Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 273 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3265–3276 / 4903 reports
North Korean IT Workers Exploit Remote Work to Infiltrate U.S. Companies in 2025
Information Technology/IT8 months ago

North Korean IT Workers Exploit Remote Work to Infiltrate U.S. Companies in 2025

In 2025, U.S. authorities uncovered a sophisticated scheme where North Korean IT workers, using stolen or fabricated identities, secured remote positions within over 300 U.S. companies. These operatives, often based in China and Russia, infiltrated organizations by posing as legitimate American employees, thereby accessing sensitive corporate data and systems. The illicit earnings, estimated at over $88 million, were funneled back to North Korea to support its weapons programs. ([forbes.com](https://www.forbes.com/sites/alonzomartinez/2025/04/25/north-korean-hackers-pose-as-remote-workers-to-infiltrate-us-firms/?utm_source=openai)) This incident underscores the escalating threat of nation-state actors exploiting remote work vulnerabilities to bypass traditional security measures. The use of advanced tactics, including AI-generated profiles and deepfake technologies, highlights the need for enhanced identity verification processes and continuous monitoring of remote access points to safeguard organizational assets. ([fortune.com](https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PayPal's 2025 Data Breach: A Cautionary Tale in Financial Data Security
Financial Services8 months ago

PayPal's 2025 Data Breach: A Cautionary Tale in Financial Data Security

In 2025, PayPal experienced a significant data breach due to a code change in its Working Capital application, which inadvertently exposed sensitive customer information, including Social Security numbers and dates of birth, for nearly six months. The breach was discovered on December 12, 2025, but had been active since July 1, 2025. Approximately 100 customers were affected by this incident. ([cybernews.com](https://cybernews.com/security/paypal-six-month-breach-ssn-working-capital-app/?utm_source=openai)) This incident underscores the critical importance of rigorous code review processes and robust access controls in financial applications. The prolonged exposure period highlights the necessity for continuous monitoring and rapid response mechanisms to detect and mitigate unauthorized access to sensitive data.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Credential Theft Leads to Massive Data Breach at French Ministry of Finance
Banking/Mortgage8 months ago

Credential Theft Leads to Massive Data Breach at French Ministry of Finance

In late January 2026, the French Ministry of Finance reported a significant data breach involving unauthorized access to the national bank account registry, FICOBA. A threat actor exploited stolen credentials from a government official to access sensitive information on approximately 1.2 million bank accounts. The compromised data included bank account details (RIBs/IBANs), account holder identities, physical addresses, and, in some cases, taxpayer identification numbers. Upon detection, the Ministry promptly restricted the unauthorized access and initiated measures to notify affected individuals and financial institutions. This incident underscores the critical importance of robust access controls and credential management within governmental systems. The breach highlights the escalating risks associated with credential theft and the necessity for enhanced cybersecurity measures to protect sensitive financial data. Organizations are urged to reassess their security protocols to mitigate similar threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks
Information Technology/IT8 months ago

BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks

In early February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted requests to vulnerable endpoints. Despite the release of patches, active exploitation began almost immediately, with threat actors deploying ransomware and exfiltrating data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, emphasizing the urgency for organizations to apply the necessary updates. The rapid exploitation of CVE-2026-1731 underscores a concerning trend where attackers swiftly leverage newly disclosed vulnerabilities to launch ransomware campaigns. This incident highlights the critical need for organizations to implement robust patch management processes and maintain vigilant monitoring to detect and respond to such threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FBI Reports Surge in ATM Jackpotting Attacks in 2025
Banking/Mortgage8 months ago

FBI Reports Surge in ATM Jackpotting Attacks in 2025

In 2025, the FBI reported a significant surge in ATM jackpotting incidents across the United States, with over 700 attacks resulting in more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs, often deploying malware like Ploutus to force machines to dispense cash without legitimate transactions. Criminals typically gain access by using generic keys to open ATM fronts and then install malware to control the machines remotely. This alarming trend underscores the evolving tactics of cybercriminals and highlights the urgent need for financial institutions to bolster their ATM security measures. The rise in such sophisticated attacks calls for enhanced vigilance and the implementation of robust security protocols to protect against these threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Ukrainian National Sentenced for Facilitating North Korean IT Worker Fraud
Information Technology/IT8 months ago

Ukrainian National Sentenced for Facilitating North Korean IT Worker Fraud

In February 2026, Ukrainian national Oleksandr Didenko was sentenced to five years in U.S. federal prison for orchestrating a scheme that enabled North Korean IT workers to fraudulently secure employment at 40 U.S. companies. Didenko operated the website Upworksell.com, facilitating the sale of stolen U.S. citizen identities to these workers, who then funneled their earnings back to North Korea to support its weapons programs. He also managed multiple 'laptop farms' in the U.S. to create the illusion of domestic employment locations. This case underscores the persistent threat of nation-state actors exploiting identity theft to infiltrate and financially exploit U.S. businesses. The incident highlights the evolving tactics of North Korean operatives, who now leverage authentic LinkedIn profiles to enhance the credibility of their fraudulent job applications, posing ongoing risks to corporate security and compliance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Cline CLI Supply Chain Attack: Lessons in Software Security
Computer Software/Engineering8 months ago

Cline CLI Supply Chain Attack: Lessons in Software Security

In February 2026, the Cline CLI, a widely used AI coding assistant, was compromised through a supply chain attack. An unauthorized party exploited a stolen npm publish token to release version 2.3.0 of Cline CLI, which included a modified package.json file. This modification added a postinstall script that silently installed OpenClaw, an unrelated open-source package, on developers' systems upon installation. The malicious version was available for approximately eight hours before being deprecated, during which it was downloaded around 4,000 times. The Cline team responded by revoking the compromised token, publishing a corrected version (2.4.0), and enhancing their release pipeline security. This incident underscores the escalating threat of supply chain attacks targeting developer tools. The unauthorized installation of OpenClaw, while not inherently malicious, highlights the potential for more harmful payloads in future attacks. Organizations are urged to audit their development environments and enforce stringent security measures to mitigate such risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
BeyondTrust CVE-2026-1731 Exploitation: A 2026 Cybersecurity Incident
Financial Services8 months ago

BeyondTrust CVE-2026-1731 Exploitation: A 2026 Cybersecurity Incident

In February 2026, a critical vulnerability (CVE-2026-1731) in BeyondTrust's Remote Support (RS) and Privileged Remote Access (PRA) products was actively exploited by threat actors. This pre-authentication remote code execution flaw allowed attackers to execute operating system commands as the site user, leading to unauthorized access, data exfiltration, and service disruptions. The attacks targeted sectors including financial services, legal services, high technology, higher education, wholesale and retail, and healthcare across multiple countries. The exploitation involved deploying web shells, backdoors, and remote management tools, facilitating lateral movement and data theft. Notably, malware such as VShell and Spark RAT were utilized. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to include CVE-2026-1731, confirming its use in ransomware campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Abu Dhabi Finance Week 2026 Data Breach: A Cloud Misconfiguration Exposes VIP Passport Details
Financial Services8 months ago

Abu Dhabi Finance Week 2026 Data Breach: A Cloud Misconfiguration Exposes VIP Passport Details

In early February 2026, Abu Dhabi Finance Week (ADFW) experienced a significant data breach due to a misconfigured cloud storage environment managed by a third-party vendor. This misconfiguration exposed scans of over 700 passports and identity cards belonging to high-profile attendees, including former British Prime Minister David Cameron and U.S. investor Anthony Scaramucci. The breach was discovered by cybersecurity researcher Roni Suchowski, who found that the sensitive documents were publicly accessible without password protection. Upon notification, ADFW promptly secured the environment and stated that access activity was limited to the researcher who identified the issue. The incident underscores the critical importance of securing cloud storage configurations to prevent unauthorized access to sensitive information. ([techradar.com](https://www.techradar.com/pro/security/abu-dhabi-finance-summit-exposes-personal-data-passport-info-of-hundreds-of-major-global-figures?utm_source=openai)) This breach highlights the ongoing risks associated with cloud misconfigurations, which continue to be a leading cause of data exposure. As organizations increasingly rely on cloud services, ensuring proper configuration and regular security audits is essential to protect sensitive data and maintain trust with stakeholders.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Cline 2026 Supply Chain Attack: Lessons Learned
Computer Software/Engineering8 months ago

Cline 2026 Supply Chain Attack: Lessons Learned

In February 2026, the Cline CLI npm package, a widely used AI coding assistant, was compromised through a supply chain attack. An unauthorized party exploited a stolen npm publish token to release version 2.3.0, which included a postinstall script that silently installed the OpenClaw package globally on users' machines. This malicious version was available for approximately eight hours before being deprecated, during which it was downloaded over 4,000 times. While OpenClaw itself is not malicious, its unauthorized installation raised significant security concerns. This incident underscores the escalating threat of supply chain attacks targeting developer tools and the necessity for robust security measures in software distribution pipelines.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
Financial Services8 months ago

Starkiller Phishing Kit: A New Era of MFA Bypass Attacks

In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform that enables cybercriminals to bypass multi-factor authentication (MFA) by proxying live login pages. Unlike traditional phishing kits that use static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to relay real-time authentication sessions, capturing credentials, MFA codes, and session tokens as users interact with legitimate sites. This approach allows attackers to harvest sensitive information without raising user suspicion. The platform is distributed on the dark web with a subscription model, offering updates and customer support, thereby lowering the technical barrier for launching credential-stealing campaigns at scale. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa/?utm_source=openai)) The emergence of Starkiller highlights a significant escalation in phishing infrastructure, demonstrating a shift towards real-time, session-aware compromises that render traditional detection methods, such as static page analysis and URL blocklisting, less effective. Organizations are urged to adopt behavioral and identity-aware detection strategies, including monitoring for anomalous sign-ins and session token reuse, to mitigate the risks posed by such advanced phishing platforms. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OpenClaw 2026 Infostealer Malware Attack: A Wake-Up Call for AI Security
Computer Software/Engineering8 months ago

OpenClaw 2026 Infostealer Malware Attack: A Wake-Up Call for AI Security

In February 2026, OpenClaw, an open-source AI assistant formerly known as Clawdbot and Moltbot, became the target of infostealer malware. Cybersecurity firm Hudson Rock reported that attackers exploited OpenClaw's configuration, which stores sensitive information like API keys and authentication tokens, to extract valuable data. The malware accessed these configurations during standard data-grabbing operations, leading to potential exposure of user credentials and other sensitive information. This incident underscores the growing vulnerability of AI assistant tools as they become more integrated into professional workflows. ([techradar.com](https://www.techradar.com/pro/security/openclaw-ai-agents-targeted-by-infostealer-malware-for-the-first-time?utm_source=openai)) The attack highlights a significant shift in malware trends, with cybercriminals developing specialized modules to target AI agent configurations. As AI assistants like OpenClaw gain popularity, they present new attack surfaces for threat actors, emphasizing the need for robust security measures and vigilant monitoring to protect sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports