Technology/IT6 months ago

Microsoft's April 2026 Patch Tuesday: A Critical Security Update

In April 2026, Microsoft released a substantial Patch Tuesday update addressing 165 vulnerabilities across its product suite, marking the second-largest patch release in the company's history. Notably, this update included a zero-day vulnerability in Microsoft Office SharePoint (CVE-2026-32201) that was actively exploited, allowing unauthenticated attackers to perform spoofing over a network. Additionally, a high-severity vulnerability in Microsoft Defender (CVE-2026-33825) was publicly disclosed prior to patching, potentially enabling unauthorized privilege escalation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-april-2026/?utm_source=openai)) The scale and severity of this update underscore the increasing complexity and volume of security threats facing organizations. The active exploitation of SharePoint and the public disclosure of the Defender vulnerability highlight the critical need for timely patch management and proactive security measures to mitigate potential breaches and data compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Windows 11 April 2026 Security Update: Critical Fixes and Enhancements
Government Administration6 months ago

Windows 11 April 2026 Security Update: Critical Fixes and Enhancements

In April 2026, Microsoft released cumulative updates KB5083769 and KB5082052 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These mandatory updates addressed 165 security vulnerabilities, including one actively exploited zero-day in Microsoft SharePoint Server (CVE-2026-32201) and one publicly disclosed zero-day in Microsoft Defender (CVE-2026-33825). The updates also introduced enhancements such as the ability to toggle Smart App Control without a clean install, improved Narrator features, and refined Settings app design. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/windows-11-cumulative-updates-kb5083769-and-kb5082052-released/amp/?utm_source=openai)) The release underscores the critical importance of timely patch management, as threat actors increasingly exploit known vulnerabilities shortly after disclosure. Organizations are urged to apply these updates promptly to mitigate potential risks associated with these vulnerabilities. ([crowdstrike.com](https://www.crowdstrike.com/content/crowdstrike-www/locale-sites/us/en-us/blog/patch-tuesday-analysis-april-2026.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fake Ledger Live App on Apple App Store Leads to $9.5M Crypto Theft
Banking/Mortgage6 months ago

Fake Ledger Live App on Apple App Store Leads to $9.5M Crypto Theft

In April 2026, a counterfeit version of the Ledger Live app was discovered on Apple's Mac App Store, leading to the theft of approximately $9.5 million in cryptocurrency from over 50 users. The malicious app, submitted under the developer name 'Leva Heal Limited,' deceived users into entering their seed phrases, granting attackers full access to their wallets. The stolen funds were laundered through more than 150 deposit addresses on KuCoin, linked to a centralized mixing service called 'AudiA6.' Apple has since removed the fraudulent app from the App Store. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/?utm_source=openai)) This incident underscores the persistent threat of sophisticated phishing attacks targeting cryptocurrency users. It highlights the critical need for vigilance when downloading financial applications, even from official app stores, and the importance of never sharing seed phrases or recovery keys.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Kraken Faces Insider Threat and Extortion Attempt in 2026
Financial Services6 months ago

Kraken Faces Insider Threat and Extortion Attempt in 2026

In April 2026, Kraken, a leading cryptocurrency exchange, disclosed two incidents where support staff improperly accessed internal systems, exposing limited client support data. Approximately 2,000 accounts, representing 0.02% of Kraken's user base, were affected. Following these incidents, a criminal group attempted to extort Kraken by threatening to release videos showcasing the internal systems with client data. Kraken confirmed that no core systems were breached, client funds remained secure, and the company refused to comply with the extortion demands. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/crypto-exchange-kraken-extorted-by-hackers-after-insider-breach/?utm_source=openai)) This incident underscores the persistent threat of insider access within organizations, particularly in the cryptocurrency sector. It highlights the importance of robust internal controls, employee monitoring, and rapid response mechanisms to mitigate insider threats and protect sensitive client information.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft Bolsters RDP Security to Thwart Phishing Threats
Financial Services6 months ago

Microsoft Bolsters RDP Security to Thwart Phishing Threats

In April 2026, Microsoft released security updates for Windows 10 and Windows 11 to enhance protections against phishing attacks exploiting Remote Desktop Protocol (RDP) files. These updates introduce new security warnings and disable risky shared resources by default when opening RDP files, aiming to prevent unauthorized access and data theft facilitated through malicious RDP configurations. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai)) This initiative addresses the increasing abuse of RDP files in phishing campaigns, where attackers use them to gain control over victims' systems and access sensitive information. By implementing these protections, Microsoft aims to mitigate the risks associated with such attacks and enhance overall system security. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Command Injection Vulnerabilities Discovered in PHP Composer's Perforce Driver
Computer Software/Engineering6 months ago

Critical Command Injection Vulnerabilities Discovered in PHP Composer's Perforce Driver

In April 2026, two critical command injection vulnerabilities were identified in PHP's Composer package manager, specifically within its Perforce VCS driver. These flaws, designated as CVE-2026-40176 and CVE-2026-40261, allowed attackers to execute arbitrary commands on systems running vulnerable versions of Composer. The vulnerabilities stemmed from improper input validation and insufficient escaping of user-supplied parameters, enabling command execution in the context of the user running Composer. Immediate patches were released in versions 2.9.6 and 2.2.27 to address these issues. This incident underscores the persistent risks associated with software supply chains, particularly in widely-used development tools. It highlights the necessity for developers to remain vigilant, promptly apply security updates, and scrutinize third-party dependencies to mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Adobe Acrobat Reader Zero-Day Exploit CVE-2026-34621: What You Need to Know
Financial Services6 months ago

Adobe Acrobat Reader Zero-Day Exploit CVE-2026-34621: What You Need to Know

In April 2026, Adobe addressed a critical zero-day vulnerability (CVE-2026-34621) in Acrobat Reader, which had been actively exploited since at least December 2025. This flaw allowed attackers to execute arbitrary code on both Windows and macOS systems when users opened maliciously crafted PDF files. The vulnerability stemmed from a prototype pollution issue, enabling unauthorized code execution within the context of the current user. ([techcrunch.com](https://techcrunch.com/2026/04/14/adobe-fixes-pdf-zero-day-security-bug-that-hackers-have-exploited-for-months/?utm_source=openai)) The exploitation of this vulnerability highlights the persistent targeting of widely used software by threat actors. Organizations are urged to prioritize timely patching and to educate users on the risks associated with opening files from untrusted sources to mitigate similar threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
Computer Software/Engineering6 months ago

Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity

In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led Anthropic to restrict public access to Mythos, collaborating instead with select organizations under Project Glasswing to address these vulnerabilities responsibly. The model's proficiency in discovering long-standing flaws, including a 27-year-old bug in OpenBSD, underscores the transformative impact of AI in cybersecurity. The emergence of AI models like Claude Mythos signifies a paradigm shift in vulnerability management, compressing the timeline from discovery to exploitation. This development necessitates immediate adaptation by security teams to enhance their defensive strategies and operational models to keep pace with rapidly evolving AI-driven threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Highlights Active Exploitation of Vulnerabilities in Fortinet, Microsoft, and Adobe Products
Financial Services6 months ago

CISA Highlights Active Exploitation of Vulnerabilities in Fortinet, Microsoft, and Adobe Products

On April 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities affect Fortinet FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, and Microsoft Visual Basic for Applications. Notably, CVE-2026-21643, an SQL injection vulnerability in Fortinet FortiClient EMS, has been actively exploited since March 24, 2026. Additionally, Microsoft reports that threat actor Storm-1175 has been leveraging CVE-2023-21529 in Exchange Server to deliver Medusa ransomware. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-6-known-exploited-flaws-in.html?utm_source=openai)) The inclusion of these vulnerabilities underscores the persistent threat posed by both newly discovered and older security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate potential risks, as unpatched systems remain prime targets for cyber adversaries. ([bytevanguard.com](https://bytevanguard.com/2026/04/14/cisa-kev-update-from-a-2012-bug-to-2026-flaws/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShowDoc 2025 Remote Code Execution Vulnerability
Information Technology/IT6 months ago

ShowDoc 2025 Remote Code Execution Vulnerability

In April 2025, a critical vulnerability (CVE-2025-0520) was identified in ShowDoc, a widely used documentation management tool. This flaw, present in versions prior to 2.8.7, allowed attackers to upload and execute arbitrary PHP files due to improper validation of file extensions, leading to remote code execution. Despite the release of a patch in October 2020, many instances remained unpatched, resulting in active exploitation by threat actors. ([thehackernews.com](https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html?utm_source=openai)) The exploitation of this vulnerability underscores the persistent risk posed by unpatched software. Organizations are urged to promptly apply security updates to mitigate such threats and protect sensitive data from unauthorized access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports