Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 5 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 49–60 / 4893 reports
How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure
How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure
Computer Software/Engineering5 days ago

How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure

On October 30, 2026, WorkOS—a developer infrastructure platform serving over 3,000 enterprises including OpenAI and Anthropic—detected unauthorized access to an internal sales application. The attacker leveraged ARTEX AI, an open-source offensive security framework developed by Chinese researchers, to automate reconnaissance and exploitation. Business contact records, CRM histories, customer communication summaries, and account relationship data were exfiltrated. Forensic analysis identified attacker user agents 'artex-enrich/1.0' and 'norma/0.4' in web request logs. Production services and core WorkOS APIs were unaffected. An independent incident response firm was engaged and external access to the compromised application was immediately disabled. This incident reflects a rapidly maturing trend of AI-assisted intrusion campaigns. ARTEX AI has now been linked to attacks on South Korean banks, a global campaign by Chinese espionage group Vapor Panda targeting 200 organizations, and the breach of cybersecurity nonprofit DIVD. Defenders must treat AI-powered offensive tooling as a persistent, scalable threat category requiring automated detection and zero-trust network controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool
cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool
Information Technology/IT5 days ago

cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool

On November 2, 2026, attackers used compromised credentials to access OpsShield's CDN update infrastructure for cPGuard, a widely deployed Linux web-server security suite. Malicious scripts were distributed through the legitimate autoupdate channel across versions 5.88.12–5.88.19 for approximately 12 hours. The payload harvested Linux password hashes, MariaDB/MySQL root credentials, root shell history, and SSH keys from affected servers, exfiltrating 32 files per host to an attacker-controlled staging point. Nearly 2,946 servers were confirmed compromised, and OpsShield's own billing system database was also copied. This incident exemplifies the accelerating abuse of trusted software update pipelines as a primary attack vector. As hosting providers and server administrators depend on automated update mechanisms for security tooling, supply-chain compromises that weaponize the update channel itself bypass traditional perimeter defenses entirely, underscoring the critical need for egress controls, credential hygiene, and behavioral anomaly detection across managed infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor
How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor
Financial Services5 days ago

How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor

In a multi-stage supply-chain and social-engineering campaign spanning June through October 2026, North Korea-linked threat actors stole $6.43 billion from Binance—the largest cryptocurrency theft on record. Attackers first compromised a Wallet DevOps engineer via a trojanized Homebrew AI-tool installer, exposing team and infrastructure metadata. A second engineer was then targeted through a fake recruitment interview on a legitimate job platform, leading to the delivery of a malicious code repository. The attacker leveraged a compromised internal AI tool to pivot across engineer endpoints, steal a container-deployment token, and ultimately abuse Binance's internal wallet signing service to initiate unauthorized transactions outside normal withdrawal controls. This incident illustrates a dangerous convergence of AI-tool supply-chain poisoning, identity-pivoting through internal automation, and recruitment-themed social engineering—tactics now central to North Korean APT playbooks. As AI tooling becomes ubiquitous in developer workflows, the attack surface for similar campaigns is expanding rapidly across the financial services and Web3 sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
How an AI Agent Breached Chainstack's Production Database in Five Days
How an AI Agent Breached Chainstack's Production Database in Five Days
Financial Services5 days ago

How an AI Agent Breached Chainstack's Production Database in Five Days

On October 26, 2026, blockchain infrastructure provider Chainstack suffered an AI-powered intrusion when an external threat actor leveraged the ARTEX autonomous AI agent framework to compromise a third-party component and gain initial access to a development environment. By October 31, the attacker had escalated privileges into production systems, accessing a database containing customer organization names, account holder names, email addresses, and password hashes, as well as systems holding node credentials. The intrusion was detected and contained on October 31, 2026. The incident is linked to a broader China-attributed campaign targeting high-value technology and blockchain firms using ARTEX to automate and accelerate multi-stage attacks. This breach is part of an accelerating wave of AI-orchestrated supply-chain intrusions hitting blockchain, API platform, and vulnerability-disclosure organizations simultaneously—including WorkOS, Chainalysis, and DIVD—signaling that ARTEX-enabled campaigns can pivot from dev environments to production databases faster than traditional detection cycles allow, raising the urgency for real-time lateral movement controls and segmentation.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Information Technology/IT5 days ago

Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access

In November 2026, Barracuda disclosed two chained vulnerabilities—CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass affecting the Email Security Gateway, and CVE-2026-111560 (CVSS 8.6), a command injection flaw impacting six Barracuda products including the Web Application Firewall, Load Balancer ADC, and Web Security Gateway. When exploited in sequence, an unauthenticated attacker with network access to the administrative interface can bypass authorization controls and achieve root-level code execution on the appliance. Organizations exposing administrative interfaces to the internet face the highest risk. Barracuda urged immediate firmware patching and restriction of admin interface access to trusted internal networks. This disclosure follows a well-documented pattern of nation-state and cybercriminal actors targeting network edge appliances—most notably the 2023 Barracuda ESG zero-day campaign attributed to UNC4841. Chained appliance vulnerabilities that yield root access are increasingly weaponized within days of disclosure, making rapid patch deployment and administrative interface segmentation a board-level priority in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
Financial Services5 days ago

One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path

In late October 2026, North Korea's TraderTraitor threat group executed the largest cryptocurrency exchange breach in history, stealing $6.3 billion from Binance in approximately 20 minutes. The attackers began by compromising a developer's laptop, then pivoted into an internal service container with withdrawal-request privileges. Exploiting an Ethereum account-delegation mechanism, they obtained transaction approval authority over a hot wallet and drained assets while bypassing Binance's normal approval controls—without using any leaked wallet keys. Binance froze roughly $3 billion and used its own reserves to replenish approximately 95% of affected assets. This incident follows the February 2025 Bybit breach ($1.5 billion) and illustrates an accelerating pattern of North Korean state-sponsored actors targeting crypto infrastructure through insider-path exploitation—manipulating trust relationships and privileged workloads rather than breaking perimeter defenses. With crypto-related theft attributable to DPRK-linked actors now exceeding 76% of all reported 2026 losses, enterprises across all verticals must re-examine blast-radius containment and lateral privilege controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do
LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do
Information Technology/IT5 days ago

LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do

LLMjacking has evolved from an opportunistic tactic into a structured cybercriminal enterprise, as documented in a November 2026 Google Threat Intelligence Group and Mandiant report. Attackers gain initial access to cloud environments by stealing or exposing IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. Once inside, they quietly validate stolen credentials using minimal API requests—sometimes a single output token—before routing paying customers through victim infrastructure via underground LLM Mixer services. Individual organizations have absorbed fraudulent resource charges exceeding $100,000 in a single day, with cumulative losses at some victims reaching $1 million before access was revoked. LLMjacking represents a structural shift in cloud-era cybercrime: attackers now monetize access rather than data. As enterprise AI adoption accelerates, exposed LLM endpoints and poorly governed cloud identities create a scalable revenue stream for financially motivated threat clusters operating globally, making identity hygiene, AI service visibility, and egress control urgent priorities for security teams in 2026 and beyond.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys
CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys
Financial Services5 days ago

CVE-2026-81648: How a CVSS 10.0 WordPress Plugin Flaw Is Handing Attackers Crypto Wallet Keys

In November 2026, threat actors began actively exploiting CVE-2026-81648, a CVSS 10.0 critical vulnerability in the CryptoPayment Gateway WordPress plugin (versions 1.2.1–1.2.2). The flaw exposes an unauthenticated AJAX endpoint that allows attackers to delete arbitrary files, overwrite payment gateway configurations, and retrieve stored wallet credentials in cleartext—all without any login. Attack infrastructure was traced to anonymous, KYC-free VPS hosting providers. No patch exists; the plugin was removed from the WordPress Plugin Directory on August 28, 2026. Affected site operators are advised to immediately remove the plugin, rotate all wallet keys, and audit server logs for unauthorized changes. This incident highlights a growing trend of financially motivated threat actors targeting Web3 and cryptocurrency payment integrations embedded in mainstream CMS platforms. As crypto adoption expands in e-commerce, unpatched plugin vulnerabilities with cleartext credential exposure represent a high-value, low-effort attack surface that defenders must prioritize with network egress controls and anomaly detection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
Information Technology/IT5 days ago

C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now

In November 2026, Synology issued an urgent advisory after threat actors exploiting CVE-2024-10441 (CVSS 9.8) — a remote code execution flaw in DiskStation Manager patched in December 2024 — began deploying C3RB3R ransomware against NAS devices still running outdated DSM versions. The C3RB3R group, which has a documented history of targeting NAS infrastructure, encrypted victim files with a .L0CK3D extension and dropped ransom notes in every affected directory. Attackers also leveraged two newly disclosed 2026 DSM vulnerabilities (CVE-2026-13684 and CVE-2026-13639, both CVSS 9.8) affecting SCGI and login logic, enabling arbitrary file read/write and denial-of-service. Synology urged immediate patching and activation of automatic updates across all affected DSM branches. This incident underscores a persistent and escalating pattern: ransomware operators are increasingly targeting unpatched network-attached storage devices as primary encryption targets, exploiting months-old CVEs that organizations fail to remediate. With NAS devices frequently storing backup and archival data, successful encryption dramatically elevates recovery costs and operational disruption, amplifying ransom leverage.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know
BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know
Financial Services5 days ago

BTCPay Server Exploit Drains Bitcoin and Litecoin Hot Wallets: What Every Crypto Merchant Needs to Know

In November 2026, threat actors actively exploited a critical vulnerability in BTCPay Server versions 2.4.1 and earlier, a widely-deployed self-hosted open-source cryptocurrency payment processor. Attackers targeted unpatched instances to drain Bitcoin and Litecoin directly from hot wallets, resulting in direct financial losses for merchants and payment processors relying on the platform. BTCPay Server's maintainers issued an urgent advisory confirming the attacks were exploitation-driven, urging all operators to immediately upgrade to the patched release. The incident underscores the compounding risk of unpatched open-source financial infrastructure exposed to the internet. This breach reflects a broader surge in financially-motivated attacks against cryptocurrency payment infrastructure. As digital asset adoption grows among merchants and fintechs, self-hosted payment processors represent high-value, under-monitored targets. Threat actors are increasingly weaponizing known CVEs against open-source stacks where patch cadence is inconsistent and egress controls are minimal.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
Information Technology/IT5 days ago

CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit

In November 2026, Red Hat and Canonical disclosed CVE-2026-98432, a critical use-after-free vulnerability (CVSS 9.8) in the Linux kernel's IPv4 TCP stack present since kernel version 4.4. A remote, unauthenticated attacker can trigger a race condition by sending IPv4 TCP connection requests carrying Record Route or Timestamp IP options to any listening TCP port, potentially achieving remote code execution without credentials or user interaction. Red Hat shipped emergency errata for RHEL 8, 9, and 10 on November 1, 2026, while Ubuntu's fixes for its three current LTS releases remain in an opt-in testing channel. Anthropic disclosed that an internal AI research model independently developed a working remote root exploit requiring no credentials, with full root shell access achievable in under one hour. This incident underscores the accelerating intersection of AI-assisted exploit development and unpatched Linux infrastructure. As AI models demonstrate the capacity to autonomously construct kernel-level exploits, the window between vulnerability disclosure and weaponization is collapsing, demanding near-real-time patch cadence and compensating network controls across cloud and hybrid environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
Financial Services5 days ago

LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges

In 2026, Google Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks targeting enterprises across financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific. Threat actors—including the tracked cluster UNC6993—obtained cloud credentials via phishing, misconfigured Service Account keys, exposed GitHub Personal Access Tokens, and public code repositories to gain unauthorized access to enterprise LLM APIs. After establishing a foothold, attackers escalated privileges, performed multi-region reconnaissance, cloned codebases for hard-coded secrets, and created backdoor service accounts. Fraudulent LLM consumption exceeded $100,000 USD in a single day at individual organizations, with cumulative charges reaching $1 million USD before access was revoked. LLMjacking represents a structural evolution beyond cryptojacking, exploiting the high per-token cost of frontier AI models and the emergence of underground LLM Mixer services that proxy and resell stolen enterprise LLM access. As agentic AI workflows proliferate in production cloud environments, the attack surface for credential-based API abuse is expanding rapidly, making cloud identity hygiene and real-time egress enforcement urgent priorities for security teams in 2026 and beyond.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports