Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 265 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3169–3180 / 4903 reports
Project Compass: Unveiling the Arrests in 'The Com' Cybercrime Network
Banking/Mortgage8 months ago

Project Compass: Unveiling the Arrests in 'The Com' Cybercrime Network

In January 2025, Europol initiated Project Compass, a coordinated international operation targeting 'The Com,' a decentralized cybercriminal collective known for engaging in ransomware attacks, financial extortion, and the exploitation of minors. Over the course of the year, the operation led to the arrest of 30 individuals and the identification of 179 additional suspects across 28 countries. Investigators also identified 62 victims, with four being directly safeguarded from further harm. 'The Com' primarily consists of English-speaking individuals aged 16 to 25, who utilize social media platforms, messaging applications, and online gaming environments to recruit and exploit young people. The group's decentralized structure and use of various online platforms have made it particularly challenging for law enforcement to disrupt their activities. The success of Project Compass underscores the importance of international collaboration in combating cybercrime and highlights the ongoing threat posed by such decentralized networks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai)) The significance of this operation is underscored by the increasing prevalence of cybercriminal groups targeting vulnerable populations through online platforms. The arrest of key members of 'The Com' serves as a critical reminder of the need for continuous vigilance and proactive measures to protect minors from online exploitation. Additionally, the operation highlights the evolving tactics of cybercriminals, who are increasingly leveraging decentralized networks and social engineering techniques to perpetrate their crimes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/30-alleged-members-the-com-arrested-project-compass/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenClaw Vulnerability Highlights AI Agent Security Risks

OpenClaw Vulnerability Highlights AI Agent Security Risks

In February 2026, a critical vulnerability (CVE-2026-25253) was discovered in OpenClaw, an open-source AI agent platform, allowing attackers to execute arbitrary code on users' systems via malicious web pages. This flaw exposed over 42,000 instances globally, leading to unauthorized access, data exfiltration, and potential system compromise. The vulnerability was promptly patched in version 2026.1.29, but the incident highlighted significant security concerns inherent in AI agent architectures. ([taoapex.com](https://taoapex.com/en/guides/deploy-personal-ai-assistant-openclaw/?utm_source=openai)) The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, making them attractive targets for cybercriminals. This incident underscores the urgent need for comprehensive security frameworks and best practices to mitigate risks associated with autonomous AI systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Pro-Iranian Cyberattacks 2026: Unveiling the Threat to Critical Infrastructure

Pro-Iranian Cyberattacks 2026: Unveiling the Threat to Critical Infrastructure

In early 2026, amid escalating geopolitical tensions, pro-Iranian cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure in the United States and allied nations. These attacks aimed to disrupt essential services, including utilities and transportation systems, and were characterized by sophisticated techniques such as ransomware deployment and data exfiltration. The cyber offensive resulted in significant operational disruptions and financial losses, highlighting the evolving threat landscape posed by nation-state-sponsored cyber activities. This incident underscores the persistent and adaptive nature of cyber threats from nation-state actors, particularly in the context of geopolitical conflicts. Organizations are urged to enhance their cybersecurity posture by implementing robust defense mechanisms, conducting regular threat assessments, and fostering information-sharing partnerships to mitigate the risks associated with such sophisticated cyberattacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding OAuth Redirection Abuse in Phishing Attacks

Understanding OAuth Redirection Abuse in Phishing Attacks

In March 2026, Microsoft identified a sophisticated phishing campaign exploiting OAuth's redirection mechanisms to deliver malware. Attackers crafted URLs using legitimate identity providers like Microsoft Entra ID and Google Workspace, embedding them in phishing emails with themes such as e-signature requests and financial documents. When recipients clicked these links, they were redirected through trusted domains to attacker-controlled sites, leading to malware downloads. This method effectively bypassed traditional email and browser security defenses, resulting in significant compromises across government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) This incident underscores a growing trend where threat actors leverage legitimate protocol features to conduct malicious activities. The abuse of OAuth redirection highlights the need for organizations to enhance monitoring of authentication flows and implement stricter controls over third-party application permissions to mitigate such evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks
Financial Services8 months ago

IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks

In January 2026, security researchers at Prompt Armor identified a critical vulnerability in IBM's generative AI tool, Bob, which was in its beta phase. The flaw allowed for indirect prompt injection attacks, enabling malicious actors to embed hidden commands within emails or calendar entries. When Bob processed these inputs, it could be manipulated to perform unauthorized actions such as data exfiltration, malware execution, or establishing persistent system access. This vulnerability was particularly concerning due to Bob's integration capabilities with other applications, amplifying the potential attack surface. The incident underscores the inherent risks associated with AI systems that process untrusted data sources. As AI tools become more integrated into business workflows, the potential for such vulnerabilities increases, highlighting the need for robust security measures. Organizations must prioritize the development and implementation of safeguards to prevent prompt injection attacks and ensure the secure deployment of AI technologies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CrushFTP 2025 Brute-Force Attack Highlights Credential Vulnerabilities
Financial Services8 months ago

CrushFTP 2025 Brute-Force Attack Highlights Credential Vulnerabilities

In March 2025, CrushFTP servers were targeted by brute-force attacks exploiting default or weak credentials, particularly the 'crushadmin' account with the password 'crushadmin'. These attacks originated from IP address 5.189.139.225, a French IP with a history of exploit attempts targeting simple vulnerabilities. The attackers aimed to gain unauthorized administrative access, potentially leading to data exfiltration and system compromise. This incident underscores the critical importance of enforcing strong password policies and regularly updating default credentials to prevent unauthorized access. Organizations are advised to review their authentication mechanisms and implement multi-factor authentication where possible to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
March 2026 Iranian Cyberattacks: A Wake-Up Call for Critical Infrastructure Security

March 2026 Iranian Cyberattacks: A Wake-Up Call for Critical Infrastructure Security

In early March 2026, Iranian state-sponsored cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure and government entities across the United States and its allies. These attacks included sophisticated phishing campaigns, deployment of data-exfiltrating malware, and disruptive operations attributed to Iranian-aligned hacktivist groups. The cyber offensive coincided with heightened geopolitical tensions following military strikes in the region, leading to significant disruptions in services and raising concerns over national security vulnerabilities. The escalation underscores the persistent threat posed by nation-state actors leveraging cyber capabilities to achieve strategic objectives. Organizations are urged to enhance their cybersecurity posture, as the current geopolitical climate suggests a continued risk of similar cyber operations targeting critical infrastructure and sensitive data.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Google's March 2026 Android Security Update Addresses Critical Qualcomm Zero-Day
Telecommunications8 months ago

Google's March 2026 Android Security Update Addresses Critical Qualcomm Zero-Day

In March 2026, Google disclosed a high-severity zero-day vulnerability (CVE-2026-21385) affecting an open-source Qualcomm display component in Android devices. This memory-corruption flaw, reported to Qualcomm on December 18, 2025, impacts 234 chipsets. Qualcomm notified its customers on February 2, 2026, and provided fixes in January 2026. The vulnerability has been under limited, targeted exploitation, though specific details on the extent and impact remain undisclosed. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) This incident underscores the critical importance of timely security updates and coordinated disclosure practices. The surge in Android vulnerabilities, with 129 defects addressed in this update—the highest since April 2018—highlights the evolving threat landscape and the necessity for robust vulnerability management strategies. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Deepfake Injection Attacks: A Growing Threat to Identity Verification in 2025
Financial Services8 months ago

Deepfake Injection Attacks: A Growing Threat to Identity Verification in 2025

In 2025, the financial sector faced a significant surge in deepfake and injection attacks targeting identity verification processes. Fraudsters utilized AI-generated media to impersonate individuals during onboarding and authentication, leading to unauthorized access and substantial financial losses. Notably, a multinational firm in Singapore was nearly defrauded of $500,000 when attackers used deepfake video avatars to impersonate company executives during a Zoom call. ([regulaforensics.com](https://regulaforensics.com/blog/identity-verification-incidents-2025/?utm_source=openai)) This incident underscores the escalating threat posed by deepfake technologies in compromising identity verification systems. The increasing sophistication and accessibility of AI tools have enabled attackers to bypass traditional security measures, highlighting the urgent need for enhanced detection and prevention strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing Campaign Exploits Fake Google Security Page and PWA to Steal Credentials
Financial Services8 months ago

Phishing Campaign Exploits Fake Google Security Page and PWA to Steal Credentials

In March 2026, a sophisticated phishing campaign emerged, utilizing a counterfeit Google Account security page to deploy a malicious Progressive Web App (PWA). This app deceived users into granting permissions that enabled the theft of one-time passcodes, cryptocurrency wallet addresses, and other sensitive data. Additionally, the malware transformed victims' browsers into proxies for attacker traffic, facilitating further network exploitation. The attackers employed the domain google-prism[.]com to mimic legitimate Google services, leading users through a deceptive setup process that included installing the harmful PWA and, in some cases, a companion Android application. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms and social engineering to bypass traditional security measures. The use of PWAs in phishing attacks highlights the need for heightened vigilance and the adoption of advanced security protocols to protect against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack

North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack

In March 2026, North Korean state-sponsored hackers launched a sophisticated supply chain attack by publishing 26 malicious npm packages disguised as developer tools. These packages utilized steganography to extract command-and-control (C2) URLs from seemingly benign Pastebin content, ultimately deploying a cross-platform remote access trojan (RAT) targeting developers. The C2 infrastructure was hosted on Vercel across 31 deployments, enabling the attackers to execute commands, exfiltrate sensitive data, and maintain persistent access to compromised systems. This incident underscores the evolving tactics of threat actors in exploiting trusted open-source ecosystems to infiltrate developer environments. The use of steganography and multi-stage payload delivery highlights the increasing complexity of supply chain attacks, emphasizing the need for enhanced vigilance and security measures within the software development community.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
APT28's Exploitation of MSHTML Zero-Day Vulnerability in February 2026

APT28's Exploitation of MSHTML Zero-Day Vulnerability in February 2026

In early 2026, the Russian state-sponsored threat actor APT28 exploited a zero-day vulnerability, CVE-2026-21513, in the MSHTML Framework. This high-severity flaw allowed attackers to bypass security features by convincing users to open malicious HTML or shortcut files, leading to potential code execution. The exploitation occurred before Microsoft's February 2026 Patch Tuesday, which subsequently addressed the vulnerability. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html?utm_source=openai)) The incident underscores the persistent threat posed by state-sponsored actors leveraging zero-day vulnerabilities. Organizations are reminded of the critical importance of timely patch management and user education to mitigate risks associated with such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports