Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 334 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3997–4008 / 4903 reports
FBI: $262M Lost to ATO Fraud as AI Phishing and Holiday Scams Surge in 2025
Banking/Mortgage10 months ago

FBI: $262M Lost to ATO Fraud as AI Phishing and Holiday Scams Surge in 2025

In late 2025, the FBI reported an alarming uptick in Account Takeover (ATO) fraud totaling over $262 million in losses. Cybercriminals, leveraging advanced AI-driven phishing tactics and holiday-themed scams, targeted individuals, businesses, and financial institutions with convincing impersonations to steal credentials and gain access to banking and sensitive accounts. Upon entry, attackers executed lateral movement, funds transfers, and data exfiltration, impacting organizations of all sizes and sectors by causing substantial financial loss, reputational harm, and regulatory scrutiny. This incident underscores an acceleration in AI-powered social engineering and the increasing sophistication of phishing campaigns, especially during high-activity periods like the holidays. Security teams now face heightened urgency to adapt with advanced detection, identity controls, and zero trust segmentation to address evolving threats using AI and automation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious Chrome Extension Diverts Solana in Raydium Swaps: Supply Chain Breach 2024
Financial Services10 months ago

Malicious Chrome Extension Diverts Solana in Raydium Swaps: Supply Chain Breach 2024

In May 2024, researchers identified a malicious Chrome extension named 'Crypto Copilot' that was surreptitiously injecting unauthorized Solana (SOL) transfer instructions during Raydium swap transactions, redirecting user assets to an attacker-controlled wallet. Initially published on the Chrome Web Store by a developer under the alias 'sjclark76,' the extension posed as a crypto utility tool but covertly modified transaction data to exfiltrate funds without user knowledge. The breach highlighted the growing risk of supply-chain malware within browser ecosystems and exposed users to direct financial theft via manipulated decentralized finance (DeFi) operations. This incident exemplifies a broader trend of attackers leveraging browser extensions to exploit DeFi and cryptocurrency users at scale. With the proliferation of novel supply-chain vectors and the rise of open-source and web-based crypto tools, organizations and individuals must exercise heightened due diligence and implement robust extension vetting and monitoring practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Shai-Hulud v2 Strikes: Massive npm and Maven Supply Chain Breach Exposes Secrets
Computer Software/Engineering10 months ago

Shai-Hulud v2 Strikes: Massive npm and Maven Supply Chain Breach Exposes Secrets

In November 2025, a major multi-ecosystem software supply chain attack was uncovered when the Shai-Hulud v2 campaign spread beyond the npm registry into Maven Central. Threat actors compromised over 830 npm packages and at least one Maven package (org.mvnpm:posthog-node:4.18.1), embedding malicious loaders and payloads that silently exfiltrated thousands of developer and organizational secrets. This attack leveraged highly automated techniques to inject stealthy code across registries, making mitigation and detection notably difficult. The campaign’s broad reach threatened applications, organizational infrastructure, and customers reliant on compromised components. This incident highlights a rising trend where sophisticated threat actors exploit trusted open-source software ecosystems, dramatically increasing supply chain risk. Recent surges in attacks targeting developer supply chains have prompted urgent calls for enhanced controls, continuous monitoring, stronger segmentation, and stricter compliance with software integrity standards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Qilin Ransomware Orchestrates Major Supply Chain Attack on South Korean MSPs in 2025
Financial Services10 months ago

Qilin Ransomware Orchestrates Major Supply Chain Attack on South Korean MSPs in 2025

In October 2025, a sophisticated supply chain attack targeted multiple South Korean financial sector organizations via a compromised Managed Service Provider (MSP). The threat was executed by the Qilin Ransomware-as-a-Service (RaaS) group, with indications of potential collaboration from North Korea-affiliated Moonstone Sleet actors. Attackers infiltrated the MSP’s infrastructure, leveraged lateral movement to access at least 28 client environments, and deployed the Qilin ransomware payload, resulting in mass data exfiltration and operational disruption. The group publicized stolen information on their so-called 'Korean Leaks' site to pressure victims for ransom, significantly impacting banking, insurance, and fintech operations region-wide. This attack underscores the growing risk of supply chain compromise, particularly where highly interconnected MSP platforms are leveraged to target multiple downstream entities simultaneously. The tactic reflects emerging ransomware trends seen globally, where threat actors exploit trusted service providers to maximize victim impact and amplify regulatory, reputational, and economic damage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Malware Authors Leverage LLMs: 2024's Unprecedented Evasion Tactics
Financial Services10 months ago

Malware Authors Leverage LLMs: 2024's Unprecedented Evasion Tactics

In early 2024, cybersecurity researchers identified a new campaign where advanced persistent threat (APT) groups incorporated large language models (LLMs) into malware strains to dynamically evade traditional security controls. Attackers leveraged generative AI prompts at runtime to modify payloads, change behavior signatures, and bypass both heuristic and signature-based detection solutions. This innovation enabled lateral movement within compromised environments, facilitated egress of sensitive data, and complicated incident response due to the malware's adaptive techniques. Several enterprise and public sector networks were affected, leading to significant operational disruptions and raising concerns about advanced AI-powered threats. The incident underscores a rapidly escalating trend: cybercriminals are weaponizing AI and LLMs to outpace enterprise defenses, blending evasion, lateral movement, and multi-cloud attack vectors. The urgency is heightened as regulatory frameworks evolve and organizations race to adopt zero trust, segmentation, and advanced anomaly detection to keep pace.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Inside the 2025 Digital Fraud Surge: How AI Supercharged Cybercrime
Financial Services10 months ago

Inside the 2025 Digital Fraud Surge: How AI Supercharged Cybercrime

In early 2025, a wave of advanced persistent fraud targeted multiple global organizations as cybercriminals leveraged generative AI and automated bots to launch large-scale digital fraud schemes. Attackers used sophisticated deepfake technology and high-quality counterfeit IDs to penetrate identity verification systems, bypass account controls, and hijack customer accounts across banking, healthcare, and e-commerce sectors. The attacks exploited gaps in east-west traffic security and leveraged encrypted channels to evade detection for months. Businesses suffered significant financial losses, reputational damage, and were forced to bolster their compliance efforts in the wake of the breach. This incident marked a turning point in the evolution of digital fraud, as attackers embraced highly scalable automation and AI for identity-driven campaigns. The surge in industrial-scale fraud highlighted gaps in visibility, zero-trust segmentation, and anomaly detection while placing new urgency on regulatory compliance and modern defense architectures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Executive Breach Brief: Scattered LAPSUS$ Hunters’ 2025 Salesforce Ransomware Campaign
Financial Services10 months ago

Executive Breach Brief: Scattered LAPSUS$ Hunters’ 2025 Salesforce Ransomware Campaign

In May 2025, the Scattered LAPSUS$ Hunters (SLSH) cybercriminal group orchestrated a wide-scale ransomware and data extortion campaign targeting the Salesforce environments of over thirty major corporations, including brands like Toyota, FedEx, Disney/Hulu, and UPS. Leveraging sophisticated voice phishing for initial access, SLSH tricked employees into connecting malicious apps to internal Salesforce portals, facilitating rapid exfiltration of sensitive corporate data. Public threats of mass data leaks via their extortion site, insider recruitment, and the deployment of the new ShinySp1d3r ransomware further amplified organizational and reputational risk, prompting companies and regulators to respond swiftly. This incident exemplifies the convergence of advanced social engineering and ransomware-as-a-service models, alongside a growing ecosystem of cybercrime collaboration. Attackers’ use of collaboration platforms, custom malware, and drive to monetize breaches through both data theft and extortion spotlights the need for zero trust and enhanced compliance controls in identity, SaaS, and egress security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Inexpensive Hardware Bypass Exposes Flaws in AMD & Intel Memory Encryption (2024)
Financial Services10 months ago

Inexpensive Hardware Bypass Exposes Flaws in AMD & Intel Memory Encryption (2024)

In early 2024, security researchers unveiled a significant vulnerability impacting AMD and Intel CPUs implementing memory encryption for confidential computing. By constructing an inexpensive hardware module, the team demonstrated how attackers could physically intercept and decrypt protected memory traffic between the main processor and RAM, effectively bypassing hardware-implemented encryption intended to secure sensitive workloads. This attack, which operates independently of software measures, exposes plaintext data and private keys, revealing a critical flaw in the foundation of memory encryption technologies relied upon for cloud, data center, and edge security. As a result, organizations using these processors for confidential computing may be at risk until hardware changes are introduced. This research underscores increasing scrutiny of hardware-level threats as confidential computing gains adoption. With the emergence of accessible hardware-based attacks, enterprises and regulators face renewed urgency to evaluate physical and low-level protections beyond traditional network and endpoint security controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
DPRK’s FlexibleFerret Infiltrates macOS: Credential Theft at Scale
Computer Software/Engineering10 months ago

DPRK’s FlexibleFerret Infiltrates macOS: Credential Theft at Scale

In early 2024, North Korea-linked threat group tracked as FlexibleFerret intensified targeted credential-theft campaigns focusing on macOS users, evolving their "Contagious Interview" social engineering lures. By masquerading as recruiters and leveraging tailored malware, the group tricked victims into opening malicious attachments, deploying a specialized macOS information stealer. The attackers' refinements enabled broader credential compromise, facilitating unauthorized access to sensitive accounts across professional and personal domains. This incident underscores a growing operational sophistication in DPRK-attributed campaigns and heightened risk to macOS environments previously perceived as less targeted. This case highlights a surge in credential-theft, social engineering, and platform-diverse malware, especially against enterprise macOS users. Security teams must adapt defenses to evolving threat actor tactics and close compliance and detection gaps regarding endpoint security and user education.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024
Financial Services10 months ago

ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024

In December 2024, organizations worldwide were targeted by the ransomware group known as ShinySP1D3R, identified as an offshoot of the Scattered LAPSUS$ Hunters collective. Attackers exploited vulnerabilities in unencrypted east-west and egress traffic to gain network access, rapidly deploying ransomware across hybrid cloud environments during the busy holiday season. The incident resulted in substantial service outages, data encryption, and led to operational delays for affected enterprises, reinforcing the dangers of sophisticated lateral movement paired with insufficient segmentation controls. This incident highlights a rising trend of threat actors striking during holidays when staffing is limited and detection/response windows are higher. The campaign’s use of advanced TTPs—such as distributed command and control and abuse of hybrid connectivity—emphasizes why zero trust architectures and continuous threat monitoring are now business-critical.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious Underground AI Models Like WormGPT 4 Are Supercharging Cybercrime in 2024
Computer/Network Security10 months ago

Malicious Underground AI Models Like WormGPT 4 Are Supercharging Cybercrime in 2024

In early 2024, cybersecurity researchers uncovered an expanding underground marketplace for custom large language models (LLMs) such as WormGPT 4 and KawaiiGPT, designed to facilitate cybercrime. These jailbroken and open-source models, advertised and sold across dark web forums, lower the technical barrier for attackers by offering tools to scan for vulnerabilities, automate malware development, and accelerate tasks like phishing and lateral movement. Their accessibility—with minimal setup time, user-friendly interfaces, and affordable pricing—has enabled a broader range of cybercriminals to automate sophisticated attacks previously requiring advanced skills. The emergence of malicious LLMs highlights a growing trend where generative AI is weaponized in cybercrime. Unlike earlier incidents, these tools are now commercialized and widely supported, signaling a shift from simple model jailbreaking to specialized AI-enabled attack platforms. This evolution increases the urgency for organizations to strengthen AI risk management, augment detection strategies, and adapt compliance controls to address the new threat landscape.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
What the Gainsight–Salesforce Supply Chain Attack Teaches Us About SaaS Security in 2024
Computer Software/Engineering10 months ago

What the Gainsight–Salesforce Supply Chain Attack Teaches Us About SaaS Security in 2024

In late October 2024, Gainsight, a customer management SaaS provider, was implicated in a supply chain attack that impacted Salesforce environments. Attackers exploited the Gainsight connected app to obtain and abuse OAuth tokens, enabling unauthorized access to several Salesforce customer instances and raising concerns about lateral movement to other connected third-party applications. While initial reports from Salesforce identified compromised tokens and only a handful of affected customers, subsequent intelligence indicated the potential exposure of over 200 Salesforce instances. Mandiant and Salesforce collaborated to investigate the extent and mechanics of the attack, tracing earliest malicious activity to October 23, 2024. Despite ongoing forensics, Gainsight maintains that the breach impact was limited in scope, and no evidence has surfaced indicating a vulnerability within Salesforce’s platform itself. This incident reflects the growing trend of SaaS supply chain attacks that exploit authentication and integration mechanisms to reach downstream enterprise environments. The blend of fragmented disclosure, coordinated incident response, and rising third-party risks demonstrates the urgent need for improved visibility, segmented access, and standardized controls within interconnected SaaS ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports