Search: “FR-Bank”

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackers·05:33 UTC · 13h agoMalware in the wild 2 sources

OFAC Sanctions Chinese Scam Platform Xinbi Guarantee

US Treasury's OFAC sanctioned Chinese scam-platform Xinbi Guarantee, which processed $24bn+, and froze $52.8m in linked cryptoassets.

OFAC sanctioned Xinbi Guarantee, a Chinese-language marketplace connecting Southeast Asian scam centers and transnational crime syndicates to merchants offering financial services, technology and crypto exchange. Treasury estimates over $24bn processed since 2022, while TRM Labs estimates over $36bn, with daily inflows nearly doubling between May and December 2025. Two supporting entities were also sanctioned: SafeW Technology (Singapore) and Anwen Technology (Cambodia, maker of XinbiPay). The US Secret Service and Elliptic froze $52.8m in linked cryptoassets, and the marketplace now appears offline with its Telegram channels deleted.

Infosecurity Magazine·updated Sep 10, 21:15 UTC · 5d ago·first Sep 10, 08:00 UTC · 6d agoPolicy & legal 3 sources1

Fortunate Recall: Ontology-Driven Memory Lifecycle Management for Persistent Coherence in LLMs

Fortunate Recall introduces ontology-based lifecycle policies for LLM memory, cutting confabulation roughly in half (e.g., 45.1% to 22.4%) versus Mem0.

Fortunate Recall (FR) is a composable policy layer that classifies personal facts into a 10+1 behavioral ontology and applies category-specific lifecycle rules including differential temporal decay, slot-key supersession, event-time validity, and retrieval routing. FR-Bank scores 76.9% on the new 516-question LifecycleBench, ahead of Mem0, A-MEM, Memory-R1, and MemoryOS (61%-70.5%), and 75.2% on LongMemEval-S. End-to-end, confabulation drops from Mem0's 45.1% to 22.4% over answered queries, with the ranking replicating on open-weight Kimi K2.5 and transferring to the independent BEAM benchmark (46.8% vs 32.9%).

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:31 UTC · 7d agoAI research

A $25 template helped scammers build hundreds of phantom bank domains

Allure Security researchers found 838 live phantom bank sites sharing a $25 template, built to lend credibility to investment and romance scams.

Allure Security researchers discovered roughly 2,200 domains presenting invented banks, of which 1,095 returned working pages and 838 contained a shared phrase. 97% of those retained parts of the $25 Cuex front-end template and 94% ran Laravel, with a misspelled 'Curreny Charts' heading on 90% of sites. The sites presented login pages, session cookies, and anti-forgery tokens consistent with a fraud model where scam contacts direct victims to fake financial portals. A leftover 'Remedy bank' title and form submission to remedycodes[.]site linked some sites to already-flagged fraud infrastructure.

Help Net Security·Aug 21, 00:00 UTC · 26d agoPhishing & fraud

Financial Stability Board Sounds the Alarm Over Frontier AI Risks

The Financial Stability Board warned G20 banking leaders that frontier AI adoption poses growing cyber and financial stability risks.

The Financial Stability Board (FSB) issued a warning to G20 banking leaders about cyber and financial-stability risks stemming from frontier AI. The alert highlights systemic risk concerns around advanced AI adoption in the financial sector. No specific incidents or regulatory actions were announced.

Infosecurity Magazine·Sep 1, 09:20 UTC · 15d agoAI policy

X says attackers are targeting user accounts after the launch of X Money

X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.

Numerous X users reported unsolicited password reset emails following the launch of X Money, the platform's new payments service with accounts held at FDIC-insured Cross River Bank. Product engineer Mridul Singhai said the company found no evidence of successful breaches or mass account takeovers, while the Grok chatbot confirmed attackers are mass-triggering resets using public usernames. Users are being advised to enable two-factor authentication and Password Reset Protect while the investigation continues.

TechCrunch · Security·Sep 1, 20:48 UTC · 14d agoPhishing & fraud in the wild

FST Pay: Deterministic Safety-Gated Architecture for Youth Digital Payments

FST Pay proposes a deterministic safety-gated architecture for teen digital payments, pairing invariant authorization checks with decoupled post-settlement AI explanations.

Researchers propose FST Pay, a formal architecture for adolescent digital payments on rails like UPI that applies six deterministic invariant checks (spending limits, guardian co-sign policies, amount thresholds, merchant category codes, temporal intervals, hardware integrity) to classify transactions as ALLOW, REVIEW, or BLOCK. High-risk transactions trigger an asynchronous guardian co-sign workflow. Generative AI is restricted to post-settlement natural-language insights and holds no mutation privileges over the ledger, avoiding non-determinism on the real-time authorization path.

arXiv cs.CR·Sep 10, 08:03 UTC · 6d agoResearch

At UBS, AI skills are now a condition for landing a job

UBS will require 2027 graduate and intern applicants in Global Banking to demonstrate AI skills, among the first major banks to do so.

Per the Financial Times, UBS will require candidates for 2027 graduate and internship roles in Global Banking and Markets to show how they use AI to improve outcomes and efficiency, with AI questions included in interviews. The requirement supplements, not replaces, traditional criteria, and Santander is similarly seeking advanced AI users for some trainee programs. Morgan Stanley analysts project more than 200,000 European banking jobs could disappear within five years as routine junior work is automated; UBS is also testing analyst avatars for client presentations.

The Decoder·Sep 7, 13:13 UTC · 9d agoAI industry

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security News·updated 18:50 UTC · 42m ago·first 08:12 UTC · 11h agoMalware in the wild 2 sources

Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign

Banking trojan Grandoreiro resurfaces in Mexico using DLL sideloading, now accounting for 40% of detections after its 2024 disruption.

Grandoreiro, a banking trojan disrupted in 2024, is active again with a new DLL sideloading technique. Mexico now accounts for 40% of the malware's detections. The resurgence signals renewed targeting of banking customers in Latin America.

Infosecurity Magazine·Aug 19, 14:00 UTC · 28d agoMalware

Fake bank websites play dead to evade security scanners

Fortra uncovered Chameleon SEO Poisoning: cloaked typosquat bank sites rank on Google and Bing to steal credentials while evading scanners, with cases up 40% in Q2 2026.

Fortra's threat intelligence unit FIRE spent three months tracking Chameleon SEO Poisoning, a phishing method that ranks recently registered typosquat domains on second-level domains like .ph.com and .gr.com above legitimate bank sites on Google and Bing. The technique uses presentation control (cloaking by referrer): direct visits get a dead, offline-looking page, while search-referred clicks receive a convincing fake bank login page, letting poisoned results persist for days or weeks. Fortra recorded a 40% jump in cases during the second quarter of 2026 and recommends referrer-spoofed URL testing, faster SLD takedowns, and bookmarking bank logins.

Help Net Security·Aug 24, 00:00 UTC · 23d agoPhishing & fraud in the wild

Russian suspect in bank account takeovers is extradited to US

Russian web developer Sergei Filimonov was extradited from Georgia to the US to face charges in a multimillion-dollar bank account takeover fraud.

Sergei Anatolyevich Filimonov, 36, appeared in an Atlanta federal court on September 4 and pleaded not guilty to bank fraud, wire fraud, access device fraud, and aggravated identity theft charges. Prosecutors say that from November 2023 to October 2025 his group bought sponsored search-engine links that diverted online banking customers to spoofed login pages, stole their credentials, and initiated unauthorized wire transfers. The FBI linked the scheme to the December 2025 seizure of the domain web3adspanels.org, identifying at least 19 victims, roughly $14.6 million in confirmed losses, and about $28 million in attempted losses.

The Record·Sep 8, 19:37 UTC · 7d agoPolicy & legal

X Money rollout linked to password-reset attacks

X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.

X users began reporting unexpected password-reset emails and codes on September 1, and product engineer Mridul Singhai said attackers appear to believe newly widespread X Money access makes accounts worth targeting. X says it has found no evidence of any breach or successful account takeover, and completing a reset still requires access to the account's email or phone number. X Money offers eligible US users interest-bearing accounts, a Visa debit card, and P2P payments, with Cross River Bank providing banking infrastructure. Malwarebytes warns the reset flood can serve as cover for phishing and urges reset protection, 2FA, and unique passwords.

Malwarebytes Labs·Sep 4, 12:29 UTC · 12d agoPhishing & fraud in the wild

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security Labs·Sep 14, 00:00 UTC · 2d agoMalware in the wild

Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users

Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.

FortiGuard Labs detailed a Casbaneiro banking Trojan campaign observed in August 2026 targeting users in Argentina, Peru, Colombia, and Mexico via fake invoice and legal-notice emails. The operation uses geofenced landing pages, an HTA downloader with WMI-based sandbox checks, a legitimate AutoIt interpreter, and process injection into RegSvcs.exe (fallback mobsync.exe). C2 activation is conditional on victims visiting banking websites, enabling keyboard control, clipboard manipulation, and fake overlay windows for bank-focused fraud, while distributed exfiltration servers and unusual HTTP 403-based signaling hinder analyst correlation.

GBHackers·Sep 14, 05:56 UTC · 2d agoMalware in the wild1

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

US DOJ and Treasury disrupt Xinbi Guarantee Telegram scam marketplace, sanctioning it and freezing $52.8M in USDT across 52 wallets.

The DOJ seized Xinbi Guarantee's Telegram channels and cryptocurrency wallets while OFAC sanctioned the marketplace, freezing $52.8 million in USDT from 52 wallets and bringing the Scam Center Strike Force's total restrained funds to roughly $938 million. Elliptic, which worked with the Secret Service, estimates Xinbi has processed $30 billion in transactions since around 2022, serving pig-butchering scam operators and links to North Korean hackers, Jin Bei Group, and Prince Group TCO. The strike force dismantled 13 scam compounds in Madagascar, seizing over 3,200 devices and interviewing roughly 400 arrestees, with about 30 Chinese compound leaders repatriated to China. After Tether froze funds, Xinbi began converting remaining USDT into the USDD stablecoin.

The Hacker News·Sep 9, 18:26 UTC · 7d agoPolicy & legal

Xen Security Advisory 511 v3 (CVE-2026-79603) - Unconditionally do TLB flushing ahead of page scrubbing

Xen Project released XSA-511 (CVE-2026-79603) fixing missing TLB flushes before page scrubbing that can leak x86 PV guest data.

Xen Security Advisory 511 v3 publicly discloses CVE-2026-79603, a TLB handling flaw in the Xen hypervisor on x86. x86 PV guests can free memory pages while a stale TLB entry still points to them, and Xen only flushes the TLB when the page is reused, potentially exposing stale data ahead of scrubbing. The advisory changes Xen to unconditionally flush the TLB ahead of page scrubbing. The issue was published in version 3 of the advisory.

oss-security·Sep 8, 15:39 UTC · 8d agoVulnerability 4 sourcesCVE-2026-79603

Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites

Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.

Fortinet identified an August 2026 Casbaneiro banking Trojan campaign targeting users in Argentina, Peru, Colombia, and Mexico through phishing PDFs styled as urgent invoices or legal notices. The staged chain uses IP-based geo-filtering, a Base64-encoded ZIP, an HTA file, and a legitimate AutoIt interpreter before injecting into RegSvcs.exe or mobsync.exe and persisting via a Startup shortcut. The Trojan exfiltrates address book and Outlook data unencrypted, stays dormant until victims visit targeted bank sites, then accepts commands for keyboard control, clipboard pasting, file execution, and command execution. It uses an expected HTTP 403 response from a second server and malformed HTTP requests to complicate network analysis.

Cyber Security News·Sep 14, 08:42 UTC · 2d agoMalware in the wild

Russian suspect in bank account takeovers is extradited to US

Russian developer Sergei Filimonov was extradited to the U.S. and pleaded not guilty to multimillion-dollar bank account takeover fraud.

Sergei Anatolyevich Filimonov, a 36-year-old Russian web developer, has been extradited to the United States to face an indictment in a multimillion-dollar bank account takeover scheme. He appeared in Atlanta federal court on September 4 and pleaded not guilty to fraud charges. Federal authorities announced the extradition on Tuesday.

DataBreaches.net·Sep 9, 12:08 UTC · 7d agoPolicy & legal1

Visa enhances A2A Protect to stop fraud before money leaves the account

Visa enhanced A2A Protect with a Featurespace-powered unified fraud score to help banks stop account-to-account fraud before funds leave accounts.

Visa announced an updated A2A Protect that integrates Featurespace technology into a unified fraud score, giving banks real-time risk insights on account-to-account payments without waiting for in-house model training or consortium participation. Visa claims a 75% increase in fraud detection within the first six months of deployment and a single API for integration. A2A transaction volume is projected to exceed 5.8 trillion by 2028, up 160% from 2024.

Help Net Security·Sep 2, 00:00 UTC · 14d agoTools

ToxicPanda Banking Trojan Matures Into Enterprise Threat

The ToxicPanda Android banking trojan has matured with new features that expand its global reach beyond users' financial apps.

Researchers report that the latest version of the ToxicPanda Android banking trojan includes new capabilities that broaden its global distribution and increase its threat to enterprises, not just individual users' financial applications. The trojan's evolution signals it is operating at a more professional, enterprise-targeting level. The report outlines expanded features and reach rather than a single incident.

Dark Reading·Aug 24, 14:34 UTC · 23d agoMalware

Russian national extradited to US for alleged involvement in bank-account takeover scheme

US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.

US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.

CyberScoop·Sep 8, 20:32 UTC · 7d agoPolicy & legal

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog·Sep 11, 13:33 UTC · 5d agoPhishing & fraud

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

Five Venezuelan nationals pleaded guilty to failed ATM jackpotting attempts in Kansas as the FBI reports 700+ US incidents in 2025.

The five defendants traveled from Indiana to Kansas in December 2025 and tried to install malware on ATMs in Wamego and Manhattan, planning to remotely trigger the machines to dispense cash. Both attempts failed — one triggered an alarm — and the men were arrested days later after surveillance captured the thefts. All five pleaded guilty to conspiracy to commit bank larceny; one has received a nine-month prison sentence. The FBI counted more than 700 jackpotting incidents in 2025 with over $20 million in losses, part of 1,900 incidents since 2020.

Security Affairs·Sep 1, 13:50 UTC · 15d agoPhishing & fraud

Banking Trojans: Ursnif Global Distribution Networks Identified

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Palo Alto Unit 42·Aug 17, 12:56 UTC · Aug 17, 2026Malware in the wild

France Establishes New Government-Focused Cyber Incident Response Unit

France created REACTIV, an ANSSI-led interministerial cyber incident response unit for state services, after the DGFiP breach exposed up to 678,000 taxpayers.

ANSSI announced REACTIV (Interministerial Response & Action against Data Breaches) on September 7, a dedicated incident response capability for French state services. It lets ANSSI require ministries to take urgent protective measures for citizens' data and lead centralized technical crisis communications during attacks on state services. The move follows the DGFiP tax authority attack that exposed data of 350,000 to 678,000 taxpayers, after which the Prime Minister ordered an extensive audit of ANSSI. Two suspects aged 16 and 18 from the ZeroBytes hacking group were arrested in late August.

Infosecurity Magazine·Sep 8, 14:30 UTC · 8d agoPolicy & legal

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN·Aug 26, 09:17 UTC · 21d agoPhishing & fraud in the wild

The New Face of Financial Fraud: AI-Powered Brand Abuse

Akamai reports AI-powered brand abuse is driving financial fraud against banks and promotes its Brand Guardian defense.

Akamai describes AI-powered brand abuse as a growing driver of financial fraud against banks. The post outlines the threats and the business impact for financial institutions. It also promotes Akamai Brand Guardian as a mitigation for financial institutions.

Akamai Blog·Aug 25, 13:00 UTC · 22d agoPhishing & fraud

Metabase zero-day exploited to access Framework customer data

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Exploit / PoC