Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 90 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1069–1080 / 4893 reports
Apple's August 2026 Security Updates: Addressing Critical Vulnerabilities
Computer Software/Engineering2 months ago

Apple's August 2026 Security Updates: Addressing Critical Vulnerabilities

In August 2026, Apple released critical security updates for iOS, iPadOS, and macOS, addressing 108 vulnerabilities, including six that affected all three operating systems. Notably, these six vulnerabilities were related to WebKit, the browser engine used by Safari. While none of these vulnerabilities had been exploited at the time of the update, their potential impact on user data and system integrity was significant. This update underscores the importance of timely software updates to mitigate potential security risks. Organizations and individuals are advised to apply these patches promptly to protect against potential exploits targeting these vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
BlackFile's 2026 Vishing Attacks on Financial Institutions
Financial Services2 months ago

BlackFile's 2026 Vishing Attacks on Financial Institutions

In early 2026, the cybercrime group BlackFile, also known as UNC6671 and linked to 'The Com,' initiated a series of sophisticated voice-phishing (vishing) attacks targeting major financial institutions, including private equity firms, law firms, and financial rating agencies. By impersonating IT support personnel, they deceived employees into divulging credentials, enabling unauthorized access to sensitive data. The group then exfiltrated this data and issued extortion demands, often starting around $3 million, with payments typically negotiated down to less than $1 million. Notably, BlackFile has expanded its operations under multiple brands—Redact, Pink, Helix, and Falcon—using shared infrastructure to target an average of 1.5 new victims daily. This incident underscores the persistent and evolving threat posed by cybercriminal groups employing social engineering tactics. The financial sector's susceptibility to such attacks highlights the critical need for enhanced employee training, robust authentication mechanisms, and vigilant monitoring to mitigate the risks associated with vishing and data extortion schemes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
SafePal Data Breach: Lessons in Securing Third-Party Integrations
Financial Services2 months ago

SafePal Data Breach: Lessons in Securing Third-Party Integrations

In August 2026, SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers. The breach, which occurred between March 2, 2025, and April 11, 2026, exposed customers' names, email addresses, shipping addresses, phone numbers, and purchase information. The company identified an authorization flaw in a third-party order-tracking plugin as the attack vector, allowing unauthorized access to customer order details. While no wallet seed phrases, private keys, or payment information were compromised, the exposed data increases the risk of targeted phishing and social engineering attacks against affected individuals. This incident underscores the critical importance of securing third-party integrations within e-commerce systems, especially for companies handling sensitive customer information. The breach highlights the evolving tactics of cybercriminals targeting the cryptocurrency sector, emphasizing the need for continuous security assessments and robust incident response strategies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 'ShieldBreak' Zero-Day in Microsoft Defender Exposes Windows Systems
Financial Services2 months ago

Critical 'ShieldBreak' Zero-Day in Microsoft Defender Exposes Windows Systems

In August 2026, security researcher Nightmare Eclipse disclosed a zero-day vulnerability named 'ShieldBreak' in Microsoft Defender, allowing local attackers to escalate privileges to SYSTEM level on fully patched Windows 10, Windows 11, and Windows Server systems. This exploit bypasses the previous 'RoguePlanet' vulnerability (CVE-2026-50656) patch, indicating that the initial fix was insufficient. Microsoft has acknowledged the issue, assigning it CVE-2026-69414, and is actively working on a security update to address the flaw. The rapid succession of critical vulnerabilities in Microsoft Defender underscores the persistent challenges in securing endpoint protection solutions. Organizations must remain vigilant, ensuring timely application of patches and considering additional layers of security to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
French Tax Authority Data Breach 2026: ZeroBytes Compromises 678,000 Records
Government Administration2 months ago

French Tax Authority Data Breach 2026: ZeroBytes Compromises 678,000 Records

In August 2026, the French Ministry of the Economy and Finance disclosed a significant data breach involving the General Directorate of Public Finances (DGFiP). A threat actor known as "ZeroBytes" accessed DGFiP systems, extracting sensitive data of approximately 678,000 individuals and professionals. The compromised information included tax data such as reference tax income, family quotient, withholding tax rates, company names, and SIREN numbers. Additionally, cadastral data related to property addresses and sizes were accessed. The breach was discovered when ZeroBytes listed the stolen database for sale on a hacking forum on August 12, 2026. Upon detection, the French tax administration promptly shut down access to sensitive systems and initiated an investigation with the National Cybersecurity Agency of France (ANSSI) to assess the full impact of the breach. Affected individuals were notified, and measures were taken to prevent further unauthorized access. This incident underscores the escalating trend of cyberattacks targeting governmental institutions, highlighting the critical need for robust cybersecurity measures and vigilant monitoring to protect sensitive citizen data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability
Financial Services2 months ago

Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability

In July 2026, a critical vulnerability known as Certighost (CVE-2026-54121) was identified in Microsoft's Active Directory Certificate Services (AD CS). This flaw allowed authenticated, low-privileged domain users to exploit the certificate enrollment process, obtaining certificates that impersonate Domain Controllers. By leveraging this vulnerability, attackers could escalate their privileges, potentially leading to full domain compromise. Microsoft addressed this issue with a security update released on July 14, 2026. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/detecting-cve-2026-54121-certighost-with-microsoft-defender/4542861?utm_source=openai)) The release of a public proof-of-concept (PoC) exploit on July 24, 2026, heightened the urgency for organizations to apply the patch promptly. This incident underscores the critical importance of securing certificate authorities and regularly auditing Active Directory configurations to prevent privilege escalation attacks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security
Computer Software/Engineering2 months ago

Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security

In June 2026, a security vulnerability was identified in Snowflake's public GitHub repository, specifically within the 'snowflake-connector-net' project. The flaw resided in the 'jira_issue.yml' GitHub Actions workflow, which processed issue titles and bodies without proper sanitization. This oversight allowed attackers to craft malicious GitHub issues that, when processed by the workflow, executed unauthorized commands. These commands had access to internal Jira credentials, potentially exposing sensitive project information. Snowflake promptly addressed the issue by updating the workflow to handle inputs securely and rotated the compromised Jira tokens. No evidence of unauthorized access was found during their investigation. This incident underscores the critical importance of input validation and secure coding practices in CI/CD pipelines. As organizations increasingly rely on automated workflows, ensuring that these processes are safeguarded against injection attacks is paramount to maintaining the integrity and security of development environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)
Computer Software/Engineering2 months ago

GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)

In August 2026, GitLab identified and patched a critical vulnerability (CVE-2026-19478) in its Community and Enterprise Editions. This flaw allowed unauthenticated attackers to remotely modify or delete public projects and user data via a GraphQL directive. The vulnerability affected versions from 18.2 up to 18.11.10, 19.0 up to 19.0.7, 19.1 up to 19.1.5, and 19.2 up to 19.2.3. GitLab released patches in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4 to address this issue. This incident underscores the critical importance of timely vulnerability management and patching in software development environments. The exploitation of such vulnerabilities can lead to significant data loss and operational disruptions, emphasizing the need for robust security practices and continuous monitoring.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices
Telecommunications2 months ago

Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices

In August 2026, security researchers identified a new Linux-based botnet named Evooo1Bot, which extends the capabilities of the infamous Mirai malware beyond traditional Distributed Denial of Service (DDoS) attacks. Evooo1Bot exploits vulnerabilities in various Internet-facing devices, including those from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, some dating back to 2007. Once compromised, these devices are utilized for credential theft, establishing encrypted command-and-control communications, and setting up reverse SOCKS proxies, effectively transforming them into persistent attacker infrastructure. ([arstechnica.com](https://arstechnica.com/security/2026/03/14000-routers-are-infected-by-malware-thats-highly-resistant-to-takedowns/?utm_source=openai)) The emergence of Evooo1Bot underscores the evolving threat landscape where botnets are increasingly used for multifaceted cyberattacks beyond DDoS. This development highlights the critical need for organizations to secure Internet of Things (IoT) devices, promptly apply security patches, and implement robust network monitoring to detect and mitigate such sophisticated threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
WindRelay Malware: A New Threat to Contactless Payments
Banking/Mortgage2 months ago

WindRelay Malware: A New Threat to Contactless Payments

In August 2026, cybersecurity researchers identified 'WindRelay,' a novel Android malware that exploits Near Field Communication (NFC) technology to facilitate contactless payment fraud. The attack begins with social engineering tactics, where victims are deceived into installing a Remote Access Trojan (RAT) named SpyNote. This RAT enables attackers to remotely deploy the WindRelay malware onto the victim's device. Once installed, WindRelay transforms the compromised smartphone into an unauthorized NFC relay, capturing live card data when victims are manipulated into tapping their payment cards against their own infected devices. This data is then transmitted in real-time to fraudsters, who use it to perform unauthorized transactions at payment terminals. The campaign has primarily targeted individuals in Czechia, Slovakia, and Slovenia, with at least 23 samples of WindRelay identified between November 2025 and July 2026. This incident underscores a significant evolution in mobile payment fraud, combining advanced malware capabilities with sophisticated social engineering to exploit NFC technology. The emergence of WindRelay highlights the increasing sophistication of cybercriminals in leveraging mobile technologies for financial fraud. As NFC-based payment systems become more prevalent, the risk of similar attacks is likely to rise, emphasizing the need for enhanced security measures and user awareness to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AmnesiaStealer: A New Threat to macOS Security
Financial Services2 months ago

AmnesiaStealer: A New Threat to macOS Security

In August 2026, cybersecurity researchers identified AmnesiaStealer, a sophisticated Rust-based malware targeting macOS systems. Distributed via counterfeit GitHub pages, it employs a multi-stage attack to harvest sensitive data, including Keychain credentials, browser information, and files from applications like Apple Notes and Telegram. Notably, it hijacks Chromium-based browsers, granting attackers live control over user sessions. The malware's deployment involves deceptive prompts to capture system passwords, enabling deep system access and data exfiltration. This incident underscores a growing trend of advanced malware targeting macOS platforms, exploiting user trust through social engineering tactics. The emergence of such threats highlights the necessity for enhanced security measures and user awareness to mitigate risks associated with sophisticated information stealers.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability
Financial Services2 months ago

August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability

In August 2026, multiple cybersecurity incidents emerged, including the 'City-Forum' campaign targeting unauthenticated guest user access in Salesforce Experience Cloud and ServiceNow Service Portals, leading to significant data exfiltration. Additionally, ShipMonk, a shipping provider for Trezor, suffered a data breach exposing sensitive customer information. Furthermore, Cursor's CLI coding agent was found to execute untrusted repository code without user consent, posing a significant security risk. These incidents underscore the evolving threat landscape, highlighting the need for robust security measures and vigilance against sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports