Tag: finance
-
What we know about the Revolut data breach so far
Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank confirmed the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/14/revolut-data-breach-privacy/
-
Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users
A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files. The campaign demonstrates…
-
Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users
A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files. The campaign demonstrates…
-
Toronto’s CISOs to Watch: Leaders Across Industry
Toronto anchors Canada’s financial, retail, and technology sectors, with a cybersecurity leadership community shaped by the demands of banking regulation, critical infrastructure protection, and large-scale digital transformation. The CISOs below bring experience spanning transit systems, national retail, enterprise software, professional… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/torontos-cisos-to-watch-leaders-across-industry/
-
Risks of hard-coded secrets in software
Risks of hard-coded secrets in software For many UK SMEs, software is now part of day-to-day business operations, whether it supports sales, customer service, finance, or operations. That makes the way software is built and maintained a business issue, not… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/risks-of-hard-coded-secrets-in-software/
-
CISOs to Watch in New York’s Fintech Industry
New York’s fintech sector spans digital banking platforms, trading infrastructure, financial technology providers, and payments companies operating at the intersection of financial services and rapid technological innovation. CISOs in this space must protect complex digital ecosystems while navigating stringent regulatory… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/cisos-to-watch-in-new-yorks-fintech-industry/
-
Tesco alerts police as supermarket becomes latest victim of scam ‘endorsement’ ads
Exclusive: Supermarket joins line of firms and sports stars including Bellingham and Haaland to have their image hijacked via adsTesco has alerted City of London police after it became the latest in a string of companies and sports stars, including Barclays bank and Lewis Hamilton, to have its image hijacked in a “scam” by unlicensed…
-
‘Cheap iPhone deal’: warning over scam sites selling latest Apple mobiles
Criminals exploit demand for iPhone 18 Pro and foldable Duo to trick people eager to get their hands on oneApple has just launched a range of new iPhones, including a foldable handset, just as you decide it is time to replace your own ageing mobile. But you balk at the £1,199 price tag for the…
-
Revolut confirms customer data breach through fake government requests
Revolut said it notified affected customers and alerted the relevant government agency, law enforcement, and financial regulators. First seen on techcrunch.com Jump to article: techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/
-
FTC rescinds policy statement requiring health apps to notify customers after a breach
The policy, passed under the Biden administration, forced health apps to disclose when users’ personal health records were exposed in a breach or shared without authorization. First seen on cyberscoop.com Jump to article: cyberscoop.com/ftc-rescinds-health-app-data-breach-policy/
-
FTC rescinds policy statement requiring health apps to notify customers after a breach
The policy, passed under the Biden administration, forced health apps to disclose when users’ personal health records were exposed in a breach or shared without authorization. First seen on cyberscoop.com Jump to article: cyberscoop.com/ftc-rescinds-health-app-data-breach-policy/
-
Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.
Threat actors are using AI-assisted phishing templates, executive impersonation, fake ServiceNow invoices, and fabricated email threads to pressure finance teams into authorizing fraudulent ACH payments worth nearly $50,000. Microsoft detected more than one million messages in the campaign, demonstrating how business email compromise (BEC) operations are becoming more polished, scalable, and difficult to spot. The…
-
Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.
Threat actors are using AI-assisted phishing templates, executive impersonation, fake ServiceNow invoices, and fabricated email threads to pressure finance teams into authorizing fraudulent ACH payments worth nearly $50,000. Microsoft detected more than one million messages in the campaign, demonstrating how business email compromise (BEC) operations are becoming more polished, scalable, and difficult to spot. The…
-
Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
Mantax OTAX is aggressive Android malware family combines ransomware, spyware, credential theft, and remote device-control features in a single infection chain. Linked to Indonesian threat actors, the campaign targets users through sideloaded APKs and turns compromised devices into tools for surveillance, financial fraud and real-time extortion. Unlike conventional Android ransomware that focuses primarily on locking…
-
How JPMorgan Chase Scaled Secure Software Delivery
Centralized Controls Help the Bank Secure Thousands of Daily Software Builds. JPMorgan Chase centralized its container pipeline to support thousands of daily builds while detecting vulnerabilities before deployment. As AI agents accelerate coding, standardized scans, security reviews and detailed specifications help keep speed from introducing unacceptable risk. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/how-jpmorgan-chase-scaled-secure-software-delivery-a-32795
-
Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
As the cyber scam industry expands globally, the U.S. government wants banks to share more information about what’s happening to their customers. First seen on therecord.media Jump to article: therecord.media/treasury-urges-banks-report-cyber-scams
-
FTC rescinds policy requiring health apps to notify customers after a breach
The policy, passed under the Biden administration, forced health apps to disclose when users’ personal health records were exposed in a breach or shared without authorization. First seen on cyberscoop.com Jump to article: cyberscoop.com/ftc-rescinds-health-app-data-breach-policy/
-
Boston Scientific Flags Financial Hit From Cyberattack
Nearly 2-Week Production and Shipping Pause Puts Sales Targets Out of Reach. Boston Scientific said an Aug. 25 cyberattack that halted production and shipping for nearly two weeks will materially hurt third-quarter and full-year 2026 results, putting its previous sales growth targets out of reach despite restored operations. First seen on govinfosecurity.com Jump to article:…
-
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026.Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider.”The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment First seen on thehackernews.com Jump to article: thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
-
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security have observed that North Korea’s Lazarus umbrella is split into six distinct clusters, focused on espionage, financial theft and sanctions evasion First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/north-korea-lazarus-six-cyber/
-
Why ‘Digital Asbestos’ Is Driving Up Risk Debt
Financial Services Risk Advisor Alex Golbin on Spotting Hidden Risk Debt. Alex Golbin, a senior financial services technology and data risk executive, said risk programs can look modern while resting on legacy workarounds underneath. He said accountability for that hidden risk debt, or digital asbestos, often falls on no one in the enterprise. First seen…
-
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft is alerting of a “high-volume phishing campaign” that’s using invisible Unicode tag characters to bypass email filters.”Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them,” the Microsoft Security…
-
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft is alerting of a “high-volume phishing campaign” that’s using invisible Unicode tag characters to bypass email filters.”Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them,” the Microsoft Security…
-
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft is alerting of a “high-volume phishing campaign” that’s using invisible Unicode tag characters to bypass email filters.”Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them,” the Microsoft Security…
-
Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of Emails
Threat actors have repurposed an AI prompt-injection technique known as ASCII smuggling to evade email security controls at massive scale, hiding invisible Unicode characters within financial phishing lures. Microsoft observed the activity reach more than 2.3 million messages per day, demonstrating how techniques first popularized in AI-security research can quickly migrate into conventional phishing operations.…
-
Chinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Systems
Chinese-speaking threat operators have been observed using Claude, Qwen and DeepSeek-powered AI agents as operational components in a second intrusion campaign targeting government, political, education and industrial organizations across Asia. The campaign is distinct from an earlier operation reported in July that used Claude Code and DeepSeek against government and financial-sector targets. In this newer…
-
Aesto Health Breach Exposes Data of More Than 9.5 Million People
Aesto Health says a December 2025 cyberattack affected more than 9.5 million people, potentially exposing medical, financial and identity data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-aesto-health-data-breach-9-5-million/
-
Why Stopping Upstream Scams Before Money Moves Is a Cybersecurity Problem
Financial institutions are realizing how upstream impersonation scams lead directly to downstream fraud. And potential lawsuits. New York Attorney General Letitia James sued Citibank and the company behind Zelle for failing to protect and reimburse consumers from impersonation-driven fraud last year. 86-year-old Nina Mortellito sued Bank of America and Merrill Lynch after losing $700,000 to..…
-
Large Enterprises Targeted in Fake Merger & Acquisition Scams
Threat actors behind the Phantom Deal campaign are studying companies in extreme detail, aiming to dupe midlevel employees into initiating large financial transfers. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/large-enterprises-fake-merger-acquisition-scams