Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Herodotus Android Malware: Sophisticated Human-Like Typing Evasion Uncovered in 2024
In early June 2024, cybersecurity researchers identified a new Android malware family, Herodotus, which leverages advanced evasion tactics to bypass mobile security defenses. Disguised as legitimate applications, Herodotus executes random delay injection within its input routines to emulate human-like typing behaviors. This innovative technique thwarts traditional detection mechanisms that rely on recognizing predictable or automated input patterns, thereby enabling the malware to steal credentials, access sensitive data, and potentially gain persistence on compromised Android devices. The threat actors exploit users who install trojanized apps from unofficial sources, broadening their infection base and weakening mobile ecosystem defenses. The Herodotus incident highlights the escalating sophistication of mobile malware and the urgent need for organizations and consumers to implement robust mobile endpoint security controls. Its emergence coincides with a marked increase in malware adopting anti-detection tactics, signaling a concerning trend in attacker adaptation and the ongoing cat-and-mouse dynamic in mobile cybersecurity.
8 months ago
Kill Chain
BiDi Swap: How Unicode URL Tricks Enable Next-Gen Phishing Attacks
In early 2024, cybersecurity researchers uncovered a wave of phishing campaigns leveraging the 'BiDi Swap' technique, where attackers exploit bidirectional Unicode text in URLs to mask malicious domains as legitimate ones. By inserting special control characters, cybercriminals create deceptive links that appear authentic to end-users and some security tools, increasing the risk of credential thefts and unauthorized access, especially for organizations relying on standard phishing defenses. The attack exploits a decade-old browser flaw now resurfacing with renewed sophistication. This incident highlights a dangerous resurgence of invisible text manipulation tactics, which are rapidly proliferating across phishing kits and social engineering toolkits. As workforces rely on web-based authentication and email, organizations should urgently review their detection capabilities to spot Unicode obfuscation and mitigate emerging URL-based threats.
8 months ago
Kill Chain
Atroposia Malware-as-a-Service Threatens 2024 Cybersecurity with Automated Vulnerability Scanning
In early June 2024, the cybersecurity community confirmed the emergence of Atroposia, a sophisticated Malware-as-a-Service (MaaS) platform offering attackers a feature-rich remote access trojan (RAT). Atroposia distinguishes itself from conventional malware by fusing persistent access, stealthy evasion, credential theft, and automated local vulnerability scanning within a single toolkit. Threat actors leveraging Atroposia can gain initial footholds via phishing or malware campaigns, then use the built-in scanner to enumerate unpatched vulnerabilities in compromised environments, accelerating lateral movement and privilege escalation while remaining elusive to defenses. The rapid adoption of Atroposia by criminal actors raises the risk of automated exploitation and more deeply entrenched incidents across industries. This incident is notable for the shift toward criminal malware platforms bundled with security assessment features, lowering the barrier for less-skilled attackers to conduct advanced operations. Security teams must address these evolving threats with layered defenses and continuous vulnerability management as attacker agility outpaces legacy controls.
8 months ago
Kill Chain
Qilin Ransomware Leverages WSL for Unprecedented Cross-Platform Attacks
In early June 2024, security researchers uncovered that the Qilin ransomware group leveraged the Windows Subsystem for Linux (WSL) to execute Linux-based encryptors on Windows systems. By deploying ransomware binaries within the WSL environment, attackers bypassed many traditional security products that focus on Windows malware, allowing the ransomware to encrypt files with reduced detection rates. This approach enabled more effective lateral movement and evasion within corporate networks, potentially increasing the victim's downtime and recovery costs after infection. This incident is especially noteworthy as it demonstrates an increasing trend of threat actors targeting multi-platform environments and exploiting hybrid operating system features. Security teams must update their approaches to not only monitor classic Windows vectors but also enforce visibility and controls across cross-platform and virtualization layers.
8 months ago
Kill Chain
Inside the GhostCall & GhostHire Malware Campaigns: BlueNoroff’s 2025 Cryptocurrency Heists
In October 2025, cybersecurity researchers uncovered new attack chains, GhostCall and GhostHire, attributed to BlueNoroff—a sub-group of North Korea's Lazarus Group—targeting the Web3 and blockchain sectors. The campaigns form part of SnatchCrypto, an ongoing operation active since 2017, characterized by sophisticated spear-phishing, malware-laden documents, and social engineering tactics to infiltrate cryptocurrency firms and financial technology startups. Once initial access is gained, attackers deploy custom malware, bypass defenses, and ultimately exfiltrate sensitive data and digital assets, resulting in significant cryptocurrency thefts and disruption across targeted organizations. This campaign is especially concerning amid a surge of advanced persistent threats exploiting trust gaps in rapidly evolving blockchain and cryptocurrency environments. Regulators and cybersecurity teams are on high alert as major financial losses and reputational impacts drive urgency for improved controls, detection, and Zero Trust strategies.
8 months ago
Kill Chain
Memento Labs Leverages Chrome Zero-Day to Deploy LeetAgent Spyware in 2025
In March 2025, a critical zero-day vulnerability (CVE-2025-2783) in Google Chrome was exploited in the wild, enabling threat actors to escape the browser sandbox and deliver espionage-focused LeetAgent spyware attributed to Italian firm Memento Labs. Security researchers from Kaspersky identified targeted campaigns leveraging this flaw to compromise high-value victims via crafted web content, resulting in covert surveillance, data exfiltration, and unauthorized system access before Google patched the issue. This breach underscores the rapid weaponization of browser vulnerabilities by sophisticated actors to distribute espionage tools, often before defenders can respond. Incidents like this demonstrate an uptick in exploitation of high-impact zero-day flaws, especially in widely used software like Chrome, allowing elite cyber espionage operators to rapidly compromise organizations. The trend poses mounting risks as zero-days are increasingly used for targeted intrusions ahead of public disclosure and patch deployment.
8 months ago
Kill Chain
Herodotus Trojan Outsmarts Android Defenses with Human-Like Behavior
In October 2025, cybersecurity researchers uncovered a new Android banking trojan, dubbed Herodotus, actively targeting financial institutions and users in Italy and Brazil. The malware stands out by performing sophisticated device takeover (DTO) attacks while mimicking genuine human behavior—specifically attempting to bypass behavioral biometrics and anti-fraud detection. Herodotus infects devices via malicious apps or phishing, granting attackers near-complete control, which they use to exfiltrate sensitive financial and authentication data by simulating legitimate user interaction. The Herodotus incident underscores a troubling advancement in mobile malware—attackers are increasingly leveraging techniques that closely imitate human behavior to elude cutting-edge security controls. This signals a growing risk for banking apps and enterprises relying on behavioral biometrics, and highlights the urgent need for multilayered zero trust strategies and improved east-west visibility in mobile ecosystems.
8 months ago
Kill Chain
Atroposia RAT: How Turnkey Malware Is Changing Enterprise Threats in 2024
In early 2024, a sophisticated Remote Access Trojan (RAT) named Atroposia emerged for public sale on cybercrime forums, offering low-level attackers turnkey access to advanced capabilities such as persistent remote control, stealth, and evasion. Distributed as a ready-to-use toolkit, Atroposia enables affiliates to deploy the malware with minimal technical skill, significantly lowering the barrier to conducting targeted attacks against organizations. Key behaviors include encrypted communications, lateral movement, and data exfiltration, leveraging evasion techniques to bypass traditional security controls. The rapid adoption of Atroposia among threat actors increases operational risk for organizations lacking modern defenses. The prevalence of Atroposia highlights a growing trend in the cybercrime ecosystem: advanced malware-as-a-service platforms democratize sophisticated attacks, making high-impact breaches increasingly accessible. Enterprises face urgent pressure to modernize lateral movement controls, incident detection, and segmentation as attacker toolkits continue to evolve.
8 months ago
Kill Chain
Memento Spyware: Chrome Zero-Day Attack Sheds Light on Evolving Spyware Threats
In early 2024, cybersecurity researchers identified active exploitation of a zero-day vulnerability in Google Chrome by Memento Labs, deploying sophisticated spyware against select targets worldwide. Memento Labs, known as the successor to the notorious Hacking Team, leveraged the undocumented Chrome exploit to remotely compromise endpoints and gain persistent access. The campaign allowed attackers to harvest sensitive data, monitor communications, and exfiltrate information from compromised browsers, with initial infections traced via malicious websites distributing tailored payloads. Businesses affected faced risks of data breaches, espionage, and unauthorized surveillance impacting operational and reputational trust. This attack is significant due to the revival of commercially available offensive spyware targeting widely used software through zero-days. As high-profile threat actors increasingly exploit browser vulnerabilities, organizations face a heightened threat landscape requiring advanced detection and zero trust protections.
8 months ago
Kill Chain
North Korean BlueNoroff APT Hits Fintech and Web3 in Sophisticated 2024 Crypto Heist
In early 2024, the North Korean APT group BlueNoroff (a sub-group of Lazarus) launched sophisticated cross-platform campaigns against fintech executives and Web3 developers worldwide. The attackers utilized fake business collaboration and job recruitment lures distributed via phishing documents and messaging apps to implant malware on both Windows and macOS devices. Once in the network, BlueNoroff leveraged their established toolkits—including custom backdoors and credential stealers—to escalate privileges and ultimately exfiltrate cryptocurrency assets. This activity resulted in significant fund theft for several organizations, eroding trust in targeted fintech sectors. This incident highlights the continuous evolution of state-sponsored cybercrime groups, who now use highly adaptive social engineering paired with platform-agnostic malware. The financial sector, especially emerging blockchain and crypto startups, remains a primary focus amid a surge of advanced financially-motivated nation-state attacks.
8 months ago
Kill Chain
Morocco’s 'Jingle Thief' Heist Shows Retailers’ Holiday Cyber Weaknesses
In late 2024, the retail sector was targeted by a Morocco-based cybercriminal operation dubbed 'Jingle Thief.' The attackers orchestrated a large-scale gift card fraud campaign by exploiting weaknesses in payment and e-commerce systems. Through phishing and the abuse of unencrypted and east-west traffic within retail networks, the adversaries accessed internal gift card management tools. The stolen gift card data was quickly monetized, resulting in fraudulent transactions and direct financial losses to multiple retailers during the lucrative holiday season. This incident underscores the urgent need for advanced segmentation, strong encryption of data in transit, and continuous network threat detection in retail environments. It also highlights an emerging trend of financially motivated attackers focusing on high-impact, low-resilience periods such as holiday shopping surges.
8 months ago
Kill Chain
How Chinese Gangs Engineered a $1B+ US Credit Card Fraud Wave via Smishing in 2025
In 2025, large-scale social engineering attacks targeted US consumers through smishing campaigns that impersonated legitimate institutions such as highway toll authorities and the US Postal Service. Orchestrated by Chinese criminal organizations, these fraudulent text messages lured victims into divulging their credit card details, which were then monetized to purchase goods via an elaborate scheme. Attackers leveraged the stolen card data by installing it into Google and Apple Wallets in Asia and facilitating cross-border purchases, enabling smooth, large-scale fraud amounting to over $1 billion across a three-year period. This case underscores a recent surge in sophisticated financial fraud campaigns that combine social engineering with digital payment ecosystems, exploiting global tech infrastructure and multi-region collaboration. The landscape sees continued pressure on organizations to safeguard payment and customer data against rapidly evolving threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports