Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 225 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2689–2700 / 4903 reports
Massive Data Breach: 108 Malicious Chrome Extensions Compromise 20,000 Users
Financial Services6 months ago

Massive Data Breach: 108 Malicious Chrome Extensions Compromise 20,000 Users

In April 2026, cybersecurity researchers uncovered a coordinated campaign involving 108 malicious Google Chrome extensions that compromised approximately 20,000 users. These extensions, published under five fake identities, masqueraded as legitimate tools such as games, translation utilities, and YouTube enhancers. Once installed, they exfiltrated sensitive data, including Google account credentials and Telegram session tokens, to a centralized command-and-control server. Some extensions injected ads and arbitrary JavaScript code into web pages, while others stripped security headers from sites like YouTube and TikTok to facilitate further exploitation. ([gizchina.com](https://www.gizchina.com/malicious-apps/108-fake-chrome-extensions-were-stealing-your-google-and-telegram-data-remove-them-now/?utm_source=openai)) This incident underscores the persistent threat posed by malicious browser extensions and highlights the need for vigilant scrutiny of third-party add-ons. The attackers' ability to infiltrate the official Chrome Web Store and maintain their presence for an extended period raises concerns about the effectiveness of current security measures in detecting and preventing such threats. ([cybernews.com](https://cybernews.com/security/chrome-extensions-flagged-for-stealing-user-data/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mirax Android RAT: A New Era of Mobile Malware Threats
Banking/Mortgage6 months ago

Mirax Android RAT: A New Era of Mobile Malware Threats

In April 2026, a sophisticated Android remote access trojan (RAT) named Mirax was identified targeting Spanish-speaking countries. Distributed through Meta advertisements, Mirax infected over 220,000 devices by masquerading as legitimate streaming applications. Once installed, it granted attackers full control over compromised devices, enabling real-time interaction, keystroke logging, and the deployment of dynamic overlays to steal sensitive information. Notably, Mirax transformed infected devices into residential proxy nodes using the SOCKS5 protocol, allowing cybercriminals to route malicious traffic through victims' IP addresses, thereby evading detection systems and facilitating fraudulent activities. This incident underscores a concerning evolution in mobile malware, where traditional RAT functionalities are augmented with proxy capabilities, expanding the operational scope of cybercriminals. The use of social media platforms for widespread distribution highlights the need for enhanced vigilance and security measures among users and organizations to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
Government Administration6 months ago

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

On April 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding seven new vulnerabilities, including issues in Microsoft Visual Basic for Applications, Adobe Acrobat, Microsoft Exchange Server, and Fortinet products. These vulnerabilities have been actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified deadlines to protect against active threats. Although BOD 22-01 applies specifically to FCEB agencies, CISA strongly urges all organizations to prioritize timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practices. This proactive approach is essential to reduce exposure to cyberattacks and safeguard organizational networks against known exploited vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
OpenSSF Tech Talk Recap: Securing Agentic AI
Financial Services6 months ago

OpenSSF Tech Talk Recap: Securing Agentic AI

On April 8, 2026, the Open Source Security Foundation (OpenSSF) hosted a Tech Talk titled 'Securing Agentic AI,' addressing the unique security challenges posed by non-deterministic AI agents. Experts from Microsoft, Thread AI, Canonical, and the OpenSSF AI/ML Security Working Group discussed issues such as agent autonomy, tool-model trust, and context integrity. They introduced SAFE-MCP, a threat catalog inspired by the MITRE ATT&CK framework, detailing over 80 attack techniques targeting tool-based Large Language Models (LLMs). The session also emphasized the importance of securing the entire AI infrastructure stack, from user interfaces to hardware, highlighting the critical role of open source in each layer. ([openssf.org](https://openssf.org/blog/2026/04/08/openssf-tech-talk-recap-securing-agentic-ai/?utm_source=openai)) The relevance of this discussion is underscored by recent developments in AI security. For instance, Anthropic's AI model, Claude Mythos, identified thousands of zero-day vulnerabilities across major operating systems and web browsers, some unpatched for decades. This highlights the pressing need for robust security measures in AI systems to prevent potential exploitation. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Oracle WebLogic Server 2026 Authentication Bypass Vulnerability: What You Need to Know
Financial Services6 months ago

Oracle WebLogic Server 2026 Authentication Bypass Vulnerability: What You Need to Know

In January 2026, a critical vulnerability (CVE-2026-21962) was identified in Oracle's WebLogic Server Proxy Plug-in, affecting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. This flaw allows unauthenticated attackers with network access via HTTP to bypass authentication mechanisms, potentially leading to unauthorized access and modification of critical data. The vulnerability has a CVSS score of 10.0, indicating its severity and the urgency for remediation. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21962?utm_source=openai)) The exploitation of this vulnerability underscores the increasing sophistication of cyber threats targeting middleware components. Organizations relying on Oracle's WebLogic Server are urged to apply the latest patches promptly to mitigate potential risks associated with this authentication bypass flaw.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Driven Cybercrime Surge in 2026: A New Era of Threats
Financial Services6 months ago

AI-Driven Cybercrime Surge in 2026: A New Era of Threats

In 2026, the cybersecurity landscape witnessed a significant transformation with the emergence of AI-driven cybercrime. Threat actors leveraged artificial intelligence to automate and scale their attacks, resulting in a 1,500% surge in AI-enabled cyber incidents. These sophisticated attacks encompassed credential theft, ransomware, and identity-based intrusions, causing substantial harm to individuals and organizations worldwide. The rapid adoption of AI by cybercriminals enabled them to exploit vulnerabilities at unprecedented speeds, often within hours of disclosure, and to conduct large-scale, coordinated attacks with minimal human intervention. ([oecd.ai](https://oecd.ai/en/incidents/2026-03-11-3607?utm_source=openai)) This escalation underscores the urgent need for organizations to reassess their cybersecurity strategies. Traditional defense mechanisms are increasingly inadequate against AI-enhanced threats. The convergence of AI, automation, and cybercrime necessitates a proactive approach, emphasizing real-time threat intelligence, advanced detection systems, and robust incident response capabilities to mitigate the evolving risks posed by AI-driven cyberattacks. ([techradar.com](https://www.techradar.com/pro/security/in-2026-cybercrime-has-reached-a-point-of-total-convergence-new-research-claims-ai-attacks-are-taking-over-so-how-can-your-business-stay-safe?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Anthropic's Claude Mythos Preview: A Game-Changer in Cybersecurity
Computer Software/Engineering6 months ago

Anthropic's Claude Mythos Preview: A Game-Changer in Cybersecurity

In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos Preview, capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the launch of Project Glasswing, a collaborative initiative with tech giants like Amazon, Apple, and Microsoft, aiming to secure critical software infrastructure. Due to the model's potential for misuse, Anthropic restricted its access to select organizations, emphasizing the need for responsible deployment of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/project/glasswing?utm_source=openai)) The emergence of AI models like Claude Mythos Preview signifies a paradigm shift in cybersecurity, where AI can both uncover and exploit vulnerabilities at an unprecedented scale. This development underscores the urgency for the cybersecurity industry to adapt, emphasizing proactive defense strategies and collaborative efforts to mitigate potential threats posed by advanced AI capabilities. ([red.anthropic.com](https://red.anthropic.com/2026/mythos-preview/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Claude Mythos: A New Era of AI-Driven Cybersecurity Threats
Computer Software/Engineering6 months ago

Claude Mythos: A New Era of AI-Driven Cybersecurity Threats

In early 2026, Anthropic's AI model, Claude Mythos, demonstrated unprecedented capabilities in autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. This advancement significantly reduces the time between vulnerability disclosure and exploitation, posing a substantial challenge to traditional cybersecurity defenses. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades?utm_source=openai)) The emergence of AI-driven tools like Claude Mythos signifies a paradigm shift in cyber threats, enabling attackers to automate complex exploits and outpace defenders. Organizations must urgently adapt their security strategies to address these rapidly evolving AI-enhanced threats. ([axios.com](https://www.axios.com/2026/04/10/anthropic-mythos-openai-cyber-threats?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Storm Infostealer 2026: A New Era of Cyber Threats
Financial Services7 months ago

Storm Infostealer 2026: A New Era of Cyber Threats

In early 2026, a new infostealer malware named 'Storm' emerged, enabling attackers to bypass traditional security measures by exfiltrating encrypted browser data to remote servers for decryption. This method allows the malware to harvest sensitive information such as saved passwords, session cookies, and cryptocurrency wallets without triggering endpoint security alerts. Storm's capabilities extend to automating session hijacking, granting attackers authenticated access to various platforms without the need for passwords or multi-factor authentication. The malware is offered as a subscription service, with packages starting at $300 for a 7-day demo and up to $1,800 for a full team license supporting 100 operators. Notably, data exfiltration continues even after subscriptions expire. The emergence of such turnkey hacking tools underscores the growing accessibility of sophisticated cyberattacks, posing serious risks to organizations relying solely on basic endpoint protections. Advanced behavioral and network analytics are essential for detecting such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Adobe Acrobat Reader Zero-Day CVE-2026-34621: A Critical Security Alert
Oil/Energy/Solar/Greentech7 months ago

Adobe Acrobat Reader Zero-Day CVE-2026-34621: A Critical Security Alert

In April 2026, Adobe released an emergency security update to address a critical zero-day vulnerability (CVE-2026-34621) in Acrobat Reader, which had been actively exploited since at least December 2025. This flaw allowed attackers to craft malicious PDF files that, when opened, could bypass sandbox restrictions and invoke privileged JavaScript APIs, leading to arbitrary code execution. The exploit enabled reading and exfiltrating arbitrary files without additional user interaction beyond opening the PDF. The incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. Organizations are reminded to maintain robust patch management practices and exercise caution when handling unsolicited documents to mitigate similar risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OpenAI's 2026 Supply Chain Attack: Lessons in Software Security
Computer Software/Engineering7 months ago

OpenAI's 2026 Supply Chain Attack: Lessons in Software Security

In March 2026, OpenAI's macOS code-signing workflow was compromised due to a supply chain attack involving the widely used JavaScript library, Axios. The attackers, identified as the North Korean threat group UNC1069, gained access to the Axios maintainer's account and published malicious versions of the package. These versions were inadvertently incorporated into OpenAI's GitHub Actions workflow, potentially exposing code-signing certificates used for macOS applications such as ChatGPT Desktop, Codex, Codex CLI, and Atlas. Although OpenAI's investigation found no evidence of certificate misuse or compromise of user data, the company proactively revoked and rotated the affected certificates to mitigate any potential risks. This incident underscores the escalating threat of supply chain attacks targeting widely used open-source libraries. Organizations must remain vigilant, as such attacks can infiltrate even well-secured development pipelines, leading to potential downstream compromises. The involvement of state-sponsored actors like UNC1069 highlights the need for enhanced security measures and continuous monitoring of software dependencies to protect against sophisticated cyber threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Booking.com Data Breach 2026: What You Need to Know
Leisure/Travel7 months ago

Booking.com Data Breach 2026: What You Need to Know

In April 2026, Booking.com, a leading online travel platform, experienced a data breach where unauthorized third parties accessed customers' reservation information. The compromised data included full names, email addresses, postal addresses, phone numbers, and communications shared with property providers. Upon detection, Booking.com promptly reset reservation PINs and notified affected users via email, advising them to remain vigilant against potential phishing attempts. ([techcrunch.com](https://techcrunch.com/2026/04/13/booking-com-confirms-hackers-accessed-customers-data/?utm_source=openai)) This incident underscores the persistent threat of cyberattacks targeting the travel and hospitality industry, emphasizing the need for robust data protection measures. As cybercriminals increasingly exploit personal data for fraudulent activities, organizations must enhance their security protocols to safeguard customer information.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports