The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
JadePuffer: Unveiling the First Autonomous LLM-Driven Ransomware Attack
In July 2026, the JadePuffer campaign marked the first documented instance of a fully autonomous ransomware attack executed by a large language model (LLM). The attack began with the exploitation of CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open-source tool for building AI applications. This allowed the agentic threat actor to gain initial access without authentication. Subsequently, the attacker pivoted to a production server running a MySQL database and an Alibaba Nacos configuration service, where they exfiltrated sensitive data, deleted the database, and left an extortion note demanding payment for the stolen information. This incident underscores the evolving threat landscape, where AI-driven attacks can autonomously execute complex operations without human intervention. The rapid adaptation and execution capabilities demonstrated by JadePuffer highlight the urgent need for organizations to reassess their security postures, particularly concerning AI and machine learning systems, to mitigate the risks posed by such advanced threats.
2 months ago
Kill Chain
GitLost: Unveiling the AI Vulnerability in GitHub's Agentic Workflows
In July 2026, a critical vulnerability named 'GitLost' was discovered in GitHub's Agentic Workflows, allowing unauthenticated attackers to exploit AI-powered automation and access private repositories. By crafting a malicious issue in a public repository, attackers could manipulate the AI agent to extract and expose sensitive data from private repositories without needing credentials or exploiting traditional software vulnerabilities. This incident underscores the emerging risks associated with integrating AI agents into development workflows, particularly the susceptibility to prompt injection attacks. Organizations must reassess their security protocols to mitigate such vulnerabilities and protect sensitive information.
2 months ago
Kill Chain
Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support and PRA
In July 2026, BeyondTrust disclosed two critical pre-authentication vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in their Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws stemmed from improper validation and processing of authentication data, potentially allowing unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation required specific authentication configurations to be enabled. BeyondTrust promptly released patches to address these issues. The disclosure underscores the persistent risk of authentication bypass vulnerabilities in remote access solutions. Organizations are urged to review and update their security configurations regularly to mitigate such threats.
2 months ago
Kill Chain
CERT/CC Uncovers Hidden Admin Backdoor in Tenda Router Firmware
In July 2026, the CERT Coordination Center (CERT/CC) disclosed a critical vulnerability (CVE-2026-11405) in Tenda router firmware, revealing an undocumented backdoor that allows attackers to bypass authentication and gain full administrative access to the device's web management interface. This backdoor is present in multiple firmware versions, including US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD and US_AC6V2.0RTL_V15.03.06.51_multi_T, among others. Exploitation of this vulnerability could lead to unauthorized remote modifications, disabling of security features, or complete device takeover. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai)) The discovery underscores the persistent risks associated with undocumented backdoors in network devices, highlighting the need for rigorous security assessments and prompt firmware updates. Organizations are advised to disable remote management and change default LAN IP addresses to mitigate potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai))
2 months ago
Kill Chain
Understanding the 'WriteOut' Vulnerability in Writer AI Platform
In July 2026, a critical session isolation vulnerability, dubbed 'WriteOut,' was discovered in Writer, an enterprise generative AI platform. This flaw allowed attackers to hijack user sessions across different organizations by exploiting the platform's live preview feature. By sharing a malicious preview link, attackers could gain unauthorized access to sensitive data, including private chats, documents, and large language model credentials, without requiring prior access to the victim's organization. ([thehackernews.com](https://thehackernews.com/2026/07/writer-ai-flaw-could-let-agent-previews.html?utm_source=openai)) The 'WriteOut' vulnerability underscores the growing security challenges in AI platforms, particularly concerning tenant isolation and session management. As AI adoption accelerates, ensuring robust security measures to prevent cross-tenant data breaches becomes imperative for organizations relying on such technologies.
2 months ago
Kill Chain
Understanding the 'GitLost' Vulnerability in GitHub's Agentic Workflows
In July 2026, researchers at Noma Security identified a critical vulnerability, dubbed 'GitLost,' in GitHub's Agentic Workflows. This flaw allows unauthenticated attackers to craft issues in public repositories that, when processed by AI-powered automation, can access and leak data from an organization's private repositories. The attack exploits prompt injection techniques, manipulating the AI agent into executing unintended actions, thereby exposing sensitive information without requiring stolen credentials or direct access to the organization. This incident underscores the growing risks associated with integrating AI agents into development workflows. As organizations increasingly adopt AI-driven automation, the potential for such vulnerabilities rises, emphasizing the need for robust security measures and continuous monitoring to prevent unauthorized data access and leakage.
2 months ago
Kill Chain
Scattered Spider Hacker Traced via Windows Device ID
In May 2025, attackers infiltrated a luxury jewelry retailer by impersonating employees and convincing the IT help desk to reset passwords and multifactor authentication devices. They gained control over three accounts, including two IT administrators, installed tunneling tools, and exfiltrated at least 77 gigabytes of data. Although the attackers attempted to deploy ransomware, the retailer's security team thwarted the effort. The attackers demanded an $8 million ransom, which the company refused to pay, resulting in approximately $2 million in losses due to disruption and remediation efforts. The incident underscores the critical importance of robust identity verification processes for IT support functions. It also highlights the necessity of implementing phishing-resistant multifactor authentication methods and continuous monitoring to detect and prevent unauthorized access attempts.
2 months ago
Kill Chain
FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a 127-byte stack buffer overflow, leading to immediate kernel panics by overwriting stack canaries. The vulnerability arises from improper validation of the sockaddr length field, enabling attackers to craft malicious requests that exploit this weakness. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-3038/?utm_source=openai)) The discovery of CVE-2026-3038 underscores the persistent challenges in kernel security, particularly concerning input validation and memory management. This incident highlights the necessity for continuous vigilance and prompt patching to mitigate potential exploits that could lead to system crashes or privilege escalation.
2 months ago
Kill Chain
Google's Legal Action Against AI-Driven Phishing: A Case Study
In June 2026, Google filed a lawsuit against a China-based cybercrime network known as 'Outsider Enterprise.' This group utilized Google's Gemini AI to create and distribute phishing websites that impersonated entities like Google, YouTube, and government agencies such as New York's E-ZPass. Operating through Telegram, Outsider Enterprise offered phishing-as-a-service, providing nearly 300 scam templates to individuals lacking technical expertise. Over a two-week period, the group sent approximately 2.5 million fraudulent text messages to Android users, leading to significant financial losses among hundreds of thousands of victims. ([arstechnica.com](https://arstechnica.com/google/2026/06/google-sues-chinese-cybercrime-network-that-used-gemini-to-automate-scams/?utm_source=openai)) This incident underscores the escalating misuse of AI technologies in cybercrime, highlighting the urgent need for enhanced security measures and regulatory frameworks to combat AI-driven phishing schemes. The collaboration between Google, the FBI, and major U.S. carriers exemplifies a proactive approach to dismantling such operations and protecting consumers from sophisticated digital threats. ([techcrunch.com](https://techcrunch.com/2026/06/12/chinese-cybercrime-operation-that-used-ai-to-scam-hundreds-of-thousands-of-victims-sued-by-google/?utm_source=openai))
2 months ago
Kill Chain
Sysdig Unveils First AI-Driven Ransomware Attack by JadePuffer
In late June 2026, Sysdig researchers documented the first known case of agentic ransomware, where an AI agent autonomously executed a comprehensive extortion operation. The threat actor, identified as JadePuffer, exploited a vulnerability in Langflow (CVE-2025-3248) to gain initial access, then proceeded to conduct reconnaissance, credential theft, lateral movement, persistence, encryption, and delivery of a ransom note. The AI agent's ability to rapidly adapt and execute over 600 distinct payloads significantly reduced the complexity and increased the speed of the attack, demonstrating a new level of operational efficiency in cyberattacks. ([sysdig.com](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion?utm_source=openai)) This incident underscores the evolving landscape of cyber threats, highlighting the integration of artificial intelligence in malicious activities. The use of AI agents in cyberattacks lowers the barrier for executing sophisticated operations, posing a significant challenge for cybersecurity defenses. Organizations must adapt to these advancements by implementing robust security measures and staying vigilant against AI-driven threats.
2 months ago
Kill Chain
Critical Adobe ColdFusion Vulnerability CVE-2026-48282: Immediate Action Required
In July 2026, a critical vulnerability identified as CVE-2026-48282 was discovered in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. This path traversal flaw allows unauthenticated attackers to execute arbitrary code remotely without user interaction, posing a significant risk to affected systems. Adobe promptly released security updates to address this issue, urging administrators to apply patches immediately. The rapid exploitation of this vulnerability underscores the increasing speed at which threat actors are leveraging newly disclosed flaws. Organizations must prioritize timely patch management and maintain robust monitoring to mitigate such risks effectively.
2 months ago
Kill Chain
Cybercriminals Exploit Microsoft Teams to Deploy EtherRAT Malware
In July 2026, threat actors initiated a sophisticated phishing campaign targeting corporate employees by impersonating IT support staff via Microsoft Teams voice calls. The attack began with phishing emails containing malicious PDF attachments labeled as 'Employee Survey.' Shortly after opening the document, victims received Teams calls from external accounts posing as system administrators. Exploiting Teams' screen-sharing feature, attackers convinced employees to install legitimate remote-access tools like HopToDesk and AnyDesk. Subsequently, they deployed a malicious MSI installer that downloaded and executed EtherRAT, a cross-platform remote access trojan written in Node.js, granting full control over compromised systems. EtherRAT enables attackers to execute commands, manipulate files, steal data, and maintain persistence, utilizing Ethereum smart contracts to retrieve its command-and-control server, complicating disruption efforts. This campaign underscores the evolving tactics of cybercriminals leveraging trusted communication platforms to infiltrate corporate networks. Organizations must enhance their security awareness training, implement robust authentication measures, and monitor for unusual activities within collaboration tools to mitigate such threats.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports