Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 277 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3313–3324 / 4903 reports
AI Discovers Critical OpenSSL Vulnerabilities in 2026
Financial Services8 months ago

AI Discovers Critical OpenSSL Vulnerabilities in 2026

In January 2026, the AI-assisted cybersecurity firm Aisle identified twelve previously undisclosed vulnerabilities in OpenSSL, a widely used cryptographic library essential for secure internet communications. These vulnerabilities, some dating back to 1998, included critical issues like CVE-2025-15467, a stack buffer overflow in CMS message parsing that could lead to remote code execution. OpenSSL rated this vulnerability as HIGH severity, with a CVSS v3 score of 9.8 out of 10. The discovery underscores the potential of AI in enhancing cybersecurity measures by identifying complex vulnerabilities that have eluded traditional detection methods. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/ai-assisted-cybersecurity-team-discovers-12-openssl-vulnerabilities-claims-humans-are-the-limiting-factor-some-vulnerabilities-have-been-around-for-decades?utm_source=openai)) The findings highlight the evolving landscape of cybersecurity, where AI tools are becoming instrumental in proactively identifying and mitigating risks. This shift emphasizes the need for organizations to integrate AI-driven solutions into their security protocols to stay ahead of sophisticated cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Chinese APT UNC6201 Exploits Dell RecoverPoint Zero-Day Vulnerability
Government Administration8 months ago

Chinese APT UNC6201 Exploits Dell RecoverPoint Zero-Day Vulnerability

In mid-2024, the Chinese state-sponsored threat group UNC6201 exploited a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines. This flaw, stemming from hardcoded administrator credentials in Apache Tomcat, allowed unauthenticated remote attackers to gain full system access and establish root-level persistence. The attackers deployed malware such as Brickstorm and later Grimbolt, facilitating long-term espionage and data exfiltration. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure. The prolonged undetected exploitation highlights the necessity for robust vulnerability management and continuous monitoring to detect and mitigate such sophisticated attacks. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Poland's Crackdown on Phobos Ransomware: A 2026 Update
Health Care / Life Sciences8 months ago

Poland's Crackdown on Phobos Ransomware: A 2026 Update

In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of 'Operation Aether,' an international effort coordinated by Europol targeting Phobos ransomware infrastructure and affiliates. During the operation, law enforcement seized computers and mobile phones containing stolen credentials, credit card numbers, and server access data, which could be used to facilitate ransomware attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/poland-arrests-suspect-linked-to-phobos-ransomware-operation/?utm_source=openai)) This arrest underscores the ongoing global efforts to dismantle ransomware operations and highlights the persistent threat posed by groups like Phobos. Organizations are reminded to bolster their cybersecurity defenses, particularly around Remote Desktop Protocol (RDP) configurations, to mitigate the risk of such attacks.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Intruder 2026: Unveiling Exposed Secrets in JavaScript Bundles
Computer Software/Engineering8 months ago

Intruder 2026: Unveiling Exposed Secrets in JavaScript Bundles

In December 2025, Intruder's research team conducted a comprehensive scan of 5 million applications, uncovering over 42,000 exposed tokens hidden within JavaScript bundles. These tokens included sensitive credentials such as code repository access tokens and project management API keys, many of which were active and provided unauthorized access to critical systems. The exposure was attributed to limitations in traditional security tools, which often fail to detect secrets embedded in front-end code, particularly within single-page applications. This incident underscores the urgent need for enhanced secrets detection methods that can effectively identify and mitigate such vulnerabilities in modern web applications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Chinese Hackers Exploit Dell Zero-Day Vulnerability in 2024
Computer Hardware8 months ago

Chinese Hackers Exploit Dell Zero-Day Vulnerability in 2024

In mid-2024, the Chinese state-sponsored hacking group UNC6201 began exploiting a critical vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines, a solution integral to VMware virtual machine backup and recovery. This hardcoded credential flaw allowed unauthenticated remote attackers to gain unauthorized access to the underlying operating system, achieving root-level persistence. Once inside, UNC6201 deployed advanced malware, including the Grimbolt backdoor, and utilized novel techniques like creating hidden network interfaces ('Ghost NICs') on VMware ESXi servers to move stealthily across networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))This incident underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure through zero-day vulnerabilities. The exploitation of such flaws highlights the necessity for organizations to maintain rigorous patch management and continuous monitoring to detect and mitigate sophisticated cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in Popular VSCode Extensions Expose Developers to Attacks
Computer Software/Engineering8 months ago

Critical Vulnerabilities in Popular VSCode Extensions Expose Developers to Attacks

In February 2026, critical vulnerabilities were discovered in several widely-used Visual Studio Code (VSCode) extensions, including Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview. These extensions, collectively downloaded over 128 million times, contained flaws that could be exploited to steal local files and execute remote code. The vulnerabilities were identified by Ox Security, which attempted disclosure since June 2025 without receiving responses from the maintainers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/flaws-in-popular-vscode-extensions-expose-developers-to-attacks/?utm_source=openai)) This incident underscores the escalating risks associated with third-party development tools and the necessity for rigorous security assessments of IDE extensions. The widespread adoption of these vulnerable extensions highlights the potential for significant supply chain attacks targeting developers and organizations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Uncovers AI Recommendation Poisoning Threat
Financial Services8 months ago

Microsoft Uncovers AI Recommendation Poisoning Threat

In February 2026, Microsoft disclosed a new cyber threat termed 'AI Recommendation Poisoning,' where businesses embed hidden instructions within 'Summarize with AI' buttons on their websites. When users click these buttons, the AI assistant's memory is manipulated via URL prompt parameters to favor certain companies or products in future recommendations. Over a 60-day period, Microsoft identified over 50 unique prompts from 31 companies across 14 industries, raising concerns about the integrity of AI-driven insights. This technique mirrors traditional search engine optimization (SEO) manipulation but targets AI systems directly, potentially leading to biased recommendations in critical areas such as health, finance, and security without user awareness. The emergence of AI Recommendation Poisoning underscores the evolving landscape of cyber threats targeting artificial intelligence systems. As AI becomes increasingly integrated into decision-making processes, ensuring the neutrality and reliability of AI outputs is paramount. Organizations must implement robust security measures to detect and prevent such manipulations to maintain trust in AI-driven recommendations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
AI Assistants Abused as Command-and-Control Proxies in Recent Cyberattacks
Computer Software/Engineering8 months ago

AI Assistants Abused as Command-and-Control Proxies in Recent Cyberattacks

In February 2026, cybersecurity researchers disclosed a novel attack technique where AI assistants with web browsing capabilities, such as Microsoft Copilot and xAI Grok, were exploited as covert command-and-control (C2) proxies. This method, termed 'AI as a C2 proxy' by Check Point Research, allows attackers to blend malicious traffic with legitimate enterprise communications, thereby evading detection. The attack leverages anonymous web access combined with browsing and summarization prompts to create a bidirectional channel for data exfiltration and command execution. This development underscores the evolving threat landscape, where AI systems are not only tools for enhancing productivity but also potential vectors for sophisticated cyberattacks. The ability to abuse AI assistants as C2 proxies highlights the need for organizations to reassess their security postures, especially concerning the integration and use of AI technologies within their networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Whisper Leak: Unveiling Side-Channel Vulnerabilities in LLMs
Health Care / Life Sciences8 months ago

Whisper Leak: Unveiling Side-Channel Vulnerabilities in LLMs

In November 2025, researchers Geoff McDonald and Jonathan Bar Or identified a side-channel vulnerability in Large Language Models (LLMs) termed 'Whisper Leak.' This attack exploits patterns in encrypted network traffic—specifically packet sizes and timing—to infer user prompt topics during LLM interactions. Despite TLS encryption, these metadata patterns allow adversaries to classify conversation topics with high accuracy, posing significant privacy risks. The study demonstrated the attack's effectiveness across 28 popular LLMs, achieving near-perfect classification rates and high precision even in scenarios with extreme class imbalance. ([microsoft.com](https://www.microsoft.com/en-us/research/publication/whisper-leak-a-side-channel-attack-on-large-language-models/?utm_source=openai)) The discovery of Whisper Leak underscores the urgent need for LLM providers to address metadata leakage vulnerabilities. As LLMs are increasingly deployed in sensitive domains such as healthcare and legal services, ensuring robust privacy protections is paramount. The researchers evaluated mitigation strategies like random padding, token batching, and packet injection; however, none provided complete protection, highlighting the complexity of securing LLM communications against side-channel attacks. ([microsoft.com](https://www.microsoft.com/en-us/research/publication/whisper-leak-a-side-channel-attack-on-large-language-models/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Salesloft Drift Breach 2025: A Wake-Up Call for SaaS Security
Financial Services8 months ago

Salesloft Drift Breach 2025: A Wake-Up Call for SaaS Security

In August 2025, Salesloft's Drift application suffered a significant security breach when attackers exploited compromised OAuth tokens to access and exfiltrate data from over 700 organizations' Salesforce instances. The breach exposed sensitive information, including customer contact details, support case data, and, in some cases, credentials such as AWS access keys and passwords. Prominent companies like Cloudflare, Zscaler, and Palo Alto Networks were among those affected. The attackers, identified as the group "Scattered Lapsus$ Hunters," demanded nearly $1 billion in ransom to prevent the public release of the stolen data. This incident underscores the critical vulnerabilities associated with third-party integrations and the importance of robust security measures to protect against supply chain attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding the 2026 ClickFix DNS PowerShell Attack
Financial Services8 months ago

Understanding the 2026 ClickFix DNS PowerShell Attack

In February 2026, a new variant of the ClickFix social engineering attack emerged, exploiting DNS queries to deliver malicious payloads. Attackers deceived users into executing an 'nslookup' command via the Windows Run dialog, which queried an attacker-controlled DNS server. The server responded with a DNS record containing a malicious PowerShell script, leading to the installation of malware, including the remote access trojan ModeloRAT. This method allowed attackers to blend malicious activities within normal DNS traffic, evading traditional detection mechanisms. This incident underscores the evolving sophistication of social engineering attacks, highlighting the need for heightened awareness and advanced security measures. The use of DNS as a delivery mechanism signifies a shift in attacker tactics, emphasizing the importance of monitoring DNS traffic and educating users about the risks of executing unsolicited commands.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
ShinyHunters Expose 600K Canada Goose Customer Records in 2026 Data Breach
Apparel/Fashion8 months ago

ShinyHunters Expose 600K Canada Goose Customer Records in 2026 Data Breach

In February 2026, the cybercriminal group ShinyHunters claimed responsibility for exfiltrating over 600,000 customer records from Canada Goose, a luxury outerwear brand. The compromised data includes personal information such as names, email addresses, phone numbers, billing and shipping addresses, IP addresses, and order histories. Additionally, partial payment card information, including card brands and the last four digits of card numbers, was exposed. Canada Goose has stated that the dataset appears to relate to past customer transactions and that there is no evidence of a breach of its own systems. The company is currently reviewing the dataset to assess its accuracy and scope. This incident underscores the persistent threat posed by data extortion groups like ShinyHunters, who have been linked to numerous high-profile breaches targeting e-commerce platforms and cloud environments. Organizations are urged to enhance their cybersecurity measures, particularly in securing customer data and monitoring third-party service providers, to mitigate the risk of such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports