The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
GuardFall: Exposing Shell Injection Vulnerabilities in AI Coding Agents
In June 2026, Adversa AI disclosed a vulnerability named 'GuardFall' affecting ten out of eleven popular open-source AI coding agents. This flaw allows attackers to bypass safety checks using decades-old shell injection techniques, enabling the execution of malicious commands that can delete files or exfiltrate sensitive data such as SSH keys and cloud credentials. The vulnerability arises because these agents rely on blocklists that fail to account for how the Bash shell processes commands, leading to discrepancies between filtered and executed commands. ([thehackernews.com](https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html?utm_source=openai)) This incident underscores the persistent risks associated with AI coding agents, especially as they become more integrated into development workflows. The exploitation of longstanding shell injection methods highlights the need for robust security measures and continuous vigilance in the deployment of AI tools to prevent potential supply chain attacks.
2 months ago
Kill Chain
Silent Swap Crypto Clipper: A New Threat to Cryptocurrency Security
In June 2026, cybersecurity researchers identified a malicious campaign named 'Silent Swap,' which targets cryptocurrency users through a fake 'Google Notes' browser extension. Delivered via unsigned .NET and Golang installers, this extension infiltrates Chromium-based browsers by modifying their settings to install itself without user consent. Once active, it monitors the system clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, leading to unauthorized fund transfers. The campaign employs advanced techniques like 'EtherHiding,' utilizing blockchain technology to dynamically update command-and-control servers, enhancing its resilience and evasion capabilities. This incident underscores a growing trend of sophisticated attacks leveraging trusted platforms and applications to distribute malware. The use of blockchain for command-and-control infrastructure highlights the evolving tactics of threat actors, making detection and mitigation more challenging. Organizations and individuals must remain vigilant, ensuring that browser extensions are sourced from reputable developers and regularly reviewing installed extensions for unauthorized additions.
2 months ago
Kill Chain
Apple's June 2026 Security Updates: Over 25 Vulnerabilities Patched
In June 2026, Apple released security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, addressing over 25 vulnerabilities. The majority of these issues were found in WebKit and related web technologies, potentially leading to crashes, memory corruption, or data disclosure. Additionally, vulnerabilities in the kernel and IOGPUFamily were patched. Notably, Apple expedited these updates in response to concerns about AI-assisted hacking tools, aiming to reduce the window between vulnerability disclosure and patch deployment. ([macrumors.com](https://www.macrumors.com/2026/06/29/apple-ios-26-5-2-early-release/?utm_source=openai)) This proactive approach underscores the growing threat posed by AI-enhanced cyberattacks, highlighting the necessity for organizations to adopt agile security practices and promptly apply software updates to mitigate emerging risks.
2 months ago
Kill Chain
Malicious Chromium Extension Exploits AI Branding for Search Hijacking
In June 2026, a malicious Chromium-based browser extension impersonating the AI-powered search engine Perplexity AI was discovered. This extension intercepted user search queries and real-time suggestions, routing them through attacker-controlled infrastructure before redirecting to legitimate search providers. The primary objective appeared to be data collection for potential misuse, such as profiling or targeted advertising. Microsoft Threat Intelligence reported the extension to Google, leading to its removal from the Chrome Web Store. This incident underscores the evolving tactics of threat actors leveraging AI-related branding to enhance the credibility of their malicious tools. The use of legitimate APIs and advanced permissions highlights the need for heightened vigilance and robust security measures to protect against sophisticated browser-based threats.
2 months ago
Kill Chain
GitHub Advisory Database Overwhelmed by Record Vulnerability Reports
In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories, marking a fivefold increase over its typical monthly output and the highest in its history. This surge reflects a structural change in the vulnerability disclosure ecosystem, with private vulnerability reports escalating from approximately 550 per week in January to over 3,000 per week by May. Repository advisories and CVE requests have similarly increased, leading to extended review times and a backlog in processing new advisories. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai)) The unprecedented volume of vulnerability reports underscores the need for enhanced coordination among researchers, maintainers, and security teams. It also highlights the importance of submitting complete and accurate vulnerability data to expedite the review process. As the ecosystem adapts to this new scale, stakeholders must collaborate to maintain the quality and timeliness of advisory publications. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai))
2 months ago
Kill Chain
Discovery of 'Short-Sleeve' RSA Keys Poses Significant Security Risk
In June 2026, researchers from Trail of Bits and the badkeys project identified a critical vulnerability in RSA keys characterized by patterns of zeros, termed "short-sleeve" RSA keys. These keys, found in public sources like Certificate Transparency logs and SSH hosts, were associated with major organizations such as Yahoo and Verizon, as well as devices running NetApp software and CompleteFTP software from EnterpriseDT. The vulnerability, stemming from improper key generation processes, allows attackers to factor the public modulus and derive private keys, compromising encrypted communications and data integrity. ([blog.trailofbits.com](https://blog.trailofbits.com/2026/06/12/factoring-short-sleeve-rsa-keys-with-polynomials/?utm_source=openai)) This discovery underscores the persistent risks associated with flawed cryptographic implementations. Organizations must prioritize regular audits of cryptographic keys and ensure adherence to secure key generation practices to mitigate potential breaches.
2 months ago
Kill Chain
Black Basta Ransomware Group: A Comprehensive Analysis of Its Rise and Fall
Black Basta, a ransomware-as-a-service (RaaS) group, emerged in April 2022 and rapidly became a significant threat by employing double extortion tactics—encrypting victims' data and exfiltrating sensitive information to pressure organizations into paying ransoms. The group targeted over 500 organizations worldwide across various critical infrastructure sectors, including healthcare, finance, and manufacturing. Their operations involved sophisticated social engineering techniques, exploitation of known vulnerabilities, and partnerships with malware distributors like QakBot to gain initial access. In 2025, internal conflicts and law enforcement actions led to a decline in Black Basta's activities, culminating in the group's shutdown. ([techrepublic.com](https://www.techrepublic.com/article/black-basta-ransomware-attack/?utm_source=openai)) The Black Basta case underscores the evolving nature of ransomware threats, highlighting the importance of robust cybersecurity measures and proactive threat intelligence to defend against sophisticated cybercriminal operations. The group's rapid rise and eventual downfall illustrate the dynamic landscape of cyber threats and the necessity for organizations to remain vigilant and adaptable.
2 months ago
Kill Chain
Urgent Alert: Oracle E-Business Suite Vulnerability Under Active Exploitation
In late June 2026, threat intelligence firm Defused reported active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments component. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers with HTTP access to execute remote code, potentially leading to full system compromise. Oracle had addressed this issue in their May 2026 Critical Security Patch Update, urging immediate patching. Despite this, numerous unpatched systems remain exposed, with over 450 Oracle EBS instances accessible online, nearly 200 of which are in the United States and Europe. The active exploitation of CVE-2026-46817 underscores the critical importance of timely patch management. Organizations using Oracle E-Business Suite must prioritize applying the latest security updates to mitigate this severe risk. Additionally, this incident highlights the broader trend of attackers targeting unpatched enterprise applications, emphasizing the need for robust vulnerability management practices.
2 months ago
Kill Chain
Nissan Employee Data Breach Exposes Sensitive Information via Oracle PeopleSoft Exploit
In June 2026, Nissan disclosed a data breach affecting current and former employees across the United States, Canada, Mexico, and Brazil. The breach occurred between May 27 and June 9, 2026, when threat actors exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, which Nissan uses to manage employee information. The attackers, identified as the ShinyHunters extortion group, accessed sensitive personal data, including contact details, banking information, Social Security numbers, and tax information. Nissan promptly activated its incident response plan, engaged external cybersecurity experts, secured affected systems, and is collaborating with Oracle to address the issue. The company is offering free credit and dark web monitoring services to affected individuals and has implemented additional security measures to prevent further unauthorized access. This incident underscores the critical importance of promptly addressing software vulnerabilities and implementing robust security measures to protect sensitive employee data. The exploitation of a zero-day vulnerability by a known threat actor highlights the evolving tactics of cybercriminals and the necessity for organizations to remain vigilant and proactive in their cybersecurity efforts.
2 months ago
Kill Chain
NAIC's 2026 Data Breach: A ShinyHunters Exploit of Oracle PeopleSoft
In June 2026, the National Association of Insurance Commissioners (NAIC) experienced a cyberattack by the ShinyHunters group, who exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft servers. The attackers claimed to have stolen 3.1 TB of data, including insurer regulatory filings and AWS infrastructure configurations. NAIC's investigation indicated that only publicly available data, outdated logs, and configuration files were accessed, with no evidence of personal or financial data exposure. The breach led to operational disruptions, such as temporary suspension of data feeds by credit rating agencies and a pause in NAIC's investment designation work. This incident underscores the critical importance of promptly addressing zero-day vulnerabilities and implementing robust security measures to protect sensitive data. Organizations must remain vigilant against sophisticated threat actors like ShinyHunters, who continue to exploit unpatched systems, emphasizing the need for proactive cybersecurity strategies and timely software updates.
2 months ago
Kill Chain
Malicious Perplexity Chrome Extension Compromises User Data
In June 2026, Microsoft identified a malicious Chrome extension named "Search for perplexity ai" that impersonated the AI search engine Perplexity. This extension intercepted users' search queries and address bar inputs, routing them through an attacker-controlled server before redirecting to legitimate search results. The extension set itself as the default search engine upon installation, capturing every character typed into the address bar and transmitting this data, along with browser headers, IP addresses, and user agents, to the attacker's server. Microsoft reported the extension to Google, leading to its removal from the Chrome Web Store. ([thehackernews.com](https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html?utm_source=openai)) This incident underscores a growing trend of malicious browser extensions exploiting the popularity of AI tools to harvest sensitive user data. Similar campaigns have targeted users by masquerading as AI assistants, leading to significant data breaches. Organizations must remain vigilant, implementing strict policies on browser extensions and educating users about the risks associated with unverified add-ons. ([techradar.com](https://www.techradar.com/pro/security/fake-chrome-ai-extensions-targeted-over-300-000-users-to-steal-emails-personal-data-and-more?utm_source=openai))
2 months ago
Kill Chain
AWS Threat Technique Catalog June 2026 Update: Enhancing Your AWS Security Posture
In June 2026, the AWS Customer Incident Response Team (AWS CIRT) updated the Threat Technique Catalog (TTC) to address emerging security challenges in container security, organizational trust, and compute hijacking. The update introduces five new entries: EKS workload modification, exploitation of public-facing applications in EKS, assuming root access into organization member accounts, compute hijacking in EKS, and inviting accounts to unknown organizations. These techniques reflect real-world incidents where threat actors exploit legitimate AWS functionalities to compromise environments, emphasizing the need for robust security measures and vigilant monitoring. This update underscores a trend where attackers leverage standard cloud operations to evade detection, highlighting the importance for organizations to enhance their security postures by implementing controls such as admission controllers, service control policies, and resource quotas, and by actively monitoring for anomalous activities within their AWS environments.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports