Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 274 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3277–3288 / 4903 reports
OpenClaw 2026: Critical Supply Chain Vulnerabilities Uncovered
Computer Software/Engineering8 months ago

OpenClaw 2026: Critical Supply Chain Vulnerabilities Uncovered

In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, an open-source AI assistant platform. These included CVE-2026-25253, allowing remote code execution via crafted URLs, and CVE-2026-24763, enabling command injection through unsafe handling of environment variables. Exploitation of these flaws could grant attackers unauthorized access to systems, leading to data breaches and system compromises. OpenClaw has since released patches to address these issues. ([smarttech247.com](https://www.smarttech247.com/threat-intel-reports/critical-openclaw-vulnerability-allows-1-click-remote-code-execution?utm_source=openai)) The rapid adoption of AI assistant tools like OpenClaw underscores the importance of securing software supply chains. Organizations must remain vigilant, ensuring timely updates and thorough vetting of third-party extensions to mitigate emerging threats in AI ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BeyondTrust's Critical RCE Vulnerability: A 2026 Cybersecurity Wake-Up Call
Information Technology/IT8 months ago

BeyondTrust's Critical RCE Vulnerability: A 2026 Cybersecurity Wake-Up Call

In February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute operating system commands remotely, potentially leading to full system compromise, unauthorized access, data exfiltration, and service disruption. The vulnerability impacts Remote Support versions 25.3.1 and prior, and Privileged Remote Access versions 24.3.4 and prior. BeyondTrust applied patches for SaaS customers on February 2, 2026, but self-hosted customers must manually apply updates to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/09/beyondtrust-remote-access-vulnerability-cve-2026-1731/?utm_source=openai)) The rapid exploitation of CVE-2026-1731 underscores the increasing speed at which threat actors leverage newly disclosed vulnerabilities. Within 24 hours of a proof-of-concept exploit being released, attackers began targeting vulnerable systems. This incident highlights the critical importance of timely patch management and proactive security measures to defend against emerging threats. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Change Healthcare's 2024 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences8 months ago

Change Healthcare's 2024 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity

In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a significant ransomware attack orchestrated by the Russian group ALPHV (BlackCat). The attackers exploited a server lacking multifactor authentication, gaining unauthorized access and encrypting critical systems. This breach disrupted essential healthcare operations nationwide, including insurance eligibility verification, prescription processing, and claims management, affecting approximately 190 million individuals. The incident underscored the vulnerabilities in third-party service providers within the healthcare sector, prompting the Department of Health and Human Services to intensify efforts in identifying and mitigating such risks. The attack's magnitude and impact have led to increased regulatory scrutiny and a reevaluation of cybersecurity practices across the industry.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ukrainian National Sentenced for Facilitating North Korean IT Worker Scheme
Information Technology/IT8 months ago

Ukrainian National Sentenced for Facilitating North Korean IT Worker Scheme

In February 2026, Ukrainian national Oleksandr Didenko was sentenced to five years in U.S. federal prison for orchestrating a scheme that enabled North Korean IT workers to fraudulently secure employment at 40 American companies. Didenko operated the website upworksell.com, through which he sold stolen U.S. citizens' identities, facilitating the creation of over 2,500 fraudulent accounts on various platforms. These actions allowed North Korean operatives to infiltrate U.S. businesses, diverting hundreds of thousands of dollars to the North Korean regime, thereby supporting its munitions programs. This case underscores the persistent threat posed by state-sponsored cyber operations and the exploitation of identity theft to circumvent international sanctions. The incident highlights the critical need for robust identity verification processes and vigilant monitoring of remote workforces to prevent unauthorized access and protect national security interests.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Massiv Android Banking Malware: A New Threat in 2026
Banking/Mortgage8 months ago

Massiv Android Banking Malware: A New Threat in 2026

In early 2026, cybersecurity researchers identified a new Android banking malware named Massiv, which masquerades as IPTV applications to infiltrate devices. Once installed, Massiv employs screen overlays and keylogging to steal sensitive information, including banking credentials, and can remotely control compromised devices. Notably, it targeted the Portuguese government's Chave Móvel Digital app, potentially allowing attackers to bypass KYC verifications and access banking accounts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-massiv-android-banking-malware-poses-as-an-iptv-app/?utm_source=openai)) This incident underscores a growing trend where cybercriminals exploit popular app themes, like IPTV, to distribute malware. The increasing sophistication of such attacks highlights the urgent need for enhanced mobile security measures and user vigilance against downloading apps from unverified sources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Operation Red Card 2.0: Unveiling Africa's Cybercrime Crackdown
Financial Services8 months ago

Operation Red Card 2.0: Unveiling Africa's Cybercrime Crackdown

Between December 8, 2025, and January 30, 2026, INTERPOL coordinated Operation Red Card 2.0, leading to the arrest of 651 individuals across 16 African countries. This operation targeted cybercriminal networks involved in investment fraud, mobile money scams, and fraudulent loan applications, resulting in the identification of 1,247 victims and the recovery of over $4.3 million. Authorities also seized 2,341 devices and dismantled 1,442 malicious websites, domains, and servers. Notably, in Nigeria, police dismantled an investment fraud ring and arrested six individuals who had breached a major telecom provider using stolen employee credentials. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/Major-operation-in-Africa-targeting-online-scams-nets-651-arrests-recovers-USD-4.3-million?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online scams and financial frauds becoming increasingly prevalent. The success of Operation Red Card 2.0 highlights the critical need for international collaboration and proactive measures to combat transnational cybercriminal activities effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ShinyHunters' 2026 Attack: Exploiting OAuth Device Code Flow in Microsoft Entra
Information Technology/IT8 months ago

ShinyHunters' 2026 Attack: Exploiting OAuth Device Code Flow in Microsoft Entra

In early 2026, the cybercriminal group ShinyHunters orchestrated a sophisticated attack targeting Microsoft Entra accounts. By combining device code phishing with voice phishing (vishing), they exploited the OAuth 2.0 Device Authorization flow. Attackers generated legitimate device codes and, through impersonation of IT staff, convinced employees to enter these codes on authentic Microsoft login pages. This manipulation granted the attackers valid authentication tokens, enabling unauthorized access to victims' accounts and associated Single Sign-On (SSO) applications, including Microsoft 365, Salesforce, and Google Workspace. The breach led to significant data exfiltration and subsequent extortion attempts. This incident underscores a concerning evolution in phishing tactics, moving beyond traditional credential theft to the exploitation of trusted authentication processes. The success of such attacks highlights the pressing need for organizations to adopt phishing-resistant multi-factor authentication (MFA) methods and to enhance employee awareness regarding emerging social engineering techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Texas Sues TP-Link Over Chinese Hacking Risks
Telecommunications8 months ago

Texas Sues TP-Link Over Chinese Hacking Risks

In February 2026, the Texas Attorney General filed a lawsuit against TP-Link Systems Inc., alleging deceptive marketing practices and security vulnerabilities in their networking devices. The suit claims that TP-Link misled consumers by labeling products as 'Made in Vietnam' while sourcing components from China, potentially exposing users to Chinese state-sponsored cyberattacks. The lawsuit highlights instances where TP-Link routers were exploited by Chinese hacking groups, such as the Quad7 botnet, to conduct credential-theft operations targeting U.S. entities. This legal action underscores the growing concern over supply chain security and the integrity of networking equipment used by consumers and businesses. As cyber threats evolve, ensuring transparency in product sourcing and robust security measures in networking devices becomes increasingly critical to protect against state-sponsored cyber espionage and attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Nigerian Hacker Sentenced for Tax Firm Breach Using Warzone RAT
Accounting8 months ago

Nigerian Hacker Sentenced for Tax Firm Breach Using Warzone RAT

Between June 2016 and June 2021, Nigerian national Matthew Abiodun Akande orchestrated a sophisticated cyber intrusion targeting multiple tax preparation firms in Massachusetts. Utilizing phishing emails that impersonated a CEO, Akande deployed the Warzone remote-access trojan (RAT) to infiltrate the firms' networks. This allowed him to steal clients' personal information, leading to the filing of over 1,000 fraudulent tax returns and the illicit collection of more than $1.3 million in refunds. Akande was arrested in October 2024 at London's Heathrow Airport, extradited to the United States in March 2025, and sentenced to eight years in prison in February 2026. ([justice.gov](https://www.justice.gov/usao-ma/pr/nigerian-man-sentenced-eight-years-prison-computer-intrusion-and-theft?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated phishing campaigns and the use of advanced malware like RATs in financial fraud schemes. It highlights the critical need for organizations, especially those handling sensitive client data, to implement robust cybersecurity measures and employee training to prevent such breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Infostealer Credential Theft Surges 800% in 2025
Financial Services8 months ago

Infostealer Credential Theft Surges 800% in 2025

In 2025, cybercriminals escalated their use of infostealer malware, leading to the theft of 1.8 billion credentials—a staggering 800% increase compared to the previous year. These infostealers infiltrated 5.8 million devices, extracting sensitive data such as login credentials, cookies, and financial information. The stolen credentials were subsequently sold on dark web marketplaces, facilitating further cyberattacks including ransomware and data breaches. Notably, major organizations like Deloitte, KPMG, and Samsung fell victim to these attacks due to inadequate enforcement of multi-factor authentication (MFA), underscoring the critical need for robust security measures. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/staggering-800-rise-infostealer/?utm_source=openai)) This surge in credential theft highlights a significant shift in cybercriminal tactics, emphasizing the exploitation of identity-based vulnerabilities. The convergence of infostealers and ransomware has created rapid extortion chains, where stolen credentials are quickly leveraged to deploy ransomware within organizations. This trend underscores the urgency for businesses to implement comprehensive security strategies, including the enforcement of MFA, regular credential monitoring, and employee education on phishing and malware threats. ([cyfirma.com](https://www.cyfirma.com/research/the-convergence-of-infostealers-and-ransomware-from-credential-harvesting-to-rapid-extortion-chains/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Massiv Android Trojan Exploits IPTV Apps for Device Takeover Attacks in 2026
Banking/Mortgage8 months ago

Massiv Android Trojan Exploits IPTV Apps for Device Takeover Attacks in 2026

In early 2026, cybersecurity researchers identified a new Android trojan named Massiv, which masquerades as IPTV applications to infiltrate devices. Once installed, Massiv enables attackers to remotely control infected devices, facilitating device takeover attacks that lead to unauthorized financial transactions from victims' banking accounts. The malware employs techniques such as screen streaming, keylogging, SMS interception, and fake overlays to steal sensitive information. Notably, it has targeted applications like Portugal's gov.pt, exploiting digital identity systems to bypass Know Your Customer (KYC) verifications and open fraudulent accounts in victims' names. This incident underscores the evolving tactics of cybercriminals who exploit popular app themes to distribute malware, highlighting the need for heightened vigilance among mobile banking users. The use of IPTV app disguises reflects a broader trend of leveraging entertainment-related applications to deceive users, emphasizing the importance of downloading apps only from trusted sources and maintaining robust security practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Patches Critical Privilege Escalation Vulnerability in Windows Admin Center
Information Technology/IT8 months ago

Microsoft Patches Critical Privilege Escalation Vulnerability in Windows Admin Center

In February 2026, Microsoft disclosed a critical security vulnerability (CVE-2026-26119) in Windows Admin Center, a browser-based management tool for Windows environments. This flaw, rated with a CVSS score of 8.8, stemmed from improper authentication mechanisms, allowing authorized attackers to escalate their privileges over a network. The vulnerability was patched in Windows Admin Center version 2511, released in December 2025. While no active exploitation was reported at the time, Microsoft assessed the likelihood of exploitation as high. This incident underscores the importance of timely software updates and robust authentication protocols. Organizations relying on Windows Admin Center should ensure they have applied the latest patches to mitigate potential risks associated with privilege escalation vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports