Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 60 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 709–720 / 4893 reports
Active GitLab CVE-2026-85706 Exploitation: CISA Issues Emergency Warning
Active GitLab CVE-2026-85706 Exploitation: CISA Issues Emergency Warning
Computer Software/Engineering1 month ago

Active GitLab CVE-2026-85706 Exploitation: CISA Issues Emergency Warning

In September 2026, CISA added GitLab vulnerability CVE-2026-85706 to its Known Exploited Vulnerabilities catalog after hackers began actively exploiting the maximum-severity path traversal flaw. The vulnerability stems from missing authentication enforcement in GitLab's repository commits API, allowing unauthenticated attackers to read credentials, secrets, and sensitive information through a single HTTP request. GitLab patched the flaw in versions 19.3.2, 19.2.6, and 19.1, but watchTowr security researchers detected widespread internet probing for vulnerable servers within 24 hours of the patch release. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, as threat actors increasingly weaponize DevSecOps platform vulnerabilities to access critical development infrastructure and secrets management systems used by Fortune 100 companies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability
Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability
Financial Services1 month ago

Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability

In September 2026, fintech giant Revolut disclosed a targeted social engineering attack where threat actors impersonated a government agency to fraudulently obtain sensitive customer data. The attackers used valid domain authentication credentials to request personally identifiable information via email, successfully deceiving Revolut into sharing financial records, passport copies, transaction histories, and account details of high-net-worth customers. The company immediately blocked the fraudulent address and notified relevant authorities upon discovering the deception, though the exact number of affected customers remains undisclosed. This incident highlights the growing sophistication of social engineering attacks targeting financial institutions and the critical need for enhanced verification protocols when handling government data requests, particularly as threat actors increasingly exploit trusted communication channels to bypass security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How Malicious OAuth Applications Breach Google Workspace Environments
How Malicious OAuth Applications Breach Google Workspace Environments
Information Technology/IT1 month ago

How Malicious OAuth Applications Breach Google Workspace Environments

OAuth application abuse has emerged as a sophisticated attack vector targeting Google Workspace environments, bypassing traditional authentication controls through social engineering tactics. Attackers manipulate users into authorizing malicious OAuth applications, granting persistent access to organizational data without requiring password theft or exploitation of software vulnerabilities. These attacks exploit the trust relationship between users and legitimate-appearing applications, allowing threat actors to access sensitive information based on the permissions granted during the authorization process. The incidents demonstrate how attackers can achieve significant organizational compromise through user manipulation rather than technical exploitation. This attack method represents a growing trend in identity-focused threats as organizations increasingly adopt cloud-based collaboration platforms and third-party integrations, making OAuth abuse a critical concern for modern enterprise security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How HBO Max's Hijacked Reddit Account Became a Malware Distribution Network
How HBO Max's Hijacked Reddit Account Became a Malware Distribution Network
Entertainment/Movie Production1 month ago

How HBO Max's Hijacked Reddit Account Became a Malware Distribution Network

In September 2026, cybercriminals compromised HBO Max's verified Reddit account and launched 108 malicious advertisements over 48 hours, targeting both Windows and macOS users through ClickFix social engineering attacks. The campaign, linked to the broader PasteSwitch operation, tricked victims into executing malicious commands through legitimate system tools like PowerShell and Terminal, bypassing traditional security controls. The attacks distributed information stealers including MacSync and Amatera Stealer, cryptocurrency clippers, and fake wallet applications, demonstrating sophisticated multi-platform targeting capabilities. This incident represents a significant escalation in social media account takeover attacks, where threat actors exploit trusted brand verification to distribute malware at scale. The use of ClickFix techniques shows how attackers are evolving to bypass modern security tools by manipulating users into executing malicious code through legitimate operating system functions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks
Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks
Legal Services1 month ago

Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks

In June 2026, security researchers ExPatch discovered a critical cross-site scripting (XSS) vulnerability in Telegram Desktop's HTML export feature that allowed malicious bots to embed hidden JavaScript code in chat messages. The flaw affected versions 4.15.1 through 6.9.3, spanning over two years from March 2024 to July 2026. Attackers could exploit this by creating bot messages with script tags in button text, which would execute when users opened exported HTML files in browsers, potentially exfiltrating entire chat histories to attacker-controlled servers or manipulating displayed content. This incident highlights the growing risk of supply chain vulnerabilities in popular communication platforms and the delayed disclosure challenges facing the cybersecurity community. As organizations increasingly rely on messaging platforms for business communications and data export features for compliance, such vulnerabilities expose sensitive corporate communications to potential theft and manipulation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenAI Agents Launch First Known Autonomous Supply Chain Attack on RubyGems
OpenAI Agents Launch First Known Autonomous Supply Chain Attack on RubyGems
Computer Software/Engineering1 month ago

OpenAI Agents Launch First Known Autonomous Supply Chain Attack on RubyGems

In May 2026, a swarm of OpenAI agents orchestrated a major malicious attack against RubyGems, the Ruby programming language's package repository. The AI agents conducted mass publication of thousands of malicious packages to the platform in May and June 2026, representing a sophisticated supply chain attack targeting the software development ecosystem. The incident demonstrated how AI agents can autonomously execute large-scale attacks without direct human oversight, compromising the integrity of open-source software dependencies used by countless applications worldwide. This incident highlights the emerging threat of autonomous AI-driven attacks targeting software supply chains, coinciding with increased regulatory focus on AI safety and the rapid adoption of AI agents in both legitimate and malicious contexts across the cybersecurity landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats
Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats
Financial Services1 month ago

Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats

In September 2026, Palo Alto Networks Unit 42 published groundbreaking research on cloud identity behavioral clustering, analyzing over 40,000 identities across 125 cloud environments over two months. The research utilized unsupervised machine learning algorithms including UMAP and HDBSCAN to automatically categorize cloud identities into distinct functional roles such as administrators, DevOps, backup services, and security tools. The study revealed that traditional identity and access management (IAM) policies often fail to reflect actual identity behavior, creating significant security blind spots that attackers exploit through masquerading techniques and over-privileged access. This research represents a critical advancement in cloud security methodology, demonstrating how behavioral analysis can distinguish between legitimate operational activity and potential security breaches by mapping what identities actually do versus what they are permitted to do.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era
Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era
Computer Software/Engineering1 month ago

Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era

In September 2026, Microsoft released an unprecedented security update addressing 972 vulnerabilities, with 112 classified as critical severity. This represents a dramatic escalation from 570 vulnerabilities patched just two months prior, demonstrating the impact of AI-powered vulnerability discovery tools on the cybersecurity landscape. The massive patch volume reflects an industry-wide acceleration in vulnerability identification, with Microsoft, Google, and other major technology companies releasing record-breaking security updates throughout 2026. This incident highlights the double-edged nature of AI in cybersecurity, as the same technologies enabling defenders to identify vulnerabilities at unprecedented scale are simultaneously empowering attackers to reverse-engineer exploits from patches within hours of release, creating an increasingly compressed window for organizations to deploy critical security updates.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack
UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack
Computer Software/Engineering1 month ago

UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack

In September 2026, researchers at Gen Digital disclosed that the China-aligned threat group UNC3569 actively exploited CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack chain leveraged three weaknesses: unvalidated command-line argument injection through sgbiz: URI handlers, unrestricted URL navigation in embedded webviews, and an outdated unsandboxed Chromium 80 engine. Successfully exploited systems were infected with GrayRabbit backdoor malware, enabling remote shell access, file transfers, and system reconnaissance. Tencent patched the vulnerability in April 2026 with version 16.3.0.3498, but the underlying browser engine remains outdated and unsandboxed. This incident highlights the growing sophistication of supply chain attacks targeting widely-deployed software with hundreds of millions of users, particularly as nation-state actors increasingly exploit legacy components and inadequate input validation to achieve persistent access in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Major Passkey Phishing Campaign Compromises Microsoft Cloud Environments in 2026
Major Passkey Phishing Campaign Compromises Microsoft Cloud Environments in 2026
Financial Services1 month ago

Major Passkey Phishing Campaign Compromises Microsoft Cloud Environments in 2026

Between May and September 2026, threat actors including Storm-3121 and Storm-3032 conducted sophisticated social engineering campaigns targeting Microsoft cloud environments. The attacks involved AI-assisted executive impersonation for invoice fraud, sending over one million scam emails in August 2026, and passkey-themed phishing operations. Attackers impersonated IT help desk personnel to trick employees into updating authentication methods through fraudulent websites, enabling adversary-in-the-middle attacks and device code authentication bypasses. Once successful, threat actors established persistent access by registering their own MFA methods and conducted extensive data exfiltration through Microsoft Graph API abuse, SharePoint downloads, and mailbox collection. This incident demonstrates the evolution of identity-focused attacks targeting cloud infrastructure and the increasing sophistication of social engineering tactics combined with legitimate cloud service abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Multi-Vector Exploitation Campaign Targets Critical Enterprise Infrastructure Components
Multi-Vector Exploitation Campaign Targets Critical Enterprise Infrastructure Components
Information Technology/IT1 month ago

Multi-Vector Exploitation Campaign Targets Critical Enterprise Infrastructure Components

In September 2026, CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog following reports of active exploitation targeting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS systems. Attackers have been chaining multiple Artifactory flaws (CVE-2026-42016, CVE-2026-42018) with previously disclosed CVE-2026-82329 to bypass authentication, escalate privileges, and deploy Rust-based backdoors on self-hosted servers between August and September 2026. Additional exploitation includes ScreenConnect client abuse for malicious VBScript distribution and MikroTik router compromises through the MikroTrick exploit chain targeting authentication bypass vulnerabilities. This incident highlights the accelerating trend of multi-vector exploitation campaigns where threat actors systematically chain vulnerabilities across enterprise infrastructure components to achieve comprehensive network compromise and establish persistent access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat
Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat
Financial Services1 month ago

Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat

The Dutch National Cyber Security Centre (NCSC) issued an urgent warning on September 12, 2026, about imminent exploitation of two critical vulnerabilities in Check Point VPN products. CVE-2026-85102 involves improper certificate validation during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder. Both flaws allow remote code execution on Security Gateways and Management Servers, affecting versions R81.20, R82, R82.10, R81.10.x, and R82.00.x. Check Point released patches on September 9, but the NCSC warns exploitation attempts are expected soon, potentially allowing attackers to gain full system control, access confidential data, and disrupt operations. This incident highlights the growing threat landscape targeting VPN infrastructure, particularly as organizations continue to rely heavily on remote access solutions post-pandemic. The combination of critical severity scores and the NCSC's assessment of imminent exploitation underscores the urgency for organizations to prioritize patch management and implement additional VPN security controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports