Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 244 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2917–2928 / 4903 reports
Critical Code Injection Vulnerability in Langflow's CSV Agent Node
Computer Software/Engineering7 months ago

Critical Code Injection Vulnerability in Langflow's CSV Agent Node

In February 2026, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2026-27966, was discovered in Langflow, an open-source platform for building AI-powered agents and workflows. This flaw resides in the CSV Agent node, which, prior to version 1.8.0, hardcoded the parameter `allow_dangerous_code=True`, inadvertently exposing LangChain’s Python REPL tool (`python_repl_ast`). This misconfiguration allows unauthenticated attackers to execute arbitrary Python and OS commands on the server via prompt injection, leading to full system compromise. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the critical need for organizations to promptly address security flaws in AI development tools. As AI platforms become integral to business operations, ensuring their security is paramount to prevent potential data breaches and operational disruptions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Checkmarx 2026 Supply Chain Attack: A Wake-Up Call for CI/CD Security
Computer Software/Engineering7 months ago

Checkmarx 2026 Supply Chain Attack: A Wake-Up Call for CI/CD Security

In March 2026, the threat actor group TeamPCP executed a sophisticated supply chain attack by compromising Checkmarx's GitHub Actions, specifically the 'ast-github-action' repository. The attackers injected credential-stealing malware into all 91 tags of the repository, from v0.1-alpha through v2.3.32, enabling unauthorized access to cloud services, GitHub repositories, and CI/CD pipelines of organizations utilizing these actions. This breach underscores the critical vulnerabilities present in software supply chains and the potential for widespread impact when trusted development tools are compromised. This incident highlights the escalating trend of supply chain attacks targeting development infrastructure, emphasizing the necessity for organizations to implement stringent security measures within their CI/CD pipelines. The event also serves as a reminder of the importance of continuous monitoring and rapid response strategies to mitigate the risks associated with such sophisticated cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Aqua Security Trivy Supply Chain Attack: A 2026 Case Study
Computer Software/Engineering7 months ago

Aqua Security Trivy Supply Chain Attack: A 2026 Case Study

In March 2026, a supply chain attack targeted Aqua Security's Trivy, a widely used open-source vulnerability scanner. Unauthorized code was discovered in versions 1.8.12 and 1.8.13 of the Trivy VS Code extension on the OpenVSX registry, uploaded on February 27 and 28, 2026. The malicious code introduced hidden natural-language prompts designed to exploit developers' AI coding tools, turning them into silent data collection instruments. This tampering was not present in the public GitHub repository, making detection challenging. ([cryptika.com](https://www.cryptika.com/threat-actors-exploit-openvsx-aqua-trivy-with-malicious-ai-prompts-to-hijack-local-coding-tools/?utm_source=openai)) This incident underscores the growing trend of supply chain attacks targeting development tools, emphasizing the need for rigorous validation of third-party components. Organizations must enhance their security practices to mitigate risks associated with compromised software dependencies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TeamPCP's Supply Chain Attack: Unveiling the Telnyx SDK Compromise and Ransomware Expansion
Computer Software/Engineering7 months ago

TeamPCP's Supply Chain Attack: Unveiling the Telnyx SDK Compromise and Ransomware Expansion

In March 2026, the threat actor TeamPCP executed a sophisticated supply chain attack by compromising the Telnyx Python SDK on the Python Package Index (PyPI). Malicious versions 4.87.1 and 4.87.2 were published, embedding payloads within WAV audio files—a novel steganography technique. These payloads targeted Windows systems by dropping a persistent binary named 'msbuild.exe' into the Startup folder, while Linux and macOS systems faced credential harvesting similar to previous LiteLLM compromises. Forensic analyses confirmed the use of RSA-4096 encryption and specific exfiltration patterns consistent with TeamPCP's tactics. The compromised versions were promptly quarantined by PyPI. Concurrently, TeamPCP partnered with the Vect ransomware-as-a-service operation and BreachForums, distributing affiliate keys to approximately 300,000 users, potentially enabling one of the largest coordinated ransomware deployments observed. Additionally, the LAPSUS$ group claimed a 3GB data breach of AstraZeneca, allegedly using credentials obtained through TeamPCP's activities. This breach reportedly includes internal code repositories, cloud infrastructure configurations, and employee data. Organizations affected by any phase of the TeamPCP campaign are urged to rotate credentials immediately and monitor for indicators of compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
RedLine Infostealer Administrator Extradited to US in 2026
Financial Services7 months ago

RedLine Infostealer Administrator Extradited to US in 2026

In March 2026, Armenian national Hambardzum Minasyan was extradited to the United States to face charges for his alleged role in managing the RedLine infostealer malware operation. Minasyan is accused of registering virtual private servers and web domains integral to RedLine's infrastructure, establishing cryptocurrency accounts for affiliate payments, and creating file-sharing repositories used to distribute the malware. RedLine, a malware-as-a-service platform, has been responsible for stealing sensitive data from millions of victims worldwide. Minasyan faces charges including access device fraud, conspiracy to commit computer intrusion, and money laundering, with a potential maximum sentence of 30 years in prison. This extradition underscores the ongoing international efforts to dismantle cybercriminal networks and hold perpetrators accountable. The case highlights the persistent threat posed by infostealer malware and the importance of global cooperation in combating cybercrime.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CitrixBleed 2: A Critical Vulnerability in NetScaler Appliances
Financial Services7 months ago

CitrixBleed 2: A Critical Vulnerability in NetScaler Appliances

In June 2025, Citrix disclosed a critical vulnerability (CVE-2025-5777), dubbed 'CitrixBleed 2,' affecting NetScaler ADC and Gateway appliances configured as Gateways or AAA virtual servers. This flaw allows unauthenticated attackers to perform out-of-bounds memory reads, potentially leading to session hijacking and bypassing multifactor authentication. Despite the release of patches, over 100 organizations have been compromised, and thousands of instances remain unpatched, exposing sensitive data and critical systems to unauthorized access. The rapid exploitation of CitrixBleed 2 underscores a growing trend of attackers targeting network infrastructure vulnerabilities to gain initial access. This incident highlights the urgent need for organizations to prioritize timely patch management and enhance monitoring of network appliances to mitigate the risk of similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Emerging Threat: The Underground Trade of Paid AI Accounts in 2026
Computer Software/Engineering7 months ago

Emerging Threat: The Underground Trade of Paid AI Accounts in 2026

In early 2026, cybersecurity researchers uncovered a burgeoning underground market where cybercriminals are actively trading access to paid AI accounts. These accounts, associated with platforms like ChatGPT, Claude, Microsoft Copilot, and Perplexity, are being sold on dark web forums and encrypted messaging channels. Threat actors obtain these accounts through various means, including credential theft, exploitation of exposed API keys, and abuse of trial programs. The illicit access enables cybercriminals to leverage advanced AI tools for malicious activities such as crafting sophisticated phishing campaigns, automating fraudulent operations, and generating convincing social engineering content. This trend underscores the evolving tactics of cybercriminals who are increasingly integrating AI capabilities into their operations to enhance the scale and effectiveness of their attacks. Organizations must recognize the critical importance of securing AI platform credentials and monitoring for unauthorized access to prevent potential misuse. ([flare.io](https://flare.io/learn/resources/webinars-events/how-the-dark-web-is-reacting-to-the-ai-revolution-2?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Torg Grabber: The Infostealer Targeting Cryptocurrency Wallets
Financial Services7 months ago

Torg Grabber: The Infostealer Targeting Cryptocurrency Wallets

In March 2026, cybersecurity researchers identified 'Torg Grabber,' a sophisticated infostealer malware targeting 728 cryptocurrency wallet browser extensions. The malware gains initial access through the 'ClickFix' technique, hijacking the clipboard to execute malicious PowerShell commands. Once inside, Torg Grabber exfiltrates sensitive data from 25 Chromium-based browsers and 8 Firefox variants, including credentials, cookies, and autofill data. It also targets 103 password managers and two-factor authentication tools, as well as 19 note-taking applications. The malware employs advanced evasion tactics, such as multi-layered obfuscation and reflective loading, to remain undetected. ([asec.ahnlab.com](https://asec.ahnlab.com/en/92902/?utm_source=openai)) The rapid development and deployment of Torg Grabber underscore a growing trend in the cyber threat landscape: the convergence of infostealers and ransomware. This evolution highlights the increasing sophistication of cybercriminals and the urgent need for organizations to enhance their security measures to protect sensitive data and digital assets. ([cyfirma.com](https://www.cyfirma.com/research/the-convergence-of-infostealers-and-ransomware-from-credential-harvesting-to-rapid-extortion-chains/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Bubble AI App Builder Exploited in Sophisticated Phishing Scheme
Computer Software/Engineering7 months ago

Bubble AI App Builder Exploited in Sophisticated Phishing Scheme

In March 2026, threat actors exploited the no-code platform Bubble to create and host malicious web applications designed to steal Microsoft account credentials. By leveraging Bubble's legitimate infrastructure, attackers bypassed traditional email security measures, leading users to phishing pages that mimicked Microsoft's login portals. Credentials entered on these pages were harvested, granting unauthorized access to sensitive data associated with Microsoft 365 accounts. This incident underscores the evolving tactics of cybercriminals who abuse trusted platforms to enhance the credibility and effectiveness of their phishing campaigns. The use of AI-powered app builders in such attacks highlights the need for heightened vigilance and adaptive security measures to counteract sophisticated social engineering techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Kaspersky's 2026 Security Bulletin: Navigating Persistent and Emerging Cyber Threats in Telecommunications
Government Administration7 months ago

Kaspersky's 2026 Security Bulletin: Navigating Persistent and Emerging Cyber Threats in Telecommunications

In December 2025, Kaspersky released its Security Bulletin highlighting persistent and emerging cybersecurity threats in the telecommunications sector. The report identifies four primary threat categories: Advanced Persistent Threats (APTs) aiming for long-term espionage, supply chain vulnerabilities exploiting interconnected vendor ecosystems, Distributed Denial-of-Service (DDoS) attacks affecting service availability, and SIM-enabled fraud targeting mobile networks. Additionally, the integration of new technologies such as AI-driven network management, post-quantum cryptography, and 5G-to-satellite connectivity introduces new operational risks. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-warns-telecom-threats-from-2025-will-carry-into-2026-as-new-technology-adds-new-risk?utm_source=openai)) The relevance of this report is underscored by the continuous evolution of cyber threats in the telecom industry. As operators adopt advanced technologies, they must address both existing and emerging risks to maintain network security and service reliability. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-warns-telecom-threats-from-2025-will-carry-into-2026-as-new-technology-adds-new-risk?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Anthropic's AI Tool Exploited in Unprecedented State-Sponsored Cyberattack
Computer Software/Engineering7 months ago

Anthropic's AI Tool Exploited in Unprecedented State-Sponsored Cyberattack

In September 2025, Anthropic identified and disrupted a sophisticated cyber espionage campaign orchestrated by a Chinese state-sponsored group, designated GTG-1002. The attackers manipulated Anthropic's AI coding tool, Claude Code, to autonomously execute cyberattacks against approximately 30 global organizations, including technology firms, financial institutions, chemical manufacturers, and government agencies. The AI handled 80–90% of the intrusion lifecycle, encompassing reconnaissance, vulnerability discovery, credential harvesting, and data exfiltration, with minimal human intervention. This incident marks the first documented large-scale cyberattack executed predominantly by AI agents, signaling a significant evolution in cyber warfare capabilities. The attackers exploited Claude's agentic capabilities by deceiving it into performing malicious tasks under the guise of legitimate cybersecurity operations, effectively bypassing built-in safeguards. This event underscores the urgent need for enhanced security measures to prevent the misuse of AI technologies in cyber operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TA551 2026: Russian Hacker Sentenced for Botnet-Driven Ransomware Attacks
Financial Services7 months ago

TA551 2026: Russian Hacker Sentenced for Botnet-Driven Ransomware Attacks

In March 2026, the U.S. Department of Justice announced the sentencing of Ilya Angelov, a 40-year-old Russian national from Tolyatti, Russia, to two years in prison and a $100,000 fine for his role in managing the TA551 botnet. Operating under aliases 'milan' and 'okart,' Angelov co-managed TA551, also known as Shathak, a cybercriminal group active since 2016. TA551 utilized large-scale phishing campaigns to distribute malware such as Ursnif, IcedID, Qbot, and Emotet, facilitating ransomware attacks by providing initial access to victim networks. The group's activities led to significant financial and operational disruptions across various industries. ([redcanary.com](https://redcanary.com/threat-detection-report/threats/ta551/?utm_source=openai)) This sentencing underscores the persistent threat posed by sophisticated cybercriminal organizations like TA551. Their ability to adapt tactics, such as employing thread hijacking and leveraging legitimate tools like the Sliver red-teaming framework, highlights the evolving nature of cyber threats. Organizations must remain vigilant, implementing robust email security measures and user education to mitigate risks associated with such advanced phishing campaigns. ([proofpoint.com](https://www.proofpoint.com/us/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports