finance news
71 stories · page 1 of 2
U.S. Bank CISO says the security role keeps growing and no one can own all of it
The role of a Chief Information Security Officer (CISO) has expanded significantly to encompass areas such as fraud, resilience, third-party risk, and AI governance, according to Ann Barron-DiCamillo, EVP and CISO at U.S. Bank. She notes that while this consolidation can make security leaders more effective by addressing interconnected risks, no single individual can realistically own every…
Three questions a hospital CISO should ask a healthcare fintech vendor
A cybersecurity expert has outlined key questions hospital CISOs should pose to healthcare fintech vendors to assess their security posture, particularly concerning patient data and financial transactions. Drew McCombs, who holds both CTO and CISO roles at Cylerity, emphasizes that security should be an integral part of development processes, not an afterthought, especially when patient data…
SWIFT Banking & Government Middleware Enables RCE
A recent report indicates that critical vulnerabilities have been identified in SWIFT banking and government middleware, potentially enabling remote code execution (RCE). The findings highlight a significant risk, particularly in environments that rely on hardware-based multi-factor authentication (MFA), suggesting that these systems could be exploited if the underlying middleware remains…
Experience What It’s Like to Travel in the Occupied West Bank
A new interactive experience has been released that simulates travel within the occupied West Bank, allowing users to navigate virtual barriers and checkpoints. The simulation aims to provide insight into the daily realities faced by nearly 3.5 million Palestinians living in the region, with user choices influencing the progression of the experience.
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Reports indicate that government and finance organizations have been targeted in weeks-long attacks exploiting zero-day vulnerabilities in NetScaler products. The attacks leverage two specific vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, with multiple security firms confirming observed exploitation.
Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)
Suspected state-sponsored threat actors have been exploiting a zero-day vulnerability in NetScaler Application Delivery Controllers (ADCs) and Gateways, identified as CVE-2026-88772, since at least early September 2026. This flaw, along with a related vulnerability, CVE-2026-88771, allows for remote code execution on affected appliances. Citrix confirmed the active exploitation of both…
Anthropic wants Claude to analyze your bank account and financial data
Anthropic is reportedly developing a new personal finance feature for its Claude AI assistant, tentatively named "Claude Money." The feature, which appears to be in early testing, would allow users to directly link their bank accounts to Claude to gain insights into their spending, financial plans, and other account activities.
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle released its September 2026 Critical Security Patch Update (CSPU) on September 15, addressing 672 unique Common Vulnerabilities and Exposures (CVEs) through 673 security updates across 17 product families. This monthly release cycle, introduced in May 2026, aims to provide a faster cadence for high-severity issues compared to the quarterly Critical Patch Updates (CPUs).
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Cybersecurity researchers have reported on a new banking malware operation, dubbed KREMLIN, which targets users of Google Chrome and Microsoft Edge browsers to steal credentials and session tokens. The operation, tracked by Elastic Security Labs as REF9334, has been active since at least May 2025 and primarily targets Brazilian banking customers through sophisticated social engineering lures.
Suspected Black Axe gang leaders face cybercrime charges in the US
Five individuals, identified as alleged leaders of the Black Axe cybercrime syndicate, have been extradited to the United States to face charges of wire fraud and money laundering. The defendants, Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru, are accused of orchestrating an internet fraud campaign from Cape Town, South Africa, between 2011 and 2021.
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft has reported details concerning two distinct campaigns where threat actors leveraged third-party email delivery infrastructure to distribute financial fraud scam messages. These campaigns employed passkey-themed social engineering tactics to compromise cloud environments, ultimately leading to the hijacking of Microsoft cloud accounts and subsequent data exfiltration.
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic, the developer of the Claude AI model, has reported that multiple threat groups, including state-sponsored espionage actors linked to Russia and China, have attempted to misuse its AI for malicious purposes. Between December 2025 and August 2026, the company observed various forms of AI misuse, encompassing cyber and influence operations, surveillance, scams, and the development of…
Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
The U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) has issued an alert to financial institutions, urging increased vigilance in identifying and reporting cyber fraud schemes, particularly those originating from overseas scam centers. This directive follows a comprehensive study revealing that nearly $13 billion has been stolen from Americans in cryptocurrency…
Gigabud Uses Android App Cloning to Evade Fraud Detection
The Gigabud Android banking trojan has been updated with a new technique that utilizes Android's work profile feature to clone banking applications, allowing fraudsters to bypass traditional fraud detection mechanisms. This development, attributed to the GoldFactory threat group, was detailed in research published on September 9.
Large Enterprises Targeted in Fake Merger & Acquisition Scams
A new social engineering campaign, dubbed "Phantom Deal," is reportedly targeting large enterprises by impersonating merger and acquisition (M&A) activities. The threat actors behind this operation are said to be conducting extensive reconnaissance on their targets, with the ultimate goal of manipulating mid-level employees into authorizing significant financial transfers.
Anthropic’s Enterprise Frontier Safeguards lets your Claude logs stay in your cloud
Anthropic has introduced a new security framework called Enterprise Frontier Safeguards, designed to address data retention and privacy concerns for enterprise customers, particularly those in regulated industries. This framework allows organizations to maintain control over their Claude AI activity logs within their own cloud environments, using their own encryption keys and access policies.
Nigeria Looks to Sovereign Cloud for Cyber, National Security
Nigeria is reportedly advancing its sovereign cloud initiative, implementing new policies around financing, procurement, and infrastructure. This strategic move is aimed at bolstering the nation's cybersecurity posture and enhancing its overall national security, while simultaneously cultivating domestic technical expertise.
ZeroTokens Phishing Platform Steers Attacks in Real Time
A new phishing platform known as ZeroTokens allows attackers to monitor victim sessions in real time and dynamically alter the prompts displayed, enabling adaptive attacks aimed at harvesting credentials and financial data. The platform provides operators with live visibility into information entered by victims, allowing them to steer individual phishing interactions while simultaneously using…
Interpol targets Black Axe’s illicit financial web in latest international sting
An international law enforcement operation, dubbed Operation Jackal IV, has resulted in 58 arrests and the identification of 263 suspects globally, targeting the financial networks of West African organized crime groups, including Black Axe. The operation, announced by Interpol, aimed to disrupt money laundering activities, locate high-value targets, seize assets, and support prosecutions.
Fideo Lens reveals connections across identities, accounts and devices
Fideo Intelligence has introduced Fideo Lens, an investigative intelligence platform designed to help fraud and financial crime teams uncover hidden connections among identities, accounts, devices, and behaviors. The platform aims to transform fragmented identity data into interactive investigative intelligence within minutes, reducing the time analysts spend manually searching across multiple…
ToxicPanda Banking Trojan Matures into Enterprise Threat
The Android banking Trojan known as ToxicPanda has reportedly evolved, incorporating new features that significantly broaden its capabilities beyond financial application targeting. This maturation suggests a strategic shift by its operators, moving from primarily consumer-level financial fraud to potentially impacting enterprise environments and a wider array of user data. The expanded global…
Personal Information Exposed in Apollo Global Data Breach
Apollo Global Management, a prominent private equity firm, has reportedly experienced a data breach that exposed personal information. The incident appears to be part of a broader campaign targeting major financial institutions, suggesting a coordinated effort against the sector. Details regarding the specific nature of the exposed personal information or the number of individuals affected…
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
A significantly upgraded version of the ToxicPanda Android malware, dubbed ToxicPanda 2.0, has expanded its targeting to 349 financial applications across 16 countries, a substantial increase from the 16 applications it previously targeted. Researchers at Zimperium's zLabs team documented the new variant, noting its command set has grown to 167 remote instructions.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
Recent reports highlight the ongoing threat posed by several prominent banking Trojans, specifically identifying Manic, Grandoreiro, and ToxicPanda 2.0. These malware families are currently active, with Manic noted for its spyware capabilities, Grandoreiro for a persistent campaign across Latin America and Europe, and ToxicPanda 2.0 for an expanded operational scope. The collective activity of…
Apollo discloses data breach from ongoing wave of attacks hitting financial sector
Apollo Global Management, a major private equity firm, has confirmed it experienced a data breach in July, impacting some of its cloud platforms. The company disclosed that sensitive personal data, including names, dates of birth, contact information, home addresses, and Social Security numbers, was compromised during the incident.
U.S. Bank says breach claims related to fourth-party incident
U.S. Bancorp, the seventh-largest bank in the United States, has stated that recent claims of data theft by the LockBit ransomware group are linked to a cyber incident involving a fourth-party vendor, rather than a direct compromise of the bank's own systems or network. The bank confirmed it has investigated the claims and found no evidence that its internal systems, networks, or data…
Medical records, SSNs, and bank details exposed in CareCloud data breach
CareCloud, a healthcare technology provider, has confirmed a data breach that exposed the personal and medical information of over 3.75 million individuals. The incident, which occurred in March, involved an unauthorized third party accessing one of the company's Amazon Web Services (AWS) environments.
A $25 template helped scammers build hundreds of phantom bank domains
Cybersecurity researchers have uncovered a network of hundreds of fraudulent banking websites, many of which share common elements from a $25 commercial website template. The investigation, initiated by Allure Security, began when a researcher noticed a suspicious domain impersonating a client's brand, but displaying an unrelated bank with the phrase "one of the largest digital banking…
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
A new Android malware, dubbed Manic, has been identified by ThreatFabric's Mobile Threat Intelligence team, active since at least February 2026. The malware, which is still under development as of July, combines features of banking malware and mobile spyware, enabling financial fraud, surveillance, and device control.
US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline
US Bank is currently investigating claims made by the LockBit ransomware group, which alleges it breached the financial institution and exfiltrated data. LockBit has set a deadline of September 3 for US Bank to pay an extortion demand, threatening to publish the stolen information if the payment is not made.
'Grandoreiro' Malware Resurfaces With Mexico Campaign
The Grandoreiro banking Trojan has reportedly resurfaced, targeting entities within Mexico. This reappearance follows a previous law enforcement takedown operation against the malware. The current iteration of Grandoreiro is noted for incorporating new features designed to complicate its detection and analysis by security researchers and defensive systems.
French tax authority says break-in exposed data of 600K, including some private messages
France's General Directorate of Public Finances (DGFiP), the national tax authority, has confirmed a data breach that exposed information belonging to approximately 600,000 individuals and businesses. The compromised data includes tax identification numbers, marital status, email and postal addresses, phone numbers, household composition, number of dependents, family quotient, reference tax…
Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps
Security researchers have identified a new variant of the ToxicPanda Android banking Trojan, dubbed ToxicPanda 2.0, which significantly expands its targeting capabilities. The zLabs team at Zimperium, a mobile security vendor, detailed their findings in a report published on August 19.
Banks look for fraud signals in customer behavior
Financial institutions are increasingly confronting a surge in fraud cases where customers are coerced into authorizing payments by criminals, prompting a shift in fraud detection strategies. A recent industry benchmark report, the Fraud Readiness Benchmark 2026, highlights that social engineering, evolving reimbursement regulations, and a growing volume of cases are significantly reshaping…
Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs
Oracle has released its August 2026 Critical Security Patch Update (CSPU), addressing 925 unique Common Vulnerabilities and Exposures (CVEs) through 943 security updates across 23 of its product families. This update includes 154 critical severity patches, accounting for 16.3% of the total fixes.
Hackers Expose Data of 1.2 Million Heights Finance Customers
Heights Finance Holdings Co., a U.S. consumer finance company, has begun notifying over 1.2 million individuals that their personal and financial data was exposed following a cybersecurity incident. The breach, discovered on May 7, 2026, involved unauthorized access to a third-party cloud platform used by Heights Finance to store customer information.
Heights Finance data breach: What customers need to know
Heights Finance Holdings has confirmed a data breach affecting a third-party cloud platform, potentially exposing sensitive personal, financial, and identity information for current and former customers, as well as individuals who merely inquired about loan products. The company discovered the unauthorized access on May 7 and initiated an investigation, which concluded that an intruder may…
Heights Finance Data Breach Impacts at Least 1.2 Million Individuals
Heights Finance has reportedly experienced a data breach affecting at least 1.2 million individuals. The incident involved the theft of sensitive personal and financial information, including names, addresses, phone numbers, Social Security numbers, and other financial details. The compromise is understood to have originated from a third-party platform utilized by Heights Finance.
Nearly 750k had financial info, SSNs leaked in South Carolina loan company breach
Heights Finance, a debt consolidation loan company, has confirmed a data breach affecting approximately 734,828 individuals. The incident, discovered on May 7, involved unauthorized access to a third-party cloud-based platform used by the company to store customer data.
LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected
A supply-chain attack targeting LiteLLM, a popular open-source AI gateway and utility library, has led to the exposure of credentials across more than 2,000 code repositories, impacting a wide range of organizations, particularly in the technology, finance, and healthcare sectors. The threat actor group, identified as TeamPCP, compromised maintainer credentials for LiteLLM and published…
France’s tax authority admits hackers made off with data on 678,000 individuals
France's General Directorate of Public Finances (DGFiP) has confirmed a data breach affecting 678,000 individuals and professionals after an attacker gained unauthorized access to its systems. The incident, which came to light following claims made by an alleged attacker on a cybercrime forum, exposed sensitive tax data.
Police bust cybercrime ring accused of stealing €30 million in four-day spree
An international law enforcement operation has dismantled a cybercrime ring accused of stealing €30 million from a German financial institution over a four-day period in late 2023. Authorities in Brazil arrested four individuals and are pursuing three additional suspects in Spain and Bulgaria.
Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology
A recent report highlights that the primary cybersecurity challenge facing organizations in Africa extends beyond mere access to technology, according to Gopan Sivasankaran, Rapid7's Regional Director for the Middle East & Africa. The observation focuses on the expanding technological landscape across key nations including Egypt, Nigeria, South Africa, and Kenya, where organizations are…
Investigation of banking hack leads to arrests in Germany, Brazil
Law enforcement agencies in Germany and Brazil have announced multiple arrests connected to a sophisticated banking hack that occurred in late 2023, which reportedly siphoned approximately €30 million (equivalent to $34.7 million) from German bank accounts. The German federal police agency, the BKA, confirmed the apprehension of three suspects in Europe, who face fraud charges. Concurrently,…
Mission-Driven Security: Inside a Global Bank's Defense
A recent interview with the group CISO of Standard Chartered provided insights into the evolving landscape of cybersecurity within a global banking institution. The discussion focused on the transition from purely technical security roles to more strategic leadership positions, emphasizing the critical need for security executives to possess a strong understanding of business operations. The…
Hackers arrested over €30M bank fraud exploiting service provider flaw
Seven individuals have been charged in connection with a sophisticated cyber fraud operation that exploited a vulnerability at a service provider, leading to the unauthorized withdrawal of approximately €30 million ($34.6 million) from customer accounts at a major German financial institution. Four arrests were made in Brazil, while three other suspects face prosecution in Europe.
France investigates tax authority breach after hacker claims 600,000 victims
The Directorate General of Public Finances (DGFiP), France's tax authority, has confirmed that its information systems were breached, leading to the extraction of data belonging to individuals and businesses. The French Economy Ministry stated that an attacker gained unauthorized access to DGFiP systems in late June by stealing or misusing an identity. This intrusion allowed the attacker to…
If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them
OpenAI and Anthropic, two prominent artificial intelligence development companies, are facing market headwinds that could challenge their long-term financial viability, leading some observers to suggest their potential nationalization if they fail as private enterprises. Both companies were founded by AI developers who expressed concerns about the unchecked development of AI by large…