Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 42 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 493–504 / 4893 reports
OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets
OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets
Information Technology/IT1 month ago

OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets

A widespread security vulnerability affecting Kubernetes operators has been identified through research by Palo Alto Networks Unit 42, revealing that over 5% of operators in the OperatorHub registry contain excessive RBAC permissions that violate the principle of least privilege. The investigation led to the discovery of CVE-2026-6389, a high-severity vulnerability (CVSS 8.8) in IBM's Turbonomic Prometurbo operator that granted cluster-wide access to secrets across all namespaces. Using their open-source OperTraitor tool, researchers found that many operators function as silent backdoors due to overly permissive service account configurations, with outdated and abandoned components remaining easily accessible through default registries. This vulnerability becomes critically relevant as the industry transitions toward AI-driven agentic operators that combine traditional Kubernetes automation with large language models. The shift to autonomous, AI-enhanced cluster management amplifies the risk of RBAC misconfigurations, transforming passive security gaps into active threat vectors capable of autonomous decision-making with excessive privileges.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
The New Face of Email Threats: How AI is Revolutionizing Social Engineering
The New Face of Email Threats: How AI is Revolutionizing Social Engineering
Financial Services1 month ago

The New Face of Email Threats: How AI is Revolutionizing Social Engineering

Modern email-based social engineering attacks have evolved significantly beyond traditional phishing methods, leveraging AI to craft sophisticated campaigns that bypass conventional security awareness training. Attackers now employ AI-powered tools to generate grammatically perfect content, use QR codes to evade URL inspection, and deploy techniques like ConsentFix and ClickFix that manipulate legitimate authentication flows. These attacks target active user sessions and authentication tokens rather than just passwords, with QR code phishing accounting for one in nine detected phishing emails in recent ESET telemetry. This evolution represents a critical shift in the threat landscape as cybercriminals increasingly weaponize AI to scale personalized attacks and exploit the expanding attack surface of cloud-native environments. Organizations must move beyond traditional awareness training to implement zero-trust verification controls and advanced detection capabilities that can identify sophisticated social engineering attempts in real-time.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities
AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities
Computer Software/Engineering1 month ago

AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities

In 2024, GitHub Security Lab researchers developed an open-source AI security agent that successfully identified 24 vulnerabilities across multiple Android applications, including critical flaws in popular apps like OsmAnd navigation (10+ million downloads) and Wikipedia. The AI-powered taskflows discovered sophisticated vulnerabilities including location tracking bypasses, account takeover mechanisms, and intent-based security flaws that traditional security testing might have missed. The research demonstrates how AI agents can systematically analyze mobile application codebases to identify complex logic vulnerabilities and API misuse patterns. This research highlights the growing effectiveness of AI-assisted security testing as mobile applications become increasingly complex and traditional manual code review struggles to scale. With Android's security model continuously evolving and new attack vectors emerging through deep links and inter-app communication, automated AI-driven vulnerability discovery represents a critical advancement in proactive mobile security.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
State Surveillance Exploits WhatsApp and Signal Device Linking Features
State Surveillance Exploits WhatsApp and Signal Device Linking Features
Law Enforcement1 month ago

State Surveillance Exploits WhatsApp and Signal Device Linking Features

German law enforcement has been exploiting device linking features in encrypted messaging apps WhatsApp and Signal to conduct surveillance operations. The technique involves connecting a police-controlled computer to a suspect's messaging account through either physical access to their device or intercepting verification codes via state-sanctioned phishing attacks and SMS interception. Once connected, all messages are delivered to the law enforcement device without breaking encryption, effectively bypassing the security protections these apps provide. This surveillance method has raised significant concerns about digital privacy and the potential for abuse of legitimate messaging features by state actors. This incident highlights the growing sophistication of state-sponsored surveillance techniques that exploit legitimate application features rather than traditional cryptographic attacks. As governments worldwide expand digital surveillance capabilities and encrypted communications become more prevalent, understanding these attack vectors is crucial for both individual privacy protection and organizational security planning.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Financial Services1 month ago

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

In September 2024, Citrix NetScaler appliances became targets of active zero-day exploitation involving CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on the CVSS scale. Attackers exploited a command injection vulnerability affecting all NetScaler devices in default configurations, achieving remote code execution. The incident was particularly notable for Citrix's delayed disclosure, leaving customers without official warnings for over 36 hours while exploitation was actively occurring. Security professionals, insurance providers, and researchers issued unofficial warnings through back channels before Citrix finally published patches and advisories. With over 50,000 publicly exposed NetScaler instances potentially vulnerable, the incident highlighted critical gaps in vendor communication during active exploitation scenarios. This incident underscores the growing trend of attackers targeting network infrastructure appliances as initial access vectors, particularly in an era where traditional perimeter security models are increasingly inadequate. The delayed vendor response demonstrates the urgent need for organizations to implement zero-trust architectures and real-time threat detection capabilities rather than relying solely on vendor patches and advisories.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Financial Services1 month ago

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

In December 2024, Kiteworks, a secure file transfer provider, issued an unprecedented advisory telling customers to take production systems offline following credible threat intelligence from federal authorities about an imminent cyberattack. The company proactively shut down customer environments over the weekend while working with federal intelligence agencies and security partners including Mandiant. During the shutdown, Kiteworks discovered and patched a critical vulnerability in their Advanced Forms product affecting approximately 50 organizations, with no evidence of exploitation. The company resumed normal operations after continuous monitoring showed no malicious activity. This incident highlights the growing trend of proactive threat response and public-private intelligence sharing in cybersecurity. As supply chain attacks continue to target file transfer and collaboration platforms, the willingness of vendors to prioritize security over operational convenience signals a maturation in industry threat response practices.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Government Administration1 month ago

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

In September 2026, CISA issued emergency directives ordering federal agencies to patch two critical Citrix NetScaler zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) by Wednesday after confirming active exploitation. The vulnerabilities allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, affecting thousands of internet-exposed instances. Threat actors were observed placing shellcode directly into memory on vulnerable systems, prompting national cybersecurity agencies to advise organizations to immediately shut down unpatched NetScaler deployments. This incident highlights the persistent targeting of network infrastructure appliances that serve as critical trust boundaries in enterprise environments. The rapid exploitation of these zero-days demonstrates the increasing sophistication of threat actors who can weaponize vulnerabilities within hours of discovery, making traditional patch cycles inadequate for defending against modern attack timelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Bitget Resumes Operations After $387.5M North Korean Crypto Heist
Bitget Resumes Operations After $387.5M North Korean Crypto Heist
Financial Services1 month ago

Bitget Resumes Operations After $387.5M North Korean Crypto Heist

In September 2026, cryptocurrency exchange Bitget suffered a major security breach attributed to North Korean state-sponsored hackers who stole $387.5 million from the platform's hot and warm wallets. The attackers compromised a critical backend system within Bitget's wallet infrastructure, enabling them to spoof transaction data and trigger unauthorized fund transfers across multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget temporarily suspended all withdrawals as a security measure before gradually resuming services starting with Bitcoin withdrawals. This incident highlights the continuing evolution of North Korean cyber operations targeting cryptocurrency exchanges, representing part of an estimated $6 billion in crypto assets stolen since 2017. The breach demonstrates sophisticated techniques for compromising wallet infrastructure and the ongoing threat to digital asset platforms from nation-state actors seeking to circumvent international sanctions.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials
Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials
Computer Software/Engineering1 month ago

Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials

In August 2026, a massive credential theft campaign targeting AI platforms exposed over 80,000 organizations worldwide, with infostealers harvesting login credentials and session tokens from employees' personal devices. The attack primarily targeted ChatGPT users but also affected Claude, Hugging Face, Replit, and other AI services, with stolen credentials being sold on underground markets for unauthorized access and billing fraud. SOCRadar's research revealed that 68% of affected organizations were billion-dollar enterprises across 36 countries, with attackers gaining access to conversation histories containing sensitive corporate data, API keys, and OAuth tokens with standing permissions to other enterprise systems. This incident highlights the critical security risks of shadow AI adoption as organizations increasingly rely on AI assistants for business operations. The theft demonstrates how unmanaged AI tool usage creates new attack vectors for data exfiltration and unauthorized access to corporate resources, making AI platforms as critical as identity providers in enterprise security strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Financial Services1 month ago

Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know

CISA added two critical Citrix NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution through improper input validation in a Perl script, while CVE-2026-88772 (CVSS 9.5) enables RCE via memory buffer operations when DTLS is enabled. Attackers are exploiting these flaws to achieve root-level access on vulnerable NetScaler appliances, potentially compromising enterprise network infrastructure and VPN gateways. This incident highlights the continued targeting of network appliances as critical attack vectors, particularly as organizations expand their hybrid cloud deployments and remote access infrastructure. The pre-authentication nature of these exploits makes them especially dangerous for threat actors seeking initial network footholds.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
Information Technology/IT1 month ago

JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks

In June 2026, the JadePuffer ransomware operator (tracked by Microsoft as Storm-3168) conducted sophisticated AI-driven attacks against Azure cloud tenants using compromised service principals. The threat actor employed autonomous AI agents to automate the entire attack chain, including reconnaissance, credential theft, lateral movement, and destructive operations targeting over 100 storage accounts, Key Vaults, Function Apps, and Virtual Machines. The destructive phase lasted only seven minutes, with attackers systematically removing backup protections and attempting to make recovery more difficult to support potential ransomware extortion. This incident represents a critical evolution in ransomware tactics, demonstrating how threat actors are weaponizing AI agents to accelerate and scale cloud-native attacks. The emergence of agentic AI in cybercrime signals a new era of automated, intelligent threats that can operate at machine speed against cloud infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
Computer Software/Engineering1 month ago

How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026

In September 2026, cybersecurity researchers at UpGuard discovered over 16,000 misconfigured Supabase databases exposing sensitive data including personally identifiable information, passwords, and authentication tokens. The exposures affected diverse organizations globally, from a U.S. valet service with 100,000+ customer records to a Canadian immigration service with nearly 5,000 user records including 884 plaintext passwords. Researchers attributed these widespread misconfigurations to poor application security settings, missing row-level security policies, and the increasing use of AI-assisted development tools that create databases without proper security awareness from developers. This incident highlights the growing security risks associated with AI-powered development platforms and cloud database misconfigurations. As AI-assisted coding becomes more prevalent, accounting for over 60% of new Supabase databases, the potential for systematic security oversights increases dramatically, making comprehensive cloud security posture management and zero-trust architectures more critical than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports