Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 295 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3529–3540 / 4903 reports
Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)
Computer Software/Engineering9 months ago

Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)

In January 2026, three critical vulnerabilities were disclosed in Anthropic's official Model Context Protocol (MCP) Git server, a tool widely used for managing Git repositories programmatically via large language models (LLMs). The flaws—identified as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145—included two path traversal and one argument injection vulnerabilities. Attackers could exploit these bugs through prompt injection via malicious content (e.g., README files, poisoned issue descriptions) to access or overwrite arbitrary files and achieve remote code execution, without needing direct access to victim systems. Chained exploitation with Filesystem MCP enabled full system compromise until patched in late 2025. This incident highlights growing risks at the intersection of AI-driven development, supply chain dependencies, and insufficient input validation within reference implementations. As organizations increasingly rely on open-source AI tooling, securing both the application layer and its automation becomes vital in defending against evolving prompt-based and supply chain exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Chainlit AI Framework Under Fire: 2024 Vulnerabilities Expose Multicloud Risk
Computer Software/Engineering9 months ago

Chainlit AI Framework Under Fire: 2024 Vulnerabilities Expose Multicloud Risk

In 2024, critical vulnerabilities were uncovered in the Chainlit open-source AI chatbot framework, enabling attackers to exploit flaws in authentication and traffic encryption protections. Malicious actors could intercept unencrypted traffic, manipulate east-west communications, and abuse privileged access across multicloud deployments, potentially leading to data exfiltration or advanced lateral movement within enterprise environments. The incident highlighted how insecure defaults and lack of robust segmentation in AI frameworks expose companies to elevated risk, demanding urgent attention from organizations relying on these technologies for customer-facing or sensitive operations. This breach underscores a broader trend of threat actors targeting open-source AI platforms, taking advantage of immature security practices inherent to many machine learning deployments. As regulatory scrutiny and supply chain attacks surge, securing AI development and deployment pipelines is increasingly essential to prevent business disruption or compliance violations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Critical RCE Flaws in Microsoft & Anthropic MCP Servers Expose AI Workloads to Cloud Takeover
Computer Software/Engineering9 months ago

Critical RCE Flaws in Microsoft & Anthropic MCP Servers Expose AI Workloads to Cloud Takeover

In early June 2024, researchers disclosed critical remote code execution (RCE) vulnerabilities in the Model Context Protocol (MCP) servers operated by Microsoft and Anthropic, exposing integral AI infrastructure to severe cloud takeover risks. Threat actors could leverage these flaws to execute arbitrary code and potentially gain privileged access to sensitive data or underlying cloud platforms, risking widespread lateral movement and data exfiltration. The vulnerabilities arose from insufficient encryption and a lack of east-west segmentation controls, enabling potential attackers to compromise interconnected AI workloads and services. Both vendors moved quickly to deploy patches, but the initial exposure window highlighted deep-seated risks in shared AI service architectures. This incident highlights growing adversary focus on AI model supply chains and service interconnects, with attackers exploiting new protocol vulnerabilities. Rising adoption of AI-driven services across industries has amplified attack surfaces, urging enterprises to enhance zero trust segmentation, encrypted traffic controls, and multicloud observability to meet evolving compliance and operational challenges.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Google Gemini Exploited: Calendar Invites Become AI Attack Vector in 2024
Financial Services9 months ago

Google Gemini Exploited: Calendar Invites Become AI Attack Vector in 2024

In early 2024, researchers identified a critical indirect prompt injection vulnerability affecting Google Gemini, Google's flagship AI suite. Attackers exploited calendar invites as a covert vector to manipulate Gemini's AI context, successfully bypassing native privacy filters and accessing sensitive user data. The attack leveraged the insertion of malicious prompts within innocuous-looking calendar items, which Gemini processed automatically, leading to unauthorized access and data exposure. Google responded by issuing incremental updates, but the incident highlighted inherent risks in automated AI integrations with productivity platforms reliant on user-generated content. This incident underscores the growing prevalence of AI/ML abuse through indirect attack vectors such as prompt injection. With threat actors increasingly targeting large language models in enterprise environments, security programs must rapidly adapt to cover AI-specific exposures, ensure robust segmentation, and incorporate real-time anomaly detection to defend against evolving risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Punycode Phishing: How IDN Abuse Enabled Stealth Attacks in 2026
Financial Services9 months ago

Punycode Phishing: How IDN Abuse Enabled Stealth Attacks in 2026

In January 2026, security researchers identified a surge in phishing attacks leveraging Internationalized Domain Names (IDNs) encoded with Punycode, enabling attackers to create visually deceptive domains that closely resemble legitimate ones. By substituting standard ASCII characters with similar-looking Unicode characters, threat actors bypassed traditional detection, tricking users into visiting fraudulent sites and unknowingly exposing credentials or sensitive information. The attack was uncovered through DNS log analysis, revealing repeated internal access attempts to encoded domains such as xn--yutube-wqf.com, demonstrating the sophistication and stealth of this social engineering tactic. This incident highlights the growing prevalence of advanced phishing campaigns using homoglyph attacks and encoded domains, underscoring the need for updated detection routines and user awareness. Organizations face increased operational risk as threat actors exploit gaps caused by internationalization and encoding, making timely monitoring and DNS log analysis crucial.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Predator Bots Hit APIs at Scale: Are Your Defenses Ready for Autonomous Threats?
Financial Services9 months ago

Predator Bots Hit APIs at Scale: Are Your Defenses Ready for Autonomous Threats?

In 2024, a surge in highly sophisticated "predator bots" led to a large-scale wave of automated attacks targeting critical APIs across multiple industries. Threat actors leveraged AI-driven automation to mimic human behavior and evade detection, resulting in credential theft, fraudulent transactions, account takeovers, and widespread data scraping. The attacks exploited shadow APIs and business logic flaws, bypassed traditional defenses like IP filtering and CAPTCHAs, and drained significant revenue through scalping and abuse. The economic impact has been severe, with business losses estimated in the billions, and operational teams scrambling to regain visibility and control. This incident highlights the urgent need for modern, adaptive security that operates at machine speed. As attackers weaponize automation and AI, organizations face mounting pressure to implement layered defenses, proactive anomaly detection, and API-centric protection to prevent sophisticated fraud, data loss, and erosion of customer trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Ingram Micro 2025 Ransomware Breach: Over 42,000 Impacted in Supply Chain Attack
Information Technology/IT9 months ago

Ingram Micro 2025 Ransomware Breach: Over 42,000 Impacted in Supply Chain Attack

In July 2025, information technology distributor Ingram Micro experienced a significant ransomware attack that compromised its internal systems and resulted in the unauthorized access and potential theft of sensitive personal information for over 42,000 individuals. Attackers infiltrated the company’s network, deployed ransomware, and encrypted critical data, causing temporary disruption to business operations. Ingram Micro responded by shutting down affected systems, launching an investigation, and notifying impacted individuals, highlighting gaps in east-west traffic security and incident detection. This breach underscores the ongoing resurgence of ransomware attacks targeting supply chain companies and IT providers. With attackers refining lateral movement techniques, organizations face mounting pressure to adopt robust segmentation, real-time anomaly detection, and comprehensive data protection strategies in compliance with evolving regulatory expectations.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Jordanian Access Broker Case Exposes Credential Sales Across 50 Enterprises
Financial Services9 months ago

Jordanian Access Broker Case Exposes Credential Sales Across 50 Enterprises

In May 2023, law enforcement identified Feras Khalil Ahmad Albashiti—a Jordanian national—operating as an initial access broker, selling unauthorized access to over 50 corporate networks via an underground cybercrime forum. Acting under the handle "r1z," Albashiti exchanged credentials for cryptocurrency on at least one occasion with an undercover officer, exposing illicit sales tied to fraud and abuse of privileged network access. Arrested in Georgia and extradited to the US in July 2024, he pleaded guilty to charges of fraud involving access credentials. Sentencing is scheduled for May 2026, with potential penalties of up to 10 years imprisonment and substantial fines. This case highlights the increasingly organized role of initial access brokers in cybercrime, where privileged access is sold to facilitate ransomware, espionage, and data theft. The incident underscores ongoing risks posed by the thriving market for stolen credentials used to compromise enterprise environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UK Under Siege: NoName057(16) DDoS Attacks Target Critical Infrastructure in 2026
Government Administration9 months ago

UK Under Siege: NoName057(16) DDoS Attacks Target Critical Infrastructure in 2026

In January 2026, the UK's National Cyber Security Centre (NCSC) issued a warning about ongoing DDoS attacks targeting critical infrastructure and local government organizations across the United Kingdom. These attacks are attributed to the pro-Russian hacktivist group NoName057(16), known for leveraging their crowdsourced DDoSia platform to coordinate massive denial-of-service campaigns. Despite an international law enforcement operation in mid-2025 that resulted in arrests and the takedown of supporting servers, the core operators evaded capture and resumed disruptive activities. The attacks, while technically unsophisticated, resulted in interruptions of public-facing services, forced organizations to invest in defensive measures, and threatened operational resilience. This incident underscores a broader trend of ideologically motivated hacktivism targeting Western critical infrastructure, amplified by evolving techniques and persistent threat actors. As geopolitical tensions rise and hacktivists increasingly collaborate via decentralized platforms, DDoS threats have become a significant operational risk for organizations across the public and private sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
How PDFSider Malware Enabled a Major Fortune 100 Ransomware Breach in Finance
Financial Services9 months ago

How PDFSider Malware Enabled a Major Fortune 100 Ransomware Breach in Finance

In January 2026, a Fortune 100 financial services company was compromised by a ransomware group utilizing a sophisticated new Windows malware strain dubbed PDFSider. Attackers used social engineering, posing as support staff to trick employees into running malicious files and installing remote-access tools. The payload was delivered via spearphishing emails containing a ZIP archive with a legitimate, signed PDF24 Creator executable and an altered cryptbase.dll, exploiting DLL side-loading to bypass security controls. Once activated, PDFSider established a covert backdoor, loaded its code into memory, and exfiltrated system information over encrypted DNS channels, employing advanced evasion and anti-analysis tactics to maintain persistent access and enable ransomware deployment. This incident underscores a surge in targeted ransomware and espionage-style operations, where attackers blend APT tradecraft with financial motives. As threats increasingly leverage trusted tools, memory-resident malware, and advanced encryption, organizations face mounting pressure to bolster detection and containment strategies in response to evolving attacker sophistication.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
NexShield Fake Ad Blocker & CrashFix: 2026's Browser Extension Malware
Financial Services9 months ago

NexShield Fake Ad Blocker & CrashFix: 2026's Browser Extension Malware

In January 2026, a sophisticated malvertising campaign leveraged a fake Chrome and Edge extension named NexShield to target corporate environments. Purported as a privacy-focused ad blocker, NexShield was distributed through the Chrome Web Store and social engineering tactics. Upon installation, the extension intentionally crashed browsers and subsequently displayed fake warnings instructing users to run malicious commands in Windows Command Prompt, thereby installing ModeloRAT—a Python-based remote access tool with extensive reconnaissance and persistence capabilities. The campaign, dubbed 'CrashFix' and attributed to threat actor KongTuke, demonstrated advanced evasion techniques, delayed payload execution, and targeted both corporate and individual users. This incident exemplifies the growing threat from malicious browser extensions and evolving malvertising techniques. Security experts note a marked increase in targeted, multi-stage attacks that exploit trusted distribution channels and leverage social engineering to compromise endpoints, underlining the urgent need for robust browser extension controls and ongoing user awareness.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign
Financial Services9 months ago

CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign

In January 2026, security researchers uncovered the 'KongTuke' campaign, which weaponized a malicious Chrome extension named CrashFix, disguised as an ad blocker. Attackers exploited a faux browser crash workflow—imitating ClickFix lures—to trick victims into running malicious commands, delivering the new ModeloRAT remote access trojan (RAT). The campaign allowed threat actors to silently gain persistent, covert access, facilitating lateral movement and potential data exfiltration within corporate environments. The incident highlights the evolving sophistication of browser-based attack chains and underscores browser extension risk as a modern threat vector for organizations reliant on SaaS and web apps. This breach is emblematic of a surge in malicious browser extensions delivering advanced malware. It showcases a growing trend toward supply chain compromise and the abuse of user trust in widely used browser platforms, calling for improved extension vetting and proactive security controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports