Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 293 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3505–3516 / 4903 reports
Chainlit 2026 Supply-Chain Flaws Let Hackers Breach Cloud AI Environments
Computer Software/Engineering9 months ago

Chainlit 2026 Supply-Chain Flaws Let Hackers Breach Cloud AI Environments

In early 2026, two high-severity vulnerabilities ('ChainLeak') were discovered in Chainlit, a widely adopted open-source conversational AI framework, exposing cloud environments to significant risk. The flaws—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery)—could be exploited without user interaction, allowing attackers to access sensitive files and internal services on internet-facing production systems. Zafran Labs demonstrated that chaining both vulnerabilities enabled full-system compromise and lateral movement within enterprise cloud environments before a patch (v2.9.4) was released in December 2025. This incident highlights a growing threat vector in the AI software supply chain, especially as critical business and academic applications increasingly rely on rapidly evolving open-source frameworks. With adversaries targeting common components and fast-moving cloud deployments, organizations face pressure to update promptly and re-evaluate their security posture against similar zero-day and supply-chain risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Cisco Zero-Day Exploited: Critical Remote Code Execution in Unified Communications (2026)
Telecommunications9 months ago

Cisco Zero-Day Exploited: Critical Remote Code Execution in Unified Communications (2026)

In January 2026, Cisco disclosed and patched CVE-2026-20045, a critical zero-day vulnerability affecting Unified Communications Manager, Unity Connection, and Webex Calling Dedicated Instance platforms. The flaw, arising from improper validation of user-supplied input via HTTP requests, allowed unauthenticated attackers to execute arbitrary code and escalate privileges to root on impacted servers. Cisco’s Product Security Incident Response Team (PSIRT) confirmed in-the-wild exploitation prior to patch release and issued urgent guidance for customers to update, as no workarounds exist. The U.S. CISA swiftly added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating timely remediation for federal agencies. This incident highlights a broader trend of sophisticated zero-day attacks targeting enterprise communications infrastructure. As attackers increasingly focus on supply chain and collaboration platforms, organizations must maintain rapid patching practices and improve segmentation and detection mechanisms against privilege escalation and remote code execution threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Credential Stuffing Attempt at PcComponentes: 2024 Incident Overview
Retail Industry9 months ago

Credential Stuffing Attempt at PcComponentes: 2024 Incident Overview

In June 2024, Spanish online retailer PcComponentes confirmed that its systems were targeted by a large-scale credential stuffing attack. While the company denied reports of a data breach affecting 16 million customers, it acknowledged that threat actors attempted to use previously leaked credentials to gain unauthorized access to customer accounts. No evidence of infrastructure compromise or mass data exfiltration was found, and PcComponentes’ internal investigation revealed that protective measures limited the attack’s impact. This incident highlights the ongoing challenges facing retailers from credential-based attacks, emphasizing the importance of stronger identity and access controls. The surge in credential stuffing campaigns reflects broader trends in attacker automation and customer credential reuse across online services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026
Financial Services9 months ago

Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026

In January 2026, LastPass alerted its users to an active and sophisticated phishing campaign impersonating the company, which sought to trick users into revealing their master passwords. Attackers sent urgent emails—claiming to be scheduled maintenance reminders—directing recipients to phishing sites designed to harvest their credentials. The emails originated from deceptive domains and included subject lines urging immediate backup of password vaults. LastPass emphasized to its users that it does not request master passwords and worked swiftly with partners to dismantle the malicious infrastructure, mitigating immediate risk. This incident highlights the persistent evolution of phishing tactics, particularly those exploiting brand trust and sense of urgency. As password manager adoption grows, attackers increasingly target such platforms, intensifying the need for user vigilance and robust email security controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks
Information Technology/IT9 months ago

VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks

In late 2025, cybersecurity researchers uncovered VoidLink, a sophisticated Linux malware framework reportedly developed primarily by a single actor leveraging artificial intelligence. Analyses by Check Point Research and Sysdig identified operational artifacts and systematic code features—like consistent formatting, template-based responses, and AI-generated debug logs—suggesting heavy use of large language models in the malware’s rapid development. The threat actor, operating in a Chinese-language environment, utilized AI tools such as TRAE SOLO to expedite Spec Driven Development, producing 88,000 lines of attack-ready code in less than a week. While no real-world infections have been reported to date, VoidLink’s capabilities are significant, aiming at stealthy, long-term access to Linux-based cloud infrastructure. The emergence of AI-generated attack frameworks like VoidLink signals a pivotal change in cybercrime. Advanced threat creation, once limited to state actors or skilled teams, can now be accomplished rapidly by individuals utilizing off-the-shelf AI tools. This trend increases the urgency for organizations to adapt AI-enhanced defenses and revisit zero trust, segmentation, and cloud security controls.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026
Computer Software/Engineering9 months ago

Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026

In January 2026, Zoom and GitLab simultaneously released critical security updates to mitigate multiple high-severity vulnerabilities uncovered in their respective platforms. Zoom's most impactful flaw, CVE-2026-22844 (CVSS 9.9), affected its Node Multimedia Routers (MMRs), potentially enabling a meeting participant to perform remote code execution via a command injection. GitLab, meanwhile, addressed several vulnerabilities including two denial-of-service (DoS) issues and a two-factor authentication (2FA) bypass flaw (CVE-2026-0723), which could let malicious actors disrupt services or compromise user accounts if they knew credential IDs. While no active exploitation was reported, organizations using Zoom’s Node MMR module and GitLab’s CE/EE deployments were urged to patch immediately to avoid significant business disruption or data compromise. The disclosure of these vulnerabilities highlights the increasing sophistication and severity of threats targeting software supply chains and critical collaboration platforms. With attackers frequently seeking novel vectors for RCE, DoS, and authentication bypass, timely patching and robust segmentation remain crucial.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know
Computer Software/Engineering9 months ago

Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know

In January 2026, serious security flaws were disclosed in the popular open-source Chainlit artificial intelligence (AI) framework, exposing organizations to substantial data theft and privilege escalation risks. The vulnerabilities—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery/SSRF)—allowed authenticated attackers to steal sensitive files, such as API keys and credentials, and leverage SSRF to access internal or cloud network services. Exploiting these flaws, attackers could combine vectors for lateral movement across environments, potentially leading to broader compromise of AI-powered systems and cloud infrastructures. Both issues were patched in version 2.9.4 following responsible disclosure. This breach is highly relevant as adoption of AI frameworks accelerates and attackers increasingly target embedded infrastructure weaknesses, combining known vulnerabilities with emerging AI application risks. The incident underscores why organizations must adapt security controls and continuously monitor new technology stacks for widely exploitable flaws.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis
Computer Software/Engineering9 months ago

North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis

In January 2026, the North Korean-aligned PurpleBravo threat group orchestrated a sophisticated social engineering campaign targeting more than 3,000 unique IP addresses. The attackers posed as recruiters from leading firms to lure victims, primarily within AI, cryptocurrency, financial services, IT, marketing, and software development, into fake job interviews. Exploiting trust through convincing communications, PurpleBravo gained access to targeted organizations across Europe, South Asia, the Middle East, and Central America, compromising data and exposing confidential operational environments. This campaign underscores the evolution of nation-state social engineering methods, leveraging supply chain trust and exploiting interest in career mobility. As geopolitical tensions rise and attackers continually refine techniques, organizations must double down on identity-centric security and awareness to mitigate evolving social engineering risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025
Computer Software/Engineering9 months ago

PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025

Between August 2024 and September 2025, North Korean state-backed group PurpleBravo orchestrated a software supply-chain campaign targeting IT services and software development firms worldwide. Posing as recruiters or fictitious brands, the attackers lured victims—often developers and job seekers—into executing malicious code on corporate endpoints. Through malware like BeaverTail, PyLangGhost, and GolangGhost, PurpleBravo exfiltrated browser credentials and cryptocurrency wallet data while leveraging GitHub, fake websites, and VPN-based command-and-control infrastructure. Over 3,100 IP addresses and 20 organizations in South Asia, Europe, the Middle East, and Central America were exposed as probable victims, amplifying downstream risk to clients of affected IT service providers. This incident underscores a growing trend of sophisticated, targeted software supply-chain attacks exploiting developer trust and recruitment platforms. The campaign’s overlap with other North Korean IT worker operations and its focus on outsourcing regions highlight urgent risks to organizations relying on distributed and third-party development partners.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CVE-2026-20045: Active Code Injection Exploit Strikes Cisco Unified Communications
Telecommunications9 months ago

CVE-2026-20045: Active Code Injection Exploit Strikes Cisco Unified Communications

In January 2026, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities Catalog following reports of active exploitation targeting Cisco Unified Communications products. Attackers exploited a code injection vulnerability that allowed remote, unauthenticated threat actors to execute arbitrary code on affected devices, potentially compromising sensitive communications and opening access for further malicious activity within targeted federal civilian executive branch (FCEB) networks. This rapid addition of CVE-2026-20045 prompted urgent federal action to remediate impacted systems and reduce the risk of lateral movement and data exfiltration. The incident highlights a persistent threat vector facing organizations reliant on unified communications infrastructure. With attackers increasingly exploiting unpatched vulnerabilities and leveraging code injection to bypass security controls, the importance of timely patch management and network segmentation continues to grow amid tightening regulatory standards and intensifying audit scrutiny.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024
Banking/Mortgage9 months ago

CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024

In early 2024, security researchers identified a sophisticated malware campaign dubbed the 'CrashFix' scam, which leveraged malicious browser extensions—specifically the NexShield extension—to crash users' browsers via social engineering popups and prompt them to install phony fixes. Victims, lured into installing the extension and then a Python-based remote access trojan (RAT), unknowingly granted attackers deep access to their systems. Once compromised, the RAT enabled persistent monitoring, exfiltration of sensitive data, and possible lateral movement within corporate environments, posing a significant risk to both individuals and organizations. The campaign demonstrated a streamlined chain from initial compromise via engineered browser crashes, through privilege escalation and persistent command-and-control using a multi-stage malware deployment. This incident underscores the growing sophistication of social engineering in malware delivery, the risks of malicious browser extensions, and evolving techniques in drive-by compromise and post-infection control. Increased reliance on browsers for daily business functions and the persistence of endpoint threats make such campaigns highly relevant amid surging attacks targeting remote access and user trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
Computer/Network Security9 months ago

How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024

In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports