Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 264 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3157–3168 / 4903 reports
Android 2026 Security Update Addresses Exploited Qualcomm Zero-Day
Telecommunications8 months ago

Android 2026 Security Update Addresses Exploited Qualcomm Zero-Day

In March 2026, Google released a security update addressing 129 vulnerabilities in Android devices, notably including CVE-2026-21385—a high-severity zero-day flaw in Qualcomm's display component. This integer overflow vulnerability allows local attackers to cause memory corruption, potentially leading to unauthorized control over affected devices. The flaw impacts 234 Qualcomm chipsets, and there are indications of its limited, targeted exploitation in the wild. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) The active exploitation of CVE-2026-21385 underscores the persistent threat posed by zero-day vulnerabilities in widely used hardware components. Organizations must prioritize timely patch management and maintain robust security protocols to mitigate risks associated with such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Cloud Imperium Games Data Breach: A Wake-Up Call for the Gaming Industry
Computer Games8 months ago

Cloud Imperium Games Data Breach: A Wake-Up Call for the Gaming Industry

In January 2026, Cloud Imperium Games (CIG), the developer behind 'Star Citizen,' experienced a sophisticated cyberattack resulting in unauthorized access to backup systems containing user data. The breach, discovered on January 21, exposed personal information including names, contact details, usernames, and dates of birth. Notably, financial information and passwords remained secure. CIG addressed the intrusion promptly, implementing enhanced security measures to prevent further incidents. ([theregister.com](https://www.theregister.com/2026/03/03/brit_games_studio_cloud_imperium/?utm_source=openai)) This incident underscores the critical importance of timely breach disclosure and robust data protection practices in the gaming industry. The delayed notification has raised concerns about transparency and user trust, highlighting the need for companies to adhere to regulatory requirements and maintain open communication with their user base. ([scworld.com](https://www.scworld.com/brief/cloud-imperium-faces-backlash-over-delayed-data-breach-disclosure?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
AWS Data Centers in Middle East Damaged by Drone Strikes
Information Technology/IT8 months ago

AWS Data Centers in Middle East Damaged by Drone Strikes

In early March 2026, Amazon Web Services (AWS) experienced significant disruptions after drone strikes targeted its data centers in the Middle East. Two facilities in the United Arab Emirates (UAE) were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks resulted in structural damage, power outages, and water damage due to fire suppression efforts, leading to elevated error rates and degraded availability for services such as Amazon EC2, Amazon S3, and Amazon DynamoDB. AWS is collaborating with local authorities to restore services, but recovery is expected to be prolonged due to the extent of the physical damage. This incident underscores the vulnerability of critical cloud infrastructure to physical attacks, especially in regions experiencing geopolitical tensions. Organizations relying on cloud services are reminded of the importance of robust disaster recovery plans and the need to consider geographic redundancy to mitigate risks associated with localized disruptions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
LexisNexis Data Breach: A Wake-Up Call for Third-Party Platform Security
Legal Services8 months ago

LexisNexis Data Breach: A Wake-Up Call for Third-Party Platform Security

In December 2024, LexisNexis Risk Solutions experienced a data breach when an unauthorized party accessed data stored on GitHub, a third-party platform used for software development. The breach, discovered in April 2025, exposed personal information of over 364,000 individuals, including names, contact details, Social Security numbers, driver's license numbers, and dates of birth. The company has since notified affected individuals and offered two years of complimentary identity protection and credit monitoring services. This incident underscores the critical importance of securing third-party platforms and the potential risks associated with their use. Organizations must ensure robust security measures are in place to protect sensitive data, especially when utilizing external services for development purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
The Rising Threat of Compromised cPanel Credentials in Cybercrime Markets
Computer Software/Engineering8 months ago

The Rising Threat of Compromised cPanel Credentials in Cybercrime Markets

In March 2025, a cybercriminal known as "miya" advertised for sale compromised SSH, cPanel, Mail, and WebHost Manager (WHM) credentials belonging to a Canadian car dealership on a dark web forum, pricing the access at $400. These credentials provided potential attackers with privileged access to the dealership's critical systems, including remote command-line server control via SSH, administrative capabilities through WHM and cPanel, and access to sensitive communications via the mail server. The breach underscored the escalating cybersecurity risks faced by automotive retailers, who increasingly rely on interconnected digital systems to manage sales, customer data, and backend infrastructure. ([cyberpress.org](https://cyberpress.org/cybercriminal-miya-stolen/?utm_source=openai)) This incident highlights a broader trend of cybercriminals targeting cPanel and other site management credentials to facilitate unauthorized access to web servers and associated services. The sale of such credentials on underground forums has become increasingly common, with prices ranging from $3 to $5, depending on the target and level of access provided. ([documents.trendmicro.com](https://documents.trendmicro.com/assets/wp/wp-north-american-underground.pdf?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Chrome's 2026 Vulnerability: A Wake-Up Call for Browser Security
Computer Software/Engineering8 months ago

Chrome's 2026 Vulnerability: A Wake-Up Call for Browser Security

In January 2026, a high-severity vulnerability (CVE-2026-0628) was identified in Google Chrome's WebView component, allowing attackers to escalate privileges via malicious extensions. This flaw, present in versions prior to 143.0.7499.192, enabled unauthorized script or HTML injection into privileged pages, potentially granting access to sensitive resources. Google promptly addressed the issue by releasing a patch on January 7, 2026. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-0628?utm_source=openai)) The incident underscores the critical importance of timely software updates and vigilant extension management. As browser vulnerabilities continue to be a prime target for cyber threats, organizations must prioritize regular patching and educate users on the risks associated with unverified extensions to mitigate potential security breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft 2026 OAuth Redirection Abuse: A New Phishing Threat
Government Administration8 months ago

Microsoft 2026 OAuth Redirection Abuse: A New Phishing Threat

In early March 2026, Microsoft identified a sophisticated phishing campaign targeting government and public-sector organizations. Attackers exploited the OAuth 2.0 redirection mechanism to bypass traditional email and browser defenses, redirecting users from legitimate authentication pages to malicious sites. This technique involved crafting OAuth authorization requests with parameters designed to trigger authentication errors, leading to redirects that facilitated malware delivery or credential harvesting. The campaign underscores the evolving tactics of threat actors in leveraging trusted authentication flows to compromise user accounts and deliver malicious payloads. This incident highlights a growing trend in the abuse of OAuth mechanisms for phishing and malware distribution. Organizations must remain vigilant, as attackers continue to refine their methods to exploit authentication protocols, emphasizing the need for robust security measures and user education to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SloppyLemming's Dual Malware Assault on South Asian Governments
Government Administration8 months ago

SloppyLemming's Dual Malware Assault on South Asian Governments

Between January 2025 and January 2026, the threat actor known as SloppyLemming executed a series of cyber-espionage attacks targeting government entities and critical infrastructure in Pakistan and Bangladesh. Utilizing spear-phishing emails with malicious PDF and Excel attachments, the group deployed two distinct malware strains: BurrowShell, a backdoor facilitating file manipulation and network tunneling, and a Rust-based keylogger designed for information theft and network reconnaissance. These sophisticated attacks underscore the evolving tactics of nation-state actors in the region. The campaign's reliance on advanced techniques, such as disguising command-and-control traffic as legitimate Windows Update communications and exploiting Cloudflare Workers infrastructure, highlights the increasing complexity of cyber threats facing South Asian nations. This incident serves as a critical reminder for organizations to bolster their cybersecurity defenses against state-sponsored attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Android 2026 Security Update: Addressing CVE-2026-21385 in Qualcomm Components
Telecommunications8 months ago

Android 2026 Security Update: Addressing CVE-2026-21385 in Qualcomm Components

In March 2026, Google released a security update addressing 129 vulnerabilities in Android devices, notably CVE-2026-21385—a high-severity flaw in Qualcomm's display component. This vulnerability, an integer overflow leading to memory corruption, was reported by Google's Android Security team on December 18, 2025, and has been confirmed to be under limited, targeted exploitation in the wild. The flaw affects 234 Qualcomm chipsets, spanning a wide range of devices. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) The active exploitation of CVE-2026-21385 underscores the critical need for timely security updates. Organizations and individuals using affected devices should prioritize applying the March 2026 security patch to mitigate potential risks associated with this vulnerability. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Microsoft Warns of OAuth Redirect Abuse Delivering Malware to Government Targets
Government Administration8 months ago

Microsoft Warns of OAuth Redirect Abuse Delivering Malware to Government Targets

In March 2026, Microsoft identified phishing campaigns exploiting OAuth's standard redirection mechanisms to deliver malware to government and public-sector organizations. Attackers created malicious applications with redirect URLs pointing to rogue domains hosting malware. They distributed OAuth phishing links prompting recipients to authenticate via these applications using intentionally invalid scopes. This process redirected users to attacker-controlled pages, leading to inadvertent malware downloads. The payloads, often in ZIP archives, executed PowerShell commands upon opening, resulting in host reconnaissance, DLL side-loading, and connections to external command-and-control servers. Phishing emails employed lures such as e-signature requests, Teams recordings, and financial themes, sent through mass-sending tools and custom solutions developed in Python and Node.js. Microsoft has since removed several malicious OAuth applications and advises organizations to limit user consent, periodically review application permissions, and remove unused or overprivileged apps. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security
Computer/Network Security8 months ago

AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security

Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor utilized multiple commercial generative AI services to compromise over 600 Fortinet FortiGate firewalls across more than 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known FortiGate vulnerabilities. This campaign underscores the growing trend of cybercriminals employing AI tools to automate and scale attacks, significantly reducing the technical expertise required to execute large-scale intrusions. The incident highlights the urgent need for organizations to secure management interfaces, enforce strong authentication mechanisms, and stay vigilant against AI-assisted cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cybercriminals Exploit Fake Tech Support to Deploy Havoc C2 Framework
Financial Services8 months ago

Cybercriminals Exploit Fake Tech Support to Deploy Havoc C2 Framework

In February 2026, a sophisticated cyberattack campaign was identified targeting multiple organizations. Threat actors impersonated IT support personnel, initiating contact through spam emails followed by phone calls. They convinced victims to grant remote access via tools like AnyDesk, leading to the deployment of a customized version of the Havoc command-and-control (C2) framework. This allowed rapid lateral movement within networks, with the attackers compromising multiple endpoints within hours, indicating objectives of data exfiltration or ransomware deployment. This incident underscores the evolving tactics of cybercriminals, combining social engineering with advanced malware to infiltrate organizations. The use of open-source C2 frameworks like Havoc, customized to evade detection, highlights the need for enhanced vigilance and updated security protocols to counter such multifaceted threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports