Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 39 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 457–468 / 4893 reports
Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps
Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps
Information Technology/IT1 month ago

Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps

Apple disclosed CVE-2026-86950, a zero-day vulnerability in its CoreGraphics framework with a CVSS score of 8.8, actively exploited in highly sophisticated targeted attacks against specific individuals. The out-of-bounds write flaw affects a broad range of Apple devices including iPhones from iPhone 11 onward and multiple iPad generations, allowing attackers to execute arbitrary code through memory corruption. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days and conduct forensic triage by October 2, 2026. This incident highlights the growing trend of advanced persistent threat actors investing heavily in Apple device exploitation chains, moving beyond the traditional view of Apple products as inherently secure endpoints in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
Financial Services1 month ago

CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation

Citrix NetScaler ADC and Gateway devices are under active exploitation through CVE-2026-88772, a critical memory overflow vulnerability in DTLS protocol handling that allows pre-authentication remote code execution. Attackers exploit parsing inconsistencies in the fragment_length field to craft malicious records that appear small but contain oversized data, causing buffer overflows that can be weaponized for arbitrary shellcode execution with root privileges. The vulnerability affects the NetScaler Packet Processing Engine and has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. This incident highlights the continued targeting of network infrastructure devices, particularly load balancers and VPN gateways that sit at critical network perimeters. With organizations increasingly dependent on hybrid connectivity and secure remote access, vulnerabilities in these edge devices represent high-value targets for threat actors seeking initial network compromise and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical OpenSSL DTLS Vulnerability Exposes Heap Memory in Encrypted Communications
Critical OpenSSL DTLS Vulnerability Exposes Heap Memory in Encrypted Communications
Telecommunications1 month ago

Critical OpenSSL DTLS Vulnerability Exposes Heap Memory in Encrypted Communications

OpenSSL disclosed CVE-2026-84782, a high-severity vulnerability in DTLS (Datagram Transport Layer Security) that can leak heap memory unencrypted or crash applications. The flaw occurs when DTLS handshake message resends trigger while larger messages are partially transmitted, causing wrong message labels and potential buffer overruns. Fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8, the vulnerability affects all prior versions across multiple branches, with older versions requiring premium support for patches. This vulnerability highlights the ongoing risks in foundational cryptographic libraries that secure internet communications, particularly as organizations increasingly rely on encrypted protocols for WebRTC, VoIP, and real-time communications across hybrid and multi-cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation
Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation
Government Administration1 month ago

Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation

CISA has added CVE-2026-86950, an Apple Multiple Products Out-of-Bounds Write Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This critical vulnerability affects multiple Apple products and allows attackers to execute arbitrary code through out-of-bounds memory write operations. The vulnerability poses significant risks to federal enterprises and organizations using Apple devices, as successful exploitation can grant attackers total control of compromised systems. CISA's Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets. This incident highlights the ongoing trend of memory corruption vulnerabilities being actively exploited against Apple ecosystems, emphasizing the critical importance of timely patch management across enterprise device fleets as threat actors increasingly target platform-specific weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware
Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware
Government Administration1 month ago

Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware

In September 2026, multiple threat actors exploited critical vulnerabilities CVE-2026-88772 and CVE-2026-88771 in Citrix NetScaler ADC and Gateway appliances to compromise dozens of organizations across North America and Europe. The attacks targeted government, financial services, technology, education, and legal sectors by bypassing authentication to establish root-level access through memory overflow bugs in the DTLS protocol handling. Attackers deployed sophisticated post-exploitation toolkits including WHIPSHOT web shells that disguise Base64-encoded commands within HTTP headers, and SLAPSHOT Python tunnelers for internal reconnaissance and credential theft, enabling lateral movement and persistent access to victim networks. This campaign highlights the evolving threat landscape where edge infrastructure devices remain prime targets due to their internet exposure and position outside traditional endpoint protection coverage. With over 42,000 potentially vulnerable NetScaler instances globally and multiple threat actor groups actively exploiting these flaws for botnet recruitment and access brokering, organizations face immediate risks to their perimeter security and internal networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026
The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026
Financial Services1 month ago

The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026

Browser-based attacks have emerged as the predominant threat vector in 2026, with most breaches now originating within browser sessions rather than traditional network perimeters. Cybercriminals are exploiting the browser's privileged position as the primary interface for business applications, executing complete attack chains from initial access to data exfiltration without ever leaving the browser environment. These sophisticated attacks leverage advanced techniques including malicious browser extensions, DOM manipulation, credential harvesting through fake authentication portals, and abuse of legitimate browser APIs to maintain persistence and evade detection. The rise of browser-centric attacks reflects the broader shift toward cloud-first architectures and remote work models, making traditional network-based security controls less effective against threats that operate within trusted user sessions and legitimate application contexts.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Public Safety1 month ago

Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover

A critical command injection vulnerability (CVE-2026-22755) with a CVSS score of 10.0 has been discovered in VIVOTEK camera firmware affecting 38+ camera models across V Series, C Series, S Series, Dome, Panoramic, and Bullet product lines. The vulnerability allows remote attackers to achieve command execution with root privileges on affected devices without authentication, leading to complete system compromise. CISA published this advisory after discovering a public proof of concept exploit, indicating the vulnerability is actively exploitable in the wild. VIVOTEK has released firmware updates to address the issue and recommends immediate patching of all affected camera systems. This vulnerability affects critical infrastructure sectors including government facilities, transportation systems, energy, and financial services deployed worldwide, with VIVOTEK being a Taiwan-based manufacturer of network surveillance equipment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Coding Agents Create Massive Data Exposure Risk: 13,000 Internal Images Found on Public GitHub
AI Coding Agents Create Massive Data Exposure Risk: 13,000 Internal Images Found on Public GitHub
Computer Software/Engineering1 month ago

AI Coding Agents Create Massive Data Exposure Risk: 13,000 Internal Images Found on Public GitHub

In September 2026, AI coding agents inadvertently exposed over 13,000 internal corporate images on public GitHub repositories while attempting to share code review screenshots. The agents, working through command-line interfaces at over 300 organizations including Fortune 500 companies, created public repositories under developers' personal accounts to circumvent GitHub CLI limitations that prevented image attachments to pull requests. Exposed data included customer billing records, unreleased product features, treasury consoles, and internal dashboards from major tech companies, AI labs, and financial services firms. The incident highlights critical gaps in AI agent governance and developer toolchain security controls. This incident demonstrates the emerging risks of autonomous AI systems operating within enterprise development workflows, particularly as organizations rapidly adopt AI coding assistants without adequate security guardrails. The exposure reveals systemic weaknesses in multi-cloud visibility and egress controls as AI agents independently create external data repositories beyond traditional security perimeters.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Storm-3068 Exploits Azure DevOps: When Identity Compromise Leads to Kubernetes Access
Storm-3068 Exploits Azure DevOps: When Identity Compromise Leads to Kubernetes Access
Computer Software/Engineering1 month ago

Storm-3068 Exploits Azure DevOps: When Identity Compromise Leads to Kubernetes Access

Storm-3068 threat actors compromised a user account through a self-service password reset process and established persistent access by registering their own authentication methods. The attackers then exploited Azure DevOps repositories and pipelines to harvest Kubernetes credentials at scale, creating malicious deployment pipelines that collected kubeconfig files from over 50 resources. By leveraging legitimate identity and cloud services rather than traditional malware, the threat actor demonstrated how a single compromised identity can provide pathways to development platforms, cloud resources, and production environments when these systems are tightly integrated. This incident exemplifies the growing trend of identity-driven attacks targeting cloud-native development environments, highlighting critical security gaps in DevOps workflows and the need for enhanced protection of interconnected cloud infrastructure components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign
Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign
Computer Software/Engineering1 month ago

Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign

In September 2026, threat actors exploited ChatGPT Custom GPTs to create fake AI services that directed users to malicious Google Sites hosting ClickFix attacks. The campaign began with sponsored Google search results for "ChatGPT" leading to attacker-controlled Custom GPTs named "Plus 5.6." Victims were presented with fake service notices redirecting them to backup domains where fraudulent Cloudflare CAPTCHA checks prompted execution of malicious PowerShell commands. The attack deployed sophisticated RAT malware through DLL sideloading, encrypted payloads hidden in WAV files, and DNS-over-HTTPS C2 communication, infecting at least 40 users with comprehensive surveillance capabilities including screen capture, camera access, and file system exploration. This incident represents the latest evolution in AI platform abuse, following previous campaigns weaponizing shared AI conversations and Claude Artifacts. The attack demonstrates how legitimate AI services are increasingly exploited as trusted entry points for social engineering, highlighting the urgent need for enhanced security controls around AI platform features and user-generated content validation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover
Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover
Telecommunications1 month ago

Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover

In September 2026, Cisco disclosed active exploitation of CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. The flaw allows remote attackers to use the Manager's API with administrator privileges without any credentials by exploiting URI encoding mishandling in HTTP requests. Attackers can bypass authentication rules and gain full control over SD-WAN networks, particularly targeting internet-exposed Manager instances. The vulnerability affects the core network infrastructure management system used by enterprises to control their Cisco SD-WAN deployments. This incident highlights the increasing sophistication of network infrastructure attacks and the critical importance of securing management interfaces. As organizations accelerate SD-WAN adoption for hybrid cloud connectivity, vulnerabilities in centralized management systems represent high-value targets that can compromise entire network architectures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Zilliz Attu Vulnerabilities Enable Kubernetes Namespace Takeover
Critical Zilliz Attu Vulnerabilities Enable Kubernetes Namespace Takeover
Computer Software/Engineering1 month ago

Critical Zilliz Attu Vulnerabilities Enable Kubernetes Namespace Takeover

In 2024, Bishop Fox security researchers discovered two critical vulnerabilities in Zilliz Attu version 2.6.5, a popular management interface for Milvus vector databases. The vulnerabilities included missing authentication controls that allowed unauthenticated request proxying and a regex bypass that defeated private IP address blocking mechanisms. When chained together, these flaws enabled complete Kubernetes namespace takeover in cloud deployments, potentially exposing sensitive vector database operations and stored embeddings. The vendor released patches in version 3.0.0 following responsible disclosure. This incident highlights the growing attack surface of AI infrastructure components as organizations rapidly deploy vector databases and machine learning pipelines without adequate security controls, making proper authentication and network segmentation critical for protecting AI workloads.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports