Recent Financial Services Cyber Attacks

Attackers linked to North Korea allegedly used a fake recruitment process to persuade a Binance software engineer to download a malicious coding assignment onto a work computer. They then used the compromised device, internal AI tooling, and stolen deployment credentials to reach wallet-signing…

North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…

Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…

Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…

Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…

Attackers compromised Arara Message, a Japanese email delivery platform, potentially exposing about 77 million email addresses across roughly 380 client companies. They then used the trusted service to send up to 7.13 million suspicious emails that impersonated credit card companies and asked…

Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…

A Banca Ifis manager received payment-request emails from someone posing as a colleague and approved transfers totaling about €23.8 million. The incident is a business email compromise (BEC) case: the attacker used a trusted internal identity and a routine payment workflow rather than a technical…

Researchers uncovered an active banking-phishing operation using hundreds of cloned financial websites. The sites show real victims a fake bank login page, but display a convincing “account suspended” notice to security scanners on a second visit, helping the criminals avoid takedown action. The…

Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…

Researchers found that criminals are stealing cloud and AI access, then reselling it through illicit AI services while victims receive enormous cloud bills. In one documented case, a group used a fake portal for LLM users to trick visitors into submitting information containing active access…

Mandiant investigated real 2026 incidents in which criminals stole or abused cloud and LLM access to run up massive unauthorized charges. In one case, UNC6993 used a fake application portal to persuade LLM users to paste active access-token data, allowing the attackers to bypass password and MFA…

Google’s threat researchers investigated real attacks in which criminals stole cloud and AI-service access, then ran up charges exceeding $100,000 in a day and, in one case, nearly $1 million. One group used a fake LLM user sign-up portal to trick visitors into providing active access tokens, while…

The FBI attributed the theft of roughly $6.3 billion from Binance to North Korea's TraderTraitor operation, which is linked to the Lazarus Group. The reported Binance breach began with a compromised DevOps engineer laptop, while the group has previously used fake job offers and recruitment…

The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…

A real campaign called Yoba used fake GitHub projects for supposed ChatGPT and Claude desktop applications to lure people into downloading malicious ZIP installers. The installers included legitimate signed OpenAI or Anthropic programs alongside malicious files, ultimately installing a…

Akamai documented scam operations that use large numbers of look-alike shopping and ticketing websites to steal payment and identity information. The operators can quickly replace a removed site with another domain connected to the same payment-data collection system. Other campaigns used…

The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…

Amatera is a subscription-based information stealer that affiliates distribute through fake AI-tool download pages, compromised websites, paid search ads, phishing, and deceptive ClickFix prompts. The scams convince people to copy and run a command to supposedly fix a CAPTCHA, browser error, or…

Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…