Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 303 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3625–3636 / 4903 reports
ChatGPT's 2026 ZombieAgent Attack: Persistent Prompt Injection Exploits AI Memory
Computer Software/Engineering10 months ago

ChatGPT's 2026 ZombieAgent Attack: Persistent Prompt Injection Exploits AI Memory

In January 2026, researchers at Radware disclosed a critical vulnerability in OpenAI's ChatGPT platform, exploiting its new memory and connector features via indirect prompt injection (IPI). The exploit, dubbed "ZombieAgent," allowed attackers to persistently implant malicious prompts within ChatGPT's memory using innocuous-looking emails or document attachments. Once infected, the AI could automatically extract and exfiltrate sensitive information through obfuscated URL requests whenever the user interacted with the compromised bot, bypassing existing controls and traditional user awareness. The attack method leverages ChatGPT integrations with email and third-party applications, increasing the risk of wide propagation and persistence. This incident underscores the rapidly evolving threat landscape in AI/ML security, where feature enhancements such as memory and connectivity can be leveraged by attackers for new classes of attacks. The ZombieAgent case highlights the urgent need for robust prompt source attribution, intent verification, and granular trust boundaries in AI agents as attackers adapt known abuse techniques to advanced AI capabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Fake AI Chrome Extensions Expose Sensitive Data of 900,000 Users
Computer Software/Engineering10 months ago

Fake AI Chrome Extensions Expose Sensitive Data of 900,000 Users

In January 2026, security researchers disclosed a major data breach in which two malicious Google Chrome extensions, posing as legitimate AI-powered tools for ChatGPT and DeepSeek, surreptitiously harvested sensitive information from over 900,000 users. These fake extensions, mimicking the functionality and branding of a trusted vendor, exfiltrated entire LLM chat conversations, browsing histories, confidential corporate URLs, internal credentials, and other proprietary data to an external command-and-control server. The scope of the incident included the exposure of intellectual property, business strategies, source code, and user credentials, highlighting significant risks for individuals and organizations whose employees utilized these tools in their workflows. With generative AI increasingly adopted for business and development tasks, this breach is a stark demonstration of the risks posed by third-party browser extensions—particularly those that intercept AI-driven sessions. It underscores the urgent need for stricter vetting controls, robust application security for browser add-ons, and user education in an environment where threat actors leverage AI both as target and tool.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
HPE OneView Critical Zero-Day Exploited for Remote Access in 2025
Information Technology/IT10 months ago

HPE OneView Critical Zero-Day Exploited for Remote Access in 2025

In June 2025, a critical vulnerability (CVE-2025-37164), was discovered and exploited in the wild against HPE OneView, the company’s IT infrastructure management platform. Attackers leveraged the flaw to achieve remote code execution without authentication, enabling full access to core infrastructure resources. Reported incidents indicate that threat actors used this vulnerability for initial access, privilege escalation, and potentially data exfiltration or ransomware deployment, threatening operational continuity for affected enterprises. HPE acted swiftly to release security advisories and patches, but exploitation occurred before widespread remediation could be implemented. This incident highlights the persistent targeting of critical infrastructure management tools and the increasing sophistication and speed with which attackers weaponize disclosed zero-day vulnerabilities. Organizations must prioritize patch management and vigilant monitoring to prevent compromise in an evolving landscape of high-consequence supply chain and platform attacks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Fancy Bear’s 2024 Credential Attacks: The Global Secrets Heist Reinvented
Government Administration10 months ago

Fancy Bear’s 2024 Credential Attacks: The Global Secrets Heist Reinvented

In early 2024, the Russian state-sponsored threat group APT28 (also known as Fancy Bear) intensified credential-harvesting campaigns targeting global governmental and enterprise networks. Leveraging basic techniques such as phishing and exploitation of unencrypted or weakly protected authentication channels, the attackers maintained persistent access and exfiltrated sensitive secrets across multiple sectors. The operations demonstrated a preference for cost-effective methods, including the abuse of stolen credentials, rather than relying on advanced custom malware—resulting in widespread data exposure and persistent breaches with significant geopolitical ramifications. This incident highlights the increasing sophistication of threat actors’ social engineering and credential-focused tactics, signaling a shift in espionage campaigns worldwide. As traditional perimeter defenses become less effective against targeted, credential-driven attacks, organizations face renewed urgency to adopt zero trust models, strong encryption, and robust monitoring to combat these persistent threats.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Attackers Manipulate Windows Process Environment Blocks for Evasion (2024 Analysis)
Financial Services10 months ago

How Attackers Manipulate Windows Process Environment Blocks for Evasion (2024 Analysis)

In January 2024, security researchers highlighted a process manipulation technique in Windows environments that allows attackers to modify the Process Environment Block (PEB) of malicious or legitimate processes. By leveraging the CREATE_SUSPENDED flag and directly editing the PEB structure, adversaries can spoof or hide command-line arguments of spawned processes. This method can be further extended to already-running processes, making detection through simple process inspection more challenging. The primary risk lies in attackers masking their operational activities to evade security controls and digital forensics investigation. This incident underscores the evolving sophistication of post-exploitation tactics aimed at defense evasion. Process hollowing, command-line spoofing, and direct PEB tampering are increasingly used in targeted attacks and commodity malware alike, highlighting the critical need for visibility, anomaly detection, and strong endpoint security strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags Critical HPE OneView Vulnerability as Actively Exploited in 2026
Information Technology/IT10 months ago

CISA Flags Critical HPE OneView Vulnerability as Actively Exploited in 2026

In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged a critical vulnerability (CVE-2025-37164) in HPE OneView infrastructure management software as being actively exploited in the wild. This flaw, present in versions prior to 11.00, allows unauthenticated attackers to execute low-complexity code-injection attacks, gaining remote code execution on unpatched systems. HPE issued security updates in December 2025, but as no mitigations or workarounds exist, organizations using legacy versions remain exposed. The exploitation of this vulnerability poses significant risks to IT infrastructure due to OneView’s widespread enterprise adoption, which includes the Fortune 500. The prominence of this threat highlights a growing trend in attacks targeting centralized infrastructure management platforms, often leading to widespread lateral movement and potential operational disruption. Regulatory agencies and security teams are increasingly prioritizing rapid patching and zero trust segmentation to address these critical exposures.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Cisco 2026 ISE Vulnerability: How Public Exploits Undermine Zero Trust
Computer/Network Security10 months ago

Cisco 2026 ISE Vulnerability: How Public Exploits Undermine Zero Trust

In January 2026, Cisco disclosed a critical vulnerability (CVE-2026-20029) affecting its widely used Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw, caused by improper XML parsing in the web-based management interface, allows attackers with valid administrative credentials to upload a malicious file and access otherwise restricted files on the underlying operating system. While Cisco has not identified any active exploitation in the wild, proof-of-concept exploit code is publicly available and even privileged enterprise environments are exposed until patched. Administrators manage authentication, access, and segmentation policies through ISE, so exploitation could grant attackers access to highly sensitive network information or credentials, potentially undermining zero trust controls and compliance postures. This incident is particularly relevant as it highlights the ongoing risk posed by public exploit code, privilege escalation bugs, and gaps in patch hygiene for critical access-management tools. Increased regulatory scrutiny and the sophistication of attackers targeting identity and segmentation controls mean organizations cannot delay patching or segmentation efforts, especially as similar vulnerabilities continue to be a primary vector for advanced threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Global Cisco Switch Reboot Outage: DNS Client Vulnerability Hits Network Operations
Information Technology/IT10 months ago

Global Cisco Switch Reboot Outage: DNS Client Vulnerability Hits Network Operations

In January 2026, numerous Cisco network switches globally experienced widespread, persistent reboot loops due to a software vulnerability in their DNS client service. Beginning around 2 AM UTC, administrators observed affected Cisco models—including CBS250, CBS350, SG350, SG350X, SG550X, and Catalyst C1200—entering repeated crashes when DNS queries for core domains (such as www.cisco.com or NTP servers) failed. The root trigger appears to be a firmware bug in the DNSC task, causing the switch OS to log a critical error and initiate an immediate reboot, with impacts observed across multiple organizations and networks worldwide. Temporary mitigations, such as disabling DNS or SNTP features, helped restore partial stability until Cisco and upstream CDN providers reverted the changes. The incident highlights the ongoing risk that latent software vulnerabilities in ubiquitous infrastructure devices pose to business continuity. As device automation and remote management expand, similar vulnerabilities can cause cascading operational outages across sectors, underscoring the need for robust patching, rigorous QA in embedded systems, and improved visibility over east-west traffic disruptions.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Chinese APT Exploits VMware ESXi Zero-Days in Stealth Hypervisor Attacks (2025)
Information Technology/IT10 months ago

Chinese APT Exploits VMware ESXi Zero-Days in Stealth Hypervisor Attacks (2025)

In late 2025, threat researchers identified a series of intrusions targeting VMware ESXi hypervisors via a zero-day toolkit attributed to a Chinese-speaking advanced persistent threat group. The attackers initially gained access by compromising a SonicWall VPN device and pivoted through privileged domain accounts, leveraging sophisticated VM escape exploits that chained three ESXi zero-day vulnerabilities (CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225) developed more than a year before disclosure. The exploit chain enabled lateral movement, data staging for exfiltration, and installation of stealth persistence backdoors, placing numerous enterprise virtualization environments at sustained risk for data breach and operational disruption. This incident exemplifies the escalating sophistication of APT operations, underlining the risks posed by supply chain weaknesses, late vulnerability reporting, and the ability of attackers to evade common monitoring. The case also highlights growing regulatory scrutiny on zero-day management and east-west traffic visibility within critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Sounds Alarm on Exploited Microsoft Office & HPE OneView Vulnerabilities (2026)
Government Administration10 months ago

CISA Sounds Alarm on Exploited Microsoft Office & HPE OneView Vulnerabilities (2026)

In January 2026, CISA added critical vulnerabilities affecting Microsoft Office (CVE-2009-0556) and HPE OneView (CVE-2025-37164) to its Known Exploited Vulnerabilities catalog after credible reports of active exploitation. CVE-2009-0556, a code injection flaw in PowerPoint, allows remote code execution via memory corruption, while CVE-2025-37164 enables unauthenticated remote code execution against all affected HPE OneView versions prior to 11.00. eSentire reported public proof-of-concept exploit code for the HPE flaw, further increasing organizational risk. Both vulnerabilities pose severe security threats, prompting urgent remediation directives across Federal Civilian Executive Branch networks. This incident underscores the rising urgency of rapid patch management as threat actors increasingly exploit published vulnerabilities and proof-of-concept exploits. The swift addition to CISA’s catalog highlights regulatory pressure and the need for proactive controls as organizations face growing risks from unpatched enterprise software.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
NodeCordRAT Trojan Exposed in npm Bitcoin-Themed Packages (2026)
Computer Software/Engineering10 months ago

NodeCordRAT Trojan Exposed in npm Bitcoin-Themed Packages (2026)

In November 2025, cybersecurity researchers uncovered a sophisticated supply chain attack involving malicious npm packages—'bitcoin-main-lib', 'bitcoin-lib-js', and 'bip40'—that distributed the remote access trojan NodeCordRAT. Uploaded by the threat actor 'wenmoonx', these packages mimicked legitimate BitcoinJS repositories, leveraging npm’s postinstall scripts to deliver malware hidden in 'bip40'. NodeCordRAT enabled attackers to exfiltrate Chrome credentials, cryptocurrency wallet seed phrases, and sensitive files to Discord-controlled servers, using Discord’s API for covert communication and command execution. This multi-OS campaign potentially impacted thousands of developers before takedown. The incident stands out for its abuse of trusted open-source components, increasing concern across the software supply chain. Its methodology highlights the growing sophistication of attacker tradecraft leveraging developer ecosystems and API-based covert channels, making such threats relevant for all organizations relying on open-source dependencies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Patches ISE Flaw Following Public Exploit Release: What Enterprises Need to Know
Financial Services10 months ago

Cisco Patches ISE Flaw Following Public Exploit Release: What Enterprises Need to Know

In January 2026, Cisco disclosed a medium-severity vulnerability (CVE-2026-20029, CVSS 4.9) in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products after a public proof-of-concept (PoC) exploit was released. The flaw, originating from improper XML parsing in the web-based management interface, could allow authenticated administrators to upload malicious files and read sensitive files from the underlying operating system—data ordinarily inaccessible, even to admins. The vulnerability was responsibly reported by a Trend Micro researcher and impacts ISE/ISE-PIC versions prior to 3.5. Cisco responded promptly with patches and confirmed there were no reports of in-the-wild exploitation at the time of disclosure. This incident highlights ongoing threats posed by privilege escalation and flaws in web-based management interfaces of critical infrastructure. With increased attacks on network devices and rapid public exploit releases, organizations face urgent pressure to patch exposed systems and reinforce administrative controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports