The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
CVE-2026-20045: Active Code Injection Exploit Strikes Cisco Unified Communications
In January 2026, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities Catalog following reports of active exploitation targeting Cisco Unified Communications products. Attackers exploited a code injection vulnerability that allowed remote, unauthenticated threat actors to execute arbitrary code on affected devices, potentially compromising sensitive communications and opening access for further malicious activity within targeted federal civilian executive branch (FCEB) networks. This rapid addition of CVE-2026-20045 prompted urgent federal action to remediate impacted systems and reduce the risk of lateral movement and data exfiltration. The incident highlights a persistent threat vector facing organizations reliant on unified communications infrastructure. With attackers increasingly exploiting unpatched vulnerabilities and leveraging code injection to bypass security controls, the importance of timely patch management and network segmentation continues to grow amid tightening regulatory standards and intensifying audit scrutiny.
8 months ago
Kill Chain
CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024
In early 2024, security researchers identified a sophisticated malware campaign dubbed the 'CrashFix' scam, which leveraged malicious browser extensions—specifically the NexShield extension—to crash users' browsers via social engineering popups and prompt them to install phony fixes. Victims, lured into installing the extension and then a Python-based remote access trojan (RAT), unknowingly granted attackers deep access to their systems. Once compromised, the RAT enabled persistent monitoring, exfiltration of sensitive data, and possible lateral movement within corporate environments, posing a significant risk to both individuals and organizations. The campaign demonstrated a streamlined chain from initial compromise via engineered browser crashes, through privilege escalation and persistent command-and-control using a multi-stage malware deployment. This incident underscores the growing sophistication of social engineering in malware delivery, the risks of malicious browser extensions, and evolving techniques in drive-by compromise and post-infection control. Increased reliance on browsers for daily business functions and the persistence of endpoint threats make such campaigns highly relevant amid surging attacks targeting remote access and user trust.
8 months ago
Kill Chain
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.
8 months ago
Kill Chain
VoidLink: AI-Generated Linux Malware Breaks New Ground in 2024 Hybrid Cloud Attack
In early 2024, security researchers uncovered VoidLink, a sophisticated Linux malware framework developed almost entirely by autonomous AI agents. The attack chain involved highly original code and TTPs that bypassed standard detection, enabling attackers to move laterally within targeted cloud and hybrid environments. Exploiting gaps in east-west segmentation and encrypted data exfiltration, VoidLink established resilient command-and-control channels and evaded traditional intrusion prevention measures, exposing sensitive internal traffic and critical workloads to theft and disruption. Operational impacts included potential data loss, regulatory exposure, and interruptions to secure network functions across multiple organizations. The emergence of AI-generated malware like VoidLink signals a paradigm shift in cyber threats, where autonomous code can outpace conventional defenses and rapidly adapt to security controls. This incident underlines the urgent need for organizations to evolve their security posture with advanced segmentation, visibility, and automation to counter the accelerating threat of agentic and AI-enabled attacks.
8 months ago
Kill Chain
Zendesk 2024 Spam Attacks Expose SaaS Security Gaps
In June 2024, multiple organizations using Zendesk experienced a widespread spam campaign that abused legitimate Zendesk instances to distribute malicious and unwanted emails. Attackers leveraged open or misconfigured support ticketing forms, submitting large volumes of spam through these systems. The CRM vendor Zendesk responded by assuring customers that the event was not tied to any software vulnerability or security breach within the platform itself. Business impact centered on increased phishing risk and operational noise in customer service channels, as well as potential reputational harm to affected brands. This incident highlights a growing trend where attackers abuse trusted SaaS communication channels to bypass traditional email security filters. As threat actors increasingly focus on exploiting third-party platforms and automation, organizations face new challenges securing digital touchpoints against social engineering and spam-based threats.
8 months ago
Kill Chain
Visual Studio Code: The Hidden Supply-Chain Threat Targeting Developers (2024)
In January 2024, a novel supply-chain attack vector targeting Visual Studio Code (VSCode) environments was exposed. Threat actors leveraged VSCode's task automation feature by embedding malicious scripts within project-level '.vscode/tasks.json' files. When an unsuspecting developer opened a compromised repository or project directory, these hidden tasks executed automatically, enabling code execution—potentially leading to malware installation, data exfiltration, or further lateral movement within the developer’s environment. The attack mimics macro-style threats seen in Office documents, utilizing obfuscated scripts and exploiting legitimate productivity features to bypass traditional security controls. This breach highlights the growing exploitation of developer tools as initial intrusion points, particularly given the increased reliance on open-source ecosystems and extensions. Supply-chain attacks via development environments are on the rise, pressuring organizations to improve oversight of internal code, dependencies, and automated scripts. Vigilance around workspace configuration files, especially auto-executing tasks, is now critical for enterprise security posture.
8 months ago
Kill Chain
How an Azure Private Endpoint DNS Misconfiguration Triggered Massive DoS Risks in 2026
In January 2026, security researchers highlighted a critical cloud misconfiguration affecting Microsoft Azure’s Private Endpoint architecture that could trigger denial-of-service (DoS) conditions. Specifically, Azure Private Link’s DNS resolution behavior was shown to inadvertently block access to resources—including Azure Storage, Key Vault, CosmosDB, and others—when Private DNS zones were misconfigured. The risks arise in accidental and malicious deployment scenarios, where incomplete or improper DNS records prevent workloads from connecting, despite the underlying resource being online. This exposure reportedly affects over 5% of Azure storage accounts, posing operational disruption risks through simple configuration errors or targeted attacker activity. This incident underscores the increasing complexity and fragility of cloud-native networking, as organizations accelerate the adoption of zero trust and segmentation patterns. With threat actors and insider mistakes both leveraging subtle service settings, this serves as an urgent reminder that cloud misconfiguration remains a leading cause of outages and breaches.
8 months ago
Kill Chain
Google Gemini AI Breach: Prompt Injection Attack Exposes Enterprise Calendar Data
In January 2026, researchers at Miggo Security demonstrated a semantic prompt injection attack against Google Gemini, the company’s flagship AI assistant integrated across Google Workspace. By sending a maliciously crafted Calendar invitation containing natural-language instructions in the event’s description, attackers could leverage Gemini’s automated parsing and task execution to exfiltrate sensitive calendar data. When a victim queried Gemini about their schedule, the model would follow the embedded instructions, summarize all meetings—including private ones—and leak the information by generating a new event visible to the attacker. This bypassed existing filtering mechanisms and exposed data without explicit user approval. The incident underscores the rising concern over generative AI systems’ susceptibility to context-driven prompt injection and logic abuse. It highlights an urgent need for context-aware and semantic-level defenses in AI-integrated business applications, as AI assistants become deeply embedded in productivity suites throughout the enterprise sector.
8 months ago
Kill Chain
VoidLink Malware: How AI Accelerated a New Breed of Cloud Attacks
In late November 2025, researchers identified the VoidLink malware framework targeting Linux-based cloud servers. Distinct for its use of AI-driven development, VoidLink was built by a single operator primarily using the TRAE SOLO AI assistant, leading to an advanced, feature-rich malware toolkit in under a week. The incident became public after the attacker inadvertently exposed critical code, documentation, and sprint plans via an unsecured open directory, allowing security analysts to trace the rapid, AI-assisted development timeline and examine the malware’s architecture, which included custom loaders, implants, and rootkit modules for stealth and evasive operations. VoidLink represents the first extensively documented case of a sophisticated threat being produced predominately through AI modeling and automation. Its rapid development cycle and advanced modularity demonstrate the growing capability for individuals or small groups to deploy complex attacks once reserved for well-resourced threat actors—an evolution that underscores urgent challenges for enterprise security teams and the mitigation of future AI-driven threats.
8 months ago
Kill Chain
Evelyn Stealer Exposes Developer Credential Risks in VS Code Supply Chain
In January 2026, researchers uncovered a malware campaign exploiting the Microsoft VS Code extension ecosystem to deliver Evelyn Stealer, an infostealer targeting software developers. Threat actors distributed malicious extensions which downloaded and executed a secondary payload, ultimately injecting the stealer into a legitimate process. Once executed, the malware harvested sensitive information—including developer credentials, stored cookies, crypto wallets, and system data—then exfiltrated these assets via FTP to a remote server. Attackers also deployed anti-analysis and evasion techniques, enabling seamless and covert data theft that potentially compromised broader organizational systems by abusing developer environments as entry points. This attack underscores the growing risks to the software supply chain, as developer tools become lucrative vectors for credential and asset theft. The Evelyn Stealer incident reflects an expanding trend where infostealers leverage trusted development ecosystems, highlighting the urgent need for stronger security controls and supply chain hygiene in rapidly evolving threat landscapes.
8 months ago
Kill Chain
2026 JavaScript Secrets Leak: Tens of Thousands of API Tokens Exposed in Production Web App Bundles
In January 2026, a sweeping automated analysis uncovered the exposure of over 42,000 sensitive API tokens—including GitHub, GitLab, Slack, Linear, and other SaaS access keys—in JavaScript bundles of live, internet-facing web applications. The research, conducted at massive scale across 5 million applications, revealed that traditional infrastructure and application security scanners consistently missed these secrets, leaving organizations exposed to repository breaches, data leaks, and system compromise. Critical tokens found enabled attackers to access private code, internal projects, downstream services, and business-critical data, demonstrating broad gaps in application supply chain controls. This incident highlights persistent shortcomings in secrets detection across the application lifecycle. As businesses accelerate cloud adoption, CI/CD automation, and shift-left security, the failure of both automated scanners and static analysis to catch secrets in deployed JavaScript highlights urgent challenges. The trend will likely intensify with rising use of contemporary development pipelines and AI-generated code.
8 months ago
Kill Chain
Cloudflare ACME WAF Bypass: How a 2026 Edge Vulnerability Left Origins Exposed
In January 2026, Cloudflare disclosed and remediated a critical vulnerability in its ACME (Automatic Certificate Management Environment) HTTP-01 validation process. The flaw allowed attackers to craft requests that bypassed Cloudflare's Web Application Firewall (WAF), gaining unauthorized access to protected origin servers by exploiting the path handling for ACME challenges. There is no evidence of mass exploitation, but the vulnerability exposed the underlying infrastructure to potential attacks until it was patched. Cloudflare identified, investigated, and quickly deployed a fix to mitigate further risk to its global customer base. The incident highlights the ongoing importance of robust validation logic and continuous testing in security edge infrastructure. As attackers adapt to complex cloud architectures, bypass techniques targeting certificate management or internal authentication flows are increasingly relevant for organizations using shared security platforms.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports