The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Apple Patches 2025 WebKit Zero-Day Exploits Used in Sophisticated Spyware Attacks
In December 2025, Apple urgently released patches for two zero-day vulnerabilities in its WebKit browser engine—CVE-2025-43529 and CVE-2025-14174—after reports of their exploitation in highly sophisticated attacks targeting specific individuals. Discovered in collaboration with Google's Threat Analysis Group, these vulnerabilities enabled potential arbitrary code execution via malicious web content due to use-after-free and memory corruption flaws. The vulnerabilities overlapped with a mysterious zero-day Google patched in Chrome, underlining the risk of cross-platform exposure via shared components. Affected devices included iOS, iPadOS, and macOS, with rapid patch distribution through emergency security advisories. This incident spotlights a growing trend of highly targeted, advanced exploitation chains, frequently leveraging zero-day flaws used in commercial spyware and state-level operations. It underscores the increasing urgency for organizations and individuals to maintain aggressive patch hygiene and layered endpoint defenses as anonymous, sophisticated exploitations proliferate.
8 months ago
Kill Chain
700Credit 2024 Breach: 5.8 Million Dealership Customers' Data Exposed
In early 2024, 700Credit, a US-based fintech firm specializing in credit and compliance solutions for auto dealerships, disclosed a major data breach affecting over 5.8 million individuals. The breach was traced to a vulnerability in a third-party web application platform, resulting in unauthorized access to sensitive customer data submitted to vehicle dealerships across North America. Exposed data included names, addresses, Social Security Numbers, dates of birth, and driver’s license numbers. The breach forced 700Credit to rapidly contain the issue, engage forensic experts, and notify customers, while drawing regulatory scrutiny due to the significant privacy impact. This incident is especially important as it highlights the persistent risks presented by web application vulnerabilities and supply chain exposure across critical business platforms. Increased attacker focus on third-party dependencies and data-rich payment ecosystems continues to drive urgency around zero trust architectures and more proactive monitoring and response.
8 months ago
Kill Chain
How Google's 2024 Research Uncovered Chinese APT Exploitation of React2Shell
In June 2024, Google's Threat Analysis Group expanded the attribution of recent attacks exploiting the critical "React2Shell" remote code execution vulnerability to at least five more Chinese nation-state hacking groups. These attackers leveraged the unpatched React2Shell flaw to gain unauthorized access to systems across multiple sectors, using sophisticated spear-phishing and lateral movement techniques to deploy malware and establish persistence. The affected organizations experienced potential data exposure, operational interruptions, and increased remediation costs while scrambling to patch impacted environments. This incident highlights the evolving capabilities and coordination among multiple Chinese APTs targeting software supply chain weaknesses. The React2Shell exploitation surge demonstrates a significant escalation in the speed and scale of zero-day abuse by coordinated state-affiliated groups. Organizations face heightened urgency to accelerate vulnerability management and enhance east-west traffic monitoring as attackers rapidly weaponize public vulnerabilities.
8 months ago
Kill Chain
SantaStealer: The 2024 Memory-Based Infostealer Malware Targeting Credentials and Crypto Wallets
In early 2024, a new information-stealing malware known as SantaStealer emerged on cybercriminal Telegram channels and hacker forums, operating as a malware-as-a-service (MaaS). Designed to run primarily in memory, SantaStealer avoids traditional file-based detection and targets sensitive data in browsers, cryptocurrency wallets, and installed application credentials. Attackers typically distribute the malware through phishing campaigns and malicious attachments. Once executed, SantaStealer exfiltrates stolen data to command-and-control servers, enabling threat actors to harvest victims' digital assets and credentials for further exploitation or sale on underground markets. The incident underlines a growing trend of evasive, memory-resident stealer malware leveraging MaaS models. Cybercriminals are accelerating adoption of these techniques, raising the stakes for organizations and individuals who store credentials and assets on personal and enterprise endpoints.
8 months ago
Kill Chain
VolkLocker Ransomware Thwarted by Leaked Master Key: Lessons from the CyberVolk 2025 Attack
In August 2025, the pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) launched VolkLocker, a new ransomware-as-a-service aimed at both Windows and Linux systems. SentinelOne researchers discovered that VolkLocker suffered a critical security flaw: a hard-coded master key was inadvertently left in test artifacts, enabling anyone to decrypt files encrypted by the ransomware, bypassing ransom payments. Attackers used typical RaaS deployment methods, leveraging phishing and malicious attachments for initial access. While the group attempted to extort victims, the encryption flaw significantly undermined their efforts. The incident highlights the increased frequency and complexity of ransomware-as-a-service offerings, while underscoring the role of sloppy operator security in containing damage. As similar attacks proliferate, organizations must prioritize incident response and security validation against emerging threats.
8 months ago
Kill Chain
Askul Hit by RansomHouse: 740,000 Customer Records Stolen in 2023 Ransomware Attack
In October 2023, Japanese e-commerce giant Askul Corporation suffered a ransomware attack attributed to the RansomHouse group. Attackers infiltrated Askul's systems, exfiltrating approximately 740,000 customer records containing sensitive personal and contact details before deploying ransomware to encrypt internal data. The breach forced Askul to temporarily suspend some business operations while it investigated the extent of the compromise. The attackers reportedly demanded a ransom in exchange for not releasing the stolen data, putting immense pressure on both customer trust and company reputation. This incident highlights the ongoing threat posed by sophisticated ransomware groups targeting large enterprises, especially in the retail and e-commerce sectors. The scale and impact underscore the necessity for organizations to strengthen data protection, incident response, and segmentation controls, as ransomware actors increasingly focus on data theft before encryption to maximize leverage.
8 months ago
Kill Chain
Critical Apple 0-Days and WinRAR Exploits: How Multi-Vector Threats Changed 2025
In December 2025, a wave of critical zero-day vulnerabilities targeting Apple devices, WinRAR, OAuth implementations, and the .NET framework was actively exploited by various cybercriminal groups. Attackers leveraged these flaws to bypass authentication mechanisms, execute remote code, and escalate privileges across both consumer and enterprise environments. Notably, some exploits were weaponized in the wild before official patches became available, resulting in widespread exposure of unencrypted traffic, unauthorized access to internal networks, and large-scale credential theft. Organizations experienced data breaches, ransomware infections, and regulatory scrutiny, particularly where weak segmentation or inadequate traffic visibility allowed lateral movement. This incident highlights the persistent threat posed by simultaneous multi-vector exploits, especially as attackers rapidly adopt new vulnerabilities in mainstream software. Increased regulatory focus on immediate patching and advanced segmentation underscores the necessity for robust, real-time threat detection and zero trust enforcement across hybrid and multi-cloud ecosystems.
8 months ago
Kill Chain
ShadyPanda’s Browser Extension Supply-Chain Attack Exposes Millions in 2025
In December 2025, security researchers uncovered a widespread supply-chain attack perpetrated by the threat group ShadyPanda, which had silently compromised several popular Chrome and Edge browser extensions. Over the course of seven years, ShadyPanda either published or acquired seemingly innocuous extensions, allowed them to build credibility and large user bases, and then weaponized them through malicious updates. The attackers exploited the implicit trust in browser extension ecosystems to exfiltrate user data and potentially inject hostile code into millions of browsers worldwide, impacting individuals and organizations alike. This incident underscores persistent risks in software supply chains, as threat actors increasingly target trusted application ecosystems to achieve broad access. As browser extensions remain integral to productivity and daily workflows, the event highlights the urgency for organizations to monitor third-party components and reassess extension management, especially amid evolving regulatory scrutiny and attacker sophistication.
8 months ago
Kill Chain
Urban VPN Chrome Extension Found Harvesting AI Chat Prompts from Millions
In late 2025, the "Urban VPN Proxy" Chrome extension—prominently labeled 'Featured' in the Chrome Web Store and boasting over six million users—was discovered silently harvesting all prompts users entered into popular AI chatbots such as ChatGPT, Anthropic Claude, Microsoft Copilot, Google Gemini, and others. Security researchers found the extension covertly intercepted and exfiltrated sensitive data in real time, leveraging its widespread user base and the inherent trust of its browser privileges. The extension’s activity amounted to a massive privacy breach, putting both individuals and enterprises at risk of data exposure. This breach highlights a surge in supply chain and third-party risks posed by browser extensions in the modern SaaS ecosystem. Enterprise security teams face heightened challenges as unregulated extensions become vectors for data harvesting, especially as reliance on AI tools increases. Privacy expectations, compliance obligations, and trust in official app marketplaces are now under renewed scrutiny.
8 months ago
Kill Chain
CISA Adds Apple & Gladinet Vulnerabilities to Known Exploited List (2025)
In December 2025, the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2025-14611 (Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability) and CVE-2025-43529 (Apple Multiple Products Use-After-Free WebKit Vulnerability) to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed reports of active exploitation. These flaws allow attackers to gain unauthorized access, execute arbitrary code, and compromise sensitive data by leveraging weaknesses in encryption and browser components. Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate these vulnerabilities by the stipulated deadlines to mitigate risks to critical government infrastructure. These additions reflect an ongoing surge in sophisticated vulnerability exploitation targeting both proprietary business platforms and widely used consumer products. Emerging attacker tactics and the regulatory environment reinforce the importance of robust, timely vulnerability management—underscoring that prioritizing patching of KEV-listed CVEs is now a best practice for all organizations.
8 months ago
Kill Chain
FreePBX 2025: Critical SQL Injection & Authentication Bypass Threatens Telecom Security
In September 2025, researchers from Horizon3.ai disclosed multiple severe vulnerabilities in FreePBX, an open-source private branch exchange (PBX) platform. These flaws, notably including a critical authentication bypass (CVE-2025-61675) and SQL injection issues, enabled remote code execution under certain configurations. Attackers could exploit these weaknesses to upload malicious files, bypass authentication controls, and potentially gain full system access. The vulnerabilities were responsibly reported to project maintainers, prompting urgent security patches and advisories to all FreePBX users. Organizations using affected versions faced significant risks, ranging from service disruption to compromise of sensitive communications and voicemail data. This incident highlights the persistent threat posed by application-layer vulnerabilities in widely deployed open-source communications platforms. The rise of telephony-based attacks and increasingly sophisticated exploitation tactics underscore the need for proactive patch management, rigorous code auditing, and supply chain security in telecom infrastructure.
8 months ago
Kill Chain
React2Shell CVE-2025-55182: Remote Code Execution Attacks Surge in 2025
In December 2025, active exploitation of a critical vulnerability in React2Shell (CVE-2025-55182) was detected, enabling remote code execution on unpatched servers. Attackers deployed a sequence of crafted HTTP requests to download and write malicious binaries onto world-writable Linux directories, such as /dev/shm and /tmp, then modified permissions to prepare for subsequent execution. The threat was identified by security researchers monitoring exploit payloads, which often leveraged ambiguous malware—classified as either adware or crypto miners—resulting in the compromise of affected servers and potentially unauthorized resource usage or data exfiltration. This campaign exemplifies the ongoing risk posed by delayed patch management, with adversaries swiftly evolving their payloads and exploiting widespread attack surfaces. The frequency of similar incidents underscores the importance of timely security updates and hardened configurations, particularly for widely deployed web services.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports