Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 33 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 385–396 / 4893 reports
Critical Atlassian Vulnerability CVE-2026-21589 Exposes File Access Risk
Computer Software/Engineering1 month ago

Critical Atlassian Vulnerability CVE-2026-21589 Exposes File Access Risk

Atlassian disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting multiple self-hosted Data Center products including Confluence, Jira, Bitbucket, and Bamboo. The vulnerability allows unauthenticated attackers to access specific files within the web application root directory, though exploitation requires prior knowledge of exact file names and paths. The flaw impacts all product versions released before October 2026 security updates, with Atlassian urging immediate patching for self-hosted instances while cloud customers received automatic updates. This incident highlights the ongoing evolution of web application vulnerabilities targeting enterprise collaboration platforms, coinciding with increased scrutiny of supply chain security and the critical need for robust patch management processes in hybrid cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals
Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals
Marketing/Advertising/Sales1 month ago

Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals

In September 2026, cybersecurity researchers disclosed a sophisticated phishing platform targeting AI advertising professionals through fake portals impersonating ChatGPT, Google Gemini, Anthropic Claude, Perplexity, Meta Muse, and other AI chatbot advertising services. The attackers employed browser-in-the-browser (BitB) techniques to create convincing spoofed login windows displaying trusted domains like accounts.google.com while capturing credentials and multi-factor authentication codes in real-time. The campaign specifically targeted agency staff, media buyers, and manager-account administrators with the goal of monetizing compromised advertising accounts or selling them in underground markets. This incident highlights the growing sophistication of AI-themed phishing campaigns as threat actors rapidly adapt to emerging technologies and capitalize on the widespread adoption of AI tools in business environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
BigDiskBuster: The Stealth Attack That Silently Disarms Microsoft Defender
BigDiskBuster: The Stealth Attack That Silently Disarms Microsoft Defender
Computer/Network Security1 month ago

BigDiskBuster: The Stealth Attack That Silently Disarms Microsoft Defender

In October 2026, security researcher Abdelhamid Naceri (MSNightmare) released a proof-of-concept technique called 'BigDiskBuster' that prevents Microsoft Defender from receiving security updates without exploiting any vulnerabilities. The technique monitors Defender update activity and creates hidden files that consume all available disk space when updates begin, causing silent update failures while leaving the antivirus service running normally. LevelBlue researchers successfully reproduced the attack, demonstrating how it creates a 'silent detection gap' where Defender appears healthy but becomes increasingly vulnerable to new threats as its signature database becomes outdated. This incident highlights the growing sophistication of EDR evasion techniques and the critical need for organizations to monitor not just whether security tools are running, but whether they're receiving current threat intelligence updates.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Denmark's Massive CPR Breach Exposes 8.8 Million Citizens Through Third-Party Access Failure
Denmark's Massive CPR Breach Exposes 8.8 Million Citizens Through Third-Party Access Failure
Government Administration1 month ago

Denmark's Massive CPR Breach Exposes 8.8 Million Citizens Through Third-Party Access Failure

In September 2026, unauthorized parties exploited a legitimate Danish company's access credentials to Denmark's Central Person Register (CPR), compromising personal data of approximately 8.8 million individuals—nearly 80% of all records in the national database. The attackers conducted automated lookups over a 10-day period to harvest valid CPR numbers, names, and addresses before being detected by system administrators. The breach exposed critical vulnerabilities in third-party access controls and API rate limiting for national identity systems. This incident highlights the growing trend of attackers targeting government identity databases through compromised business partners, reflecting broader supply chain vulnerabilities in critical national infrastructure that could enable large-scale identity theft and social engineering campaigns.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ClickFix Attacks Evolve: Browser Cache Smuggling Bypasses Windows Security
ClickFix Attacks Evolve: Browser Cache Smuggling Bypasses Windows Security
Financial Services1 month ago

ClickFix Attacks Evolve: Browser Cache Smuggling Bypasses Windows Security

A sophisticated evolution of ClickFix social engineering attacks emerged in October 2026, utilizing browser cache smuggling to bypass Windows Run dialog character limitations. Attackers compromise websites to pre-fetch malicious VBScript payloads disguised as PNG files into victims' browser caches, then trick users into executing commands that retrieve and execute these cached scripts. The attack chain progresses through multiple stages including credential harvesting, .NET assembly injection, and establishing command-and-control communications with external servers. This technique allows threat actors to circumvent the 260-character limit imposed by Windows Run dialog while concealing payloads from traditional detection methods. This attack method represents a significant escalation in social engineering sophistication, particularly relevant as organizations face increasing pressure from AI-powered phishing campaigns and nation-state actors like North Korea's Stardust Chollima and Russia's Sandworm group actively deploying ClickFix techniques against financial and critical infrastructure sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
The 2026 Open Source Security Crisis: When AI Breaks Vulnerability Disclosure
The 2026 Open Source Security Crisis: When AI Breaks Vulnerability Disclosure
Computer Software/Engineering1 month ago

The 2026 Open Source Security Crisis: When AI Breaks Vulnerability Disclosure

The OpenSSF's 2026 analysis reveals a critical inflection point in open source security, where AI-powered vulnerability discovery is generating unprecedented volumes of security findings while traditional coordinated disclosure mechanisms are breaking down. Vincent Danen of Red Hat highlights how the industry has shifted from managing one vulnerability per month to potentially thousands per week, with researchers increasingly bypassing established disclosure channels in favor of immediate public releases. This flood of AI-generated findings is overwhelming both upstream maintainers and downstream vendors, creating coordination gaps that leave critical infrastructure exposed during the vulnerability window. The breakdown coincides with regulatory pressures from the EU Cyber Resilience Act, forcing organizations to rapidly adapt their vulnerability management processes while maintaining security standards across increasingly complex supply chains.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Atlassian CVE-2026-21589 Exposes Enterprise File Systems to Unauthenticated Access
Critical Atlassian CVE-2026-21589 Exposes Enterprise File Systems to Unauthenticated Access
Computer Software/Engineering1 month ago

Critical Atlassian CVE-2026-21589 Exposes Enterprise File Systems to Unauthenticated Access

Atlassian disclosed CVE-2026-21589, a critical path traversal vulnerability affecting eight Data Center products with a CVSS score of 9.3. The flaw allows unauthenticated attackers to read arbitrary files from web application root directories across Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye products. Attackers must know exact file paths but require no authentication, potentially exposing sensitive configuration files and credentials. Atlassian has patched cloud versions and released fixes for self-hosted instances, recommending immediate offline deployment for internet-facing systems until patches are applied. This incident highlights the ongoing targeting of widely-deployed enterprise collaboration platforms, following increased exploitation of Atlassian vulnerabilities by threat actors seeking initial access to corporate networks and supply chain compromise opportunities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical LibreOffice & OpenOffice Vulnerability Enables Silent Code Execution
Critical LibreOffice & OpenOffice Vulnerability Enables Silent Code Execution
Government Administration1 month ago

Critical LibreOffice & OpenOffice Vulnerability Enables Silent Code Execution

In October 2026, critical vulnerabilities were discovered in LibreOffice (CVE-2026-63277) and Apache OpenOffice (CVE-2026-59265) that allow attackers to execute arbitrary code through malicious spreadsheets without triggering macro warnings. The attack exploits database range functionality combined with JDBC drivers to automatically download and execute malicious Java code when a crafted spreadsheet is opened, requiring only that Java support is enabled. LibreOffice released patches on October 5, 2026 (versions 26.2.5 and 26.8.0), while Apache OpenOffice remains vulnerable with a fix expected in version 4.1.17. This incident highlights the evolving threat landscape where attackers are finding new ways to bypass traditional security warnings and execute code through seemingly benign document features. The vulnerability demonstrates how legitimate application functionality can be chained together to create attack vectors that circumvent established security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Security Analysis Exposes Critical Gaps in 15,465 AI MCP Servers
Security Analysis Exposes Critical Gaps in 15,465 AI MCP Servers
Computer Software/Engineering1 month ago

Security Analysis Exposes Critical Gaps in 15,465 AI MCP Servers

In October 2026, OX Security's analysis of 15,465 publicly indexed Model Context Protocol (MCP) servers revealed critical security gaps in AI supply chain infrastructure. The research found no security guardrails or review processes across major MCP marketplaces, with 15.6% of servers hosted outside the US, including 19 in China and 18 in Russia. Additionally, 0.45% of servers operated through consumer tunneling services on personal machines, while 2.3% existed on dangling domains that could be hijacked for $4-12. The study exposed how MCP's rapid adoption has created unvetted pathways for AI agents to access external resources, bypassing enterprise security controls. This analysis highlights the emerging risks in AI supply chain security as organizations rapidly integrate AI agents and tools without proper governance frameworks, creating new attack vectors that traditional security measures don't address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Under Siege: Third Zero-Day Exploit Emerges in Two Weeks
Citrix NetScaler Under Siege: Third Zero-Day Exploit Emerges in Two Weeks
Financial Services1 month ago

Citrix NetScaler Under Siege: Third Zero-Day Exploit Emerges in Two Weeks

Citrix disclosed CVE-2026-88779, the third actively exploited NetScaler zero-day vulnerability within a two-week period in December 2024. This high-severity denial-of-service vulnerability affects NetScaler instances with SAML authentication enabled, allowing attackers to crash systems with a single crafted request. While less severe than the previous two zero-days, threat actors are actively exploiting it in the wild and can chain it with CVE-2026-88771 to accelerate attacks. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and Citrix has released patches. This incident highlights the escalating threat landscape targeting network edge infrastructure, with organizations facing unprecedented pressure from sophisticated adversaries exploiting zero-day vulnerabilities at an alarming pace.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign
Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign
Banking/Mortgage1 month ago

Major ATM Malware Developer Arrested: Inside the $5.4M Ploutus Jackpotting Campaign

The U.S. Department of Justice arrested Anibal Alexander Canelon Aguirre, alleged developer of Ploutus ATM malware and leader of a criminal organization linked to the Tren de Aragua Venezuelan gang. Between February 2024 and December 2025, Canelon Aguirre and accomplices conducted jackpotting attacks against ATMs across 47 states, stealing over $5.4 million from 63 bank ATMs and 54 credit union machines. The sophisticated malware included anti-analysis features and self-deletion capabilities to evade detection. Financial losses exceeded $100,000 per incident, with stolen funds laundered and transferred to TdA accounts internationally. This case represents the largest coordinated ATM jackpotting campaign in U.S. history, highlighting the growing sophistication of transnational cybercrime organizations and their ability to monetize physical infrastructure attacks at scale across multiple jurisdictions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
Banking/Mortgage1 month ago

AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything

In October 2026, South Korea's Financial Services Commission launched emergency investigations after AI-powered cyberattacks targeted multiple major financial institutions. Shinhan Bank suffered a breach affecting 25,000 customers, while Kookmin Bank lost credit card information for 119,000 clients, and Hana Bank experienced a limited compromise of its sales-support system. Evidence suggests attackers used ARTEX AI, an open-source penetration testing framework that automates vulnerability discovery and attack-path planning, marking one of the first confirmed uses of AI agents in large-scale financial sector breaches. This incident represents a critical inflection point as threat actors begin weaponizing AI automation tools for sophisticated attacks against high-value targets. The use of autonomous AI agents for reconnaissance and exploitation signals a new era of accelerated, intelligent cyber warfare that traditional security controls struggle to counter.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports