Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Canadian Hacker Convicted in Massive Snowflake Data Breach Extortions
Between February and October 2024, Connor Riley Moucka, a 26-year-old Canadian, orchestrated unauthorized access to at least 165 organizations utilizing Snowflake's cloud data services. Exploiting stolen credentials from accounts lacking multi-factor authentication, Moucka and his co-conspirators exfiltrated sensitive data, including personal information and call records of over 100 million AT&T customers. The stolen data was used to extort victims by threatening public disclosure. This incident underscores the critical importance of implementing robust security measures, such as multi-factor authentication, to protect cloud-based data. Organizations must remain vigilant against credential-based attacks, as threat actors continue to exploit such vulnerabilities for financial gain and data theft.
1 month ago
Kill Chain
15 TP-Link Vulnerabilities Unveil Critical Zero-Touch Provisioning Risks
In August 2026, researchers at Black Hat USA disclosed 15 vulnerabilities in TP-Link's Omada software-defined networking ecosystem, highlighting significant security risks associated with zero-touch provisioning (ZTP). These vulnerabilities, affecting routers, switches, gateways, and Wi-Fi access points, could be exploited to hijack devices, execute client-side code, disclose sensitive information, and compromise encryption protocols. The findings underscore the potential for large-scale network intrusions facilitated by automated provisioning processes. The incident serves as a critical reminder of the inherent risks in ZTP implementations, emphasizing the need for organizations to scrutinize and secure their provisioning workflows. As ZTP adoption grows, ensuring robust security measures during device onboarding becomes paramount to prevent exploitation by threat actors.
1 month ago
Kill Chain
Unveiling CSS Email Attacks: Insights from Black Hat 2026
In August 2026, at Black Hat USA, security researcher Gareth Heyes unveiled a series of novel attack techniques exploiting Cascading Style Sheets (CSS) within HTML emails. These methods enable attackers to compromise email accounts by bypassing traditional security measures, such as CSS sanitization and Content Security Policies, using only CSS and HTML. The attacks can lead to unauthorized data exfiltration, user tracking, and full account takeovers without the need for JavaScript or malicious attachments. ([portswigger.net](https://portswigger.net/research/talks?talkid=34&utm_source=openai)) This research highlights a significant shift in email-based attack vectors, emphasizing the need for enhanced security measures in webmail platforms. As attackers continue to innovate, organizations must adapt their defenses to address these emerging threats.
1 month ago
Kill Chain
AI-Driven Fraud: A New Era of Global Crime Syndicates in 2026
In 2026, global crime syndicates have significantly escalated their fraudulent activities by leveraging advanced artificial intelligence technologies. These groups employ AI-driven tools such as voice cloning, deepfake real-time video overlays, large language model (LLM)-driven persona management, and automated translation to create highly convincing synthetic identities. This sophisticated approach enables them to bypass traditional 'know your customer' (KYC) protocols and other identity verification methods, leading to substantial financial losses across various sectors, including financial institutions, online retailers, and cryptocurrency exchanges. The urgency to address this issue is underscored by a 2026 INTERPOL report, which highlights a 54% increase in fraud-related campaigns since 2024, attributing this surge to AI enhancements. The report also notes that AI-enhanced fraud is 4.5 times more profitable than traditional methods, emphasizing the need for immediate and coordinated global action to combat this evolving threat. ([interpol.int](https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-warns-of-increasingly-sophisticated-global-financial-fraud-threat?utm_source=openai))
1 month ago
Kill Chain
Unveiling the Security Flaws in AI-Powered Browsers
In August 2026, security researcher Artem Chaikin presented findings at Black Hat USA 2026 revealing that AI-powered web browsers, including Opera's AI browser, Perplexity's Comet, and OpenAI's ChatGPT Atlas, are susceptible to prompt injection attacks. These attacks exploit hidden instructions within web content, leading to potential data exfiltration and account takeovers. Despite implementing various security measures such as system-level prompts, content tagging, and user approval mechanisms, these browsers remain vulnerable due to the inherent challenges in distinguishing between user instructions and untrusted web content. This incident underscores the persistent security challenges associated with integrating AI assistants into web browsers. As AI functionalities become more embedded in everyday applications, the risk of prompt injection attacks increases, highlighting the need for continuous research and development of more robust security frameworks to protect users from emerging threats.
1 month ago
Kill Chain
Understanding 'PleaseFix': Securing AI Browsers Against Zero-Click Agent Hijacking
In March 2026, Zenity Labs disclosed 'PleaseFix,' a family of critical vulnerabilities affecting agentic browsers like Perplexity Comet. These flaws enable attackers to hijack AI agents through malicious instructions embedded in routine content, such as emails or calendar invites, without any user interaction. Exploiting these vulnerabilities, adversaries can access local files, steal credentials, and perform unauthorized actions within authenticated user sessions. The root cause lies in the agents' inability to distinguish between legitimate user commands and adversarially injected instructions, leading to significant security breaches. This incident underscores the urgent need for organizations to reassess the security models of AI-integrated systems. As AI agents become more prevalent in enterprise environments, the risk of similar zero-click exploits increases, highlighting the necessity for robust input validation, strict access controls, and continuous monitoring to prevent unauthorized agent behavior.
1 month ago
Kill Chain
Snowflake Data Breach: Lessons in Credential Security
In 2024, threat actor UNC5537 exploited stolen credentials to access Snowflake customer accounts lacking multi-factor authentication (MFA), compromising at least 165 organizations and exposing data of over 100 million individuals. The attackers utilized infostealer malware to harvest credentials, some dating back to 2020, leading to significant data breaches affecting companies like AT&T and Ticketmaster. This incident underscores the critical importance of implementing robust security measures, such as MFA and regular credential rotation, to protect against credential-based attacks. Organizations must remain vigilant as similar tactics continue to pose significant threats to data security.
1 month ago
Kill Chain
Urgent: Active Exploitation of TeamCity CVE-2026-63077 RCE Vulnerability
In July 2026, JetBrains identified a critical vulnerability (CVE-2026-63077) in TeamCity On-Premises, allowing unauthenticated remote code execution via the agent polling protocol. This flaw enables attackers to bypass authentication and execute arbitrary OS commands with the server's privileges, potentially exposing sensitive data and compromising CI/CD pipelines. JetBrains released patches in versions 2025.11.7 and 2026.1.3 to address this issue. ([blog.jetbrains.com](https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/?utm_source=openai)) By August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability in the wild, emphasizing the urgency for organizations to apply the available patches promptly to mitigate potential threats.
1 month ago
Kill Chain
Ransom Cartel Creator Sentenced to 16 Years in Prison
In August 2026, Maksim Silnikau, a 40-year-old Belarusian national, was sentenced to 16 years in prison for creating and operating the Ransom Cartel ransomware-as-a-service (RaaS) operation. Between 2021 and 2023, Ransom Cartel affiliates attacked at least 18 companies across the United States and abroad. Silnikau developed the ransomware software, acquired stolen credentials from initial access brokers, and managed a hidden panel where affiliates coordinated attacks, negotiated with victims, and divided proceeds. He also implemented a ratings system to reward productive affiliates and utilized cryptocurrency mixers to launder ransom payments. This sentencing underscores the ongoing threat posed by RaaS operations and highlights the importance of robust cybersecurity measures. The case also reflects the evolving landscape of cybercrime, where individuals can orchestrate widespread attacks without directly engaging in intrusions, emphasizing the need for comprehensive strategies to combat such threats.
1 month ago
Kill Chain
Critical Agent Infrastructure Flaws Patched by AWS, Google, and Vercel
In August 2026, security vulnerabilities were identified in agent infrastructures from Amazon Web Services (AWS), Google, and Vercel, allowing attackers to execute tools without model authorization. These flaws affected AWS's Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for Codex and OpenCode coding agents. The vulnerabilities enabled untrusted instructions to reach agent tools without verification, bypassing system prompts and model-level guardrails. AWS, Google, and Vercel have since released patches to address these issues. This incident underscores the critical need for robust input validation and authorization mechanisms in AI agent infrastructures. As AI tools become increasingly integrated into enterprise environments, ensuring their security is paramount to prevent unauthorized access and potential exploitation.
1 month ago
Kill Chain
Attackers Leverage SQL Injection to Deploy 'khunt' Toolkit in Oracle Database
In July 2026, attackers exploited a SQL injection vulnerability in a public-facing web application's autocomplete search field to gain unauthorized access to an organization's Oracle database. Utilizing the database's embedded Java Virtual Machine, they compiled and executed Java code within the database, achieving SYSTEM-level access on the underlying Windows server. This method allowed the deployment of a post-exploitation toolkit, 'khunt,' without writing executables to disk, effectively transforming the database into an attack platform. The incident underscores the critical need for robust input validation, parameterized queries, and strict privilege management to prevent such sophisticated attacks. The 'khunt' toolkit's deployment highlights a resurgence in advanced SQL injection techniques, emphasizing the importance of comprehensive security measures in database management systems. Organizations must remain vigilant against evolving threats that exploit inherent database functionalities for malicious purposes.
1 month ago
Kill Chain
Apple iCloud Private Relay Vulnerability Exposes Real IP Addresses
In August 2026, cybersecurity researchers Talal Haj Bakry and Tommy Mysk disclosed a vulnerability in Apple's iCloud Private Relay, a feature designed to enhance user privacy by routing Safari web traffic through dual relays. The flaw resides in WebKit's handling of DNS prefetching, WebAuthn Related Origin Requests, and WebTransport, which can bypass configured proxies and expose users' real IP addresses. This issue affects Safari and all third-party browsers on iOS, iPadOS, and macOS that rely on WebKit's proxy configuration APIs. As a result, users' actual IP addresses can be leaked, undermining the privacy protections offered by iCloud Private Relay. This vulnerability is particularly concerning given the widespread use of WebKit across Apple's ecosystem and its integration into various browsers. The exposure of real IP addresses can lead to targeted attacks, tracking, and a compromise of user anonymity. Organizations and individuals relying on iCloud Private Relay for privacy should be aware of this flaw and consider additional protective measures until a patch is released.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports