Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 238 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2845–2856 / 4903 reports
TeamPCP's 2026 Cloud Breaches: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering7 months ago

TeamPCP's 2026 Cloud Breaches: A Wake-Up Call for Supply Chain Security

In March 2026, the threat actor group TeamPCP executed a series of sophisticated supply chain attacks, compromising widely used open-source tools such as Trivy, KICS, LiteLLM, and Telnyx. By injecting malicious code into these trusted software packages, TeamPCP deployed infostealer malware to harvest sensitive credentials, including API keys, SSH keys, and cloud service tokens. Utilizing the stolen credentials, the group swiftly breached cloud environments across AWS, Azure, and various SaaS platforms, conducting extensive reconnaissance and data exfiltration activities. This campaign underscores the critical need for organizations to promptly rotate and revoke compromised credentials to mitigate the risk of unauthorized access and data breaches. The rapid escalation and breadth of TeamPCP's attacks highlight a concerning trend in cyber threats, emphasizing the importance of securing software supply chains and implementing robust monitoring mechanisms to detect and respond to credential misuse promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical XSS and GhostScript RCE Vulnerabilities in Enterprise Document Processing Platform
Financial Services7 months ago

Critical XSS and GhostScript RCE Vulnerabilities in Enterprise Document Processing Platform

In 2026, a critical security assessment of an enterprise document processing platform revealed two severe vulnerabilities: an unauthenticated cross-site scripting (XSS) flaw and a GhostScript parameter injection leading to remote code execution (RCE). The XSS vulnerability allowed attackers to execute malicious scripts, bypassing HttpOnly cookie protections by exploiting an internal service endpoint that reflected session cookies in its response. This enabled full administrative access. Additionally, the GhostScript flaw permitted arbitrary command execution on the server by injecting parameters that disabled security features, leading to potential system compromise. ([praetorian.com](https://www.praetorian.com/blog/httponly-cookie-bypass-xss-ghostscript-rce/?utm_source=openai)) This incident underscores the persistent risks associated with XSS and RCE vulnerabilities, especially in applications handling sensitive data. It highlights the necessity for comprehensive security measures, including proper input validation, strict access controls, and regular security assessments to identify and mitigate such critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Venom Stealer: The New Frontier in Automated ClickFix Attacks
Financial Services7 months ago

Venom Stealer: The New Frontier in Automated ClickFix Attacks

In April 2026, a new malware-as-a-service (MaaS) platform named Venom Stealer emerged, automating the creation of persistent information-stealing attacks through ClickFix social engineering techniques. Developed by an individual known as 'VenomStealer,' this platform enables attackers to establish a continuous exfiltration pipeline, harvesting credentials, session cookies, and cryptocurrency wallets from victims. Unlike traditional infostealers, Venom Stealer remains active post-infection, continuously monitoring and exfiltrating new data, thereby undermining standard incident response measures. The commoditization of such advanced attack methods signifies a concerning evolution in cyber threats, making sophisticated social engineering tactics more accessible to a broader range of cybercriminals. Organizations must enhance their security awareness training and implement robust monitoring of outbound traffic to detect and prevent data exfiltration activities associated with these attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Surge in Cyberattacks Targets Latin American Governments in 2026
Government Administration7 months ago

Surge in Cyberattacks Targets Latin American Governments in 2026

In early 2026, Latin American governments faced a significant surge in cyberattacks targeting critical infrastructure and sensitive data. Notably, Colombia's health ministry reported over 23 million cyberattacks and probes in March, while Mexico's government agencies suffered breaches compromising millions of identities and tax records. Puerto Rico's Department of Transportation also experienced disruptions due to cyber incidents. These attacks were primarily driven by financially motivated cybercriminals, with a notable increase in nation-state espionage and politically motivated hacktivism. The region's rapid digitalization, coupled with legacy systems and a shortage of cybersecurity professionals, has exacerbated vulnerabilities, making government networks prime targets for cyber adversaries. ([darkreading.com](https://www.darkreading.com/cyber-risk/latin-american-confidence-cyber-defenses-skills?utm_source=openai)) This escalation underscores the urgent need for Latin American governments to bolster their cybersecurity defenses. The convergence of AI acceleration, geopolitical fragmentation, and cyber-enabled fraud is reshaping the global risk landscape, necessitating enhanced threat intelligence, public-private cooperation, and investment in cybersecurity infrastructure to mitigate the growing threats. ([weforum.org](https://www.weforum.org/stories/2026/01/geopolitics-ai-fraud-global-cyber-cybersecurity-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Navigating the Surge of AI-Driven Cyberattacks in 2025
Financial Services7 months ago

Navigating the Surge of AI-Driven Cyberattacks in 2025

In 2025, the cybersecurity landscape witnessed a significant surge in AI-driven offensive operations. Threat actors leveraged generative AI to automate and enhance attack vectors, including sophisticated phishing campaigns, deepfake-based social engineering, and rapid malware development. Notably, the average breakout time for cyberattacks decreased to just 29 minutes, a 65% acceleration from the previous year, underscoring the efficiency gains achieved through AI integration. ([itpro.com](https://www.itpro.com/security/crowdstrike-says-ai-is-officially-supercharging-cyber-attacks-average-breakout-times-hit-just-29-minutes-in-2025-65-percent-faster-than-in-2024-and-some-attacks-take-just-seconds?utm_source=openai)) This escalation in AI-powered threats has compelled organizations to reevaluate their defensive strategies. Traditional security measures are increasingly inadequate against the speed and complexity of AI-enhanced attacks. Consequently, there is a pressing need for adaptive, AI-driven defense mechanisms capable of real-time threat detection and response to mitigate the evolving risks posed by adversaries employing artificial intelligence. ([venturebeat.com](https://venturebeat.com/ai/outsmarting-ai-powered-cyber-attacks-endpoint-defense-2025?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Azure APIM Signup Bypass: A 2025 Security Wake-Up Call
Health Care / Life Sciences7 months ago

Azure APIM Signup Bypass: A 2025 Security Wake-Up Call

In September 2025, a critical vulnerability was discovered in Microsoft Azure API Management (APIM) Developer Portal, allowing unauthorized cross-tenant account creation even when administrators had disabled user signup via the portal's UI. This flaw stemmed from the backend API continuing to accept registration requests despite the UI indicating that signup was disabled. Exploiting this, attackers could create accounts, access internal API documentation, and potentially obtain API keys without any prior relationship to the target organization. Microsoft classified this behavior as 'by design' and did not release a patch, leaving organizations to implement their own mitigations. ([praetorian.com](https://www.praetorian.com/blog/azure-apim-signup-bypass/?utm_source=openai)) This incident underscores the importance of verifying that security controls function as intended, beyond their UI representations. Organizations relying solely on UI configurations may remain vulnerable to similar bypasses, emphasizing the need for comprehensive security assessments and proactive measures to secure API management platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI Agent Security Breach: Lessons from a 2026 Penetration Test
Computer Software/Engineering7 months ago

AI Agent Security Breach: Lessons from a 2026 Penetration Test

In March 2026, a penetration test revealed a critical vulnerability in an AI-powered desktop application designed to interface with Claude (Opus 4.5) and a third-party asset management platform. Despite operating within a sandboxed environment with stringent controls, attackers exploited the agent's ability to modify existing files and execute code. By uploading a benign-looking 'Hello World' C program alongside a malicious binary, and manipulating the agent to rename and execute the binary, the attackers achieved remote code execution, compromising the sandbox and accessing sensitive business logic components. This incident underscores the evolving threat landscape where AI agents, even with robust safeguards, can be manipulated to perform unintended actions, leading to significant security breaches. Organizations must reassess their security measures, particularly concerning AI agents with code execution capabilities, to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mercor's 2026 Data Breach: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering7 months ago

Mercor's 2026 Data Breach: A Wake-Up Call for Supply Chain Security

In March 2026, AI recruiting startup Mercor confirmed a significant data breach resulting from the LiteLLM supply chain compromise orchestrated by the hacking group TeamPCP. The attackers infiltrated Mercor's systems via a compromised Tailscale VPN credential, leading to the exfiltration of approximately 4TB of sensitive data, including source code, user databases, and identity verification documents. This incident underscores the critical vulnerabilities in software supply chains and the cascading risks they pose to organizations relying on open-source components. The Mercor breach highlights the escalating threat of supply chain attacks targeting widely-used open-source projects. As organizations increasingly integrate such components into their infrastructure, the potential for widespread compromise grows, emphasizing the need for robust security measures and vigilant monitoring of third-party dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Supply Chain Attack: Axios npm Package Compromised in March 2026
Computer Software/Engineering7 months ago

Critical Supply Chain Attack: Axios npm Package Compromised in March 2026

In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely used JavaScript HTTP client library, and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a hidden dependency, plain-crypto-js@4.2.1, which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting macOS, Windows, and Linux systems. The malicious packages were live for approximately two to three hours before being removed, but during that time, any system that installed these versions was potentially compromised. ([csoonline.com](https://www.csoonline.com/article/4152696/attackers-trojanize-axios-http-library-in-highest-impact-npm-supply-chain-attack.html?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software components are manipulated to distribute malware. Given Axios's extensive use, with over 100 million weekly downloads, the potential impact was significant, highlighting the need for robust security measures in software development and distribution processes. ([csoonline.com](https://www.csoonline.com/article/4152696/attackers-trojanize-axios-http-library-in-highest-impact-npm-supply-chain-attack.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Urgent: Patch Critical Citrix NetScaler Vulnerability CVE-2026-3055
Government Administration7 months ago

Urgent: Patch Critical Citrix NetScaler Vulnerability CVE-2026-3055

In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability (CVE-2026-3055) in Citrix NetScaler ADC and Gateway appliances by April 2. This flaw, stemming from insufficient input validation, allows unauthenticated remote attackers to perform out-of-bounds memory reads, potentially exposing sensitive information. The vulnerability specifically affects appliances configured as SAML Identity Providers (IDPs). ([itnerd.blog](https://itnerd.blog/2026/03/31/the-cisa-mandates-federal-patching-of-citrix-netscaler-flaw-by-thursday/?utm_source=openai)) The urgency of this directive underscores the significant risk posed by unpatched systems, as similar vulnerabilities have been exploited in the past, leading to substantial security breaches. Organizations are advised to promptly apply the available patches to mitigate potential threats. ([itnerd.blog](https://itnerd.blog/2026/03/31/the-cisa-mandates-federal-patching-of-citrix-netscaler-flaw-by-thursday/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Uranium Finance's 2021 Smart Contract Exploits: A DeFi Cautionary Tale
Financial Services7 months ago

Uranium Finance's 2021 Smart Contract Exploits: A DeFi Cautionary Tale

In April 2021, Uranium Finance, a decentralized exchange on Binance's BNB Chain, suffered two significant security breaches. On April 8, an attacker exploited a flaw in the smart contract's 'AmountWithBonus' variable, enabling unauthorized withdrawals totaling approximately $1.4 million. The attacker then coerced the platform into labeling a portion of the stolen funds as a 'bug bounty' in exchange for returning the remainder. On April 28, a separate vulnerability—a single-character coding error—was exploited, allowing the attacker to drain nearly $53.3 million from the platform's liquidity pools. This second attack forced Uranium Finance to cease operations, leaving users without recourse. These incidents underscore the critical importance of rigorous smart contract auditing and secure coding practices in the rapidly evolving DeFi sector. The substantial financial losses and operational disruptions highlight the vulnerabilities inherent in decentralized platforms and the necessity for continuous security assessments to protect user assets.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Axios npm Package Compromise: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

Axios npm Package Compromise: A Wake-Up Call for Open-Source Security

In late March 2026, attackers compromised the npm account of a lead maintainer of the widely-used JavaScript library Axios, publishing malicious versions 1.14.1 and 0.30.4. These versions included a trojanized dependency, 'plain-crypto-js', which executed a cross-platform Remote Access Trojan (RAT) upon installation, affecting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before removal, during which time they were potentially downloaded by numerous developers, given Axios's extensive use in the JavaScript ecosystem. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source software repositories. The rapid deployment and widespread adoption of compromised packages highlight the need for enhanced security measures in package management and distribution processes to prevent similar future breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports