Search: “HSBC”

OFAC Sanctions Chinese Scam Platform Xinbi Guarantee

US Treasury's OFAC sanctioned Chinese scam-platform Xinbi Guarantee, which processed $24bn+, and froze $52.8m in linked cryptoassets.

OFAC sanctioned Xinbi Guarantee, a Chinese-language marketplace connecting Southeast Asian scam centers and transnational crime syndicates to merchants offering financial services, technology and crypto exchange. Treasury estimates over $24bn processed since 2022, while TRM Labs estimates over $36bn, with daily inflows nearly doubling between May and December 2025. Two supporting entities were also sanctioned: SafeW Technology (Singapore) and Anwen Technology (Cambodia, maker of XinbiPay). The US Secret Service and Elliptic froze $52.8m in linked cryptoassets, and the marketplace now appears offline with its Telegram channels deleted.

Infosecurity Magazine·updated Sep 10, 21:15 UTC · 5d ago·first Sep 10, 08:00 UTC · 6d agoPolicy & legal 4 sources1

FTC rescinds policy requiring health apps to notify customers after a breach

The FTC unanimously rescinded its 2021 policy statement that required health and fitness apps to notify users after health-data breaches.

The FTC voted to rescind a September 2021 Biden-era policy statement that extended federal health-data breach notification rules to health apps, fitness trackers, and connected devices, which had exposed violators to fines of $43,792 per violation per day. The 2021 statement, adopted in a divided 3-2 vote under then-chair Lina Khan, cited HIPAA coverage gaps for consumer health applications. The commission said the statement provided minimal benefit, was superseded by rulemaking, and aligns with the White House deregulatory agenda.

CyberScoop·updated Sep 10, 13:40 UTC · 6d ago·first Sep 9, 19:18 UTC · 6d agoPolicy & legal 2 sources

Exploring the Latest Mispadu Stealer Variant

Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.

Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.

Palo Alto Unit 42·Aug 17, 11:46 UTC · Aug 17, 2026Malware in the wildCVE-2023-360251

USN-8735-1: HSQLDB vulnerability

Ubuntu released USN-8735-1 fixing an HSQLDB flaw that lets specially crafted database files overwrite arbitrary files.

Ubuntu Security Notice USN-8735-1 addresses a vulnerability in HSQLDB, which incorrectly handled specially crafted database files. An attacker could exploit the flaw to overwrite arbitrary files on affected systems; updated packages are available.

Ubuntu Security Notices·Sep 8, 11:51 UTC · 8d agoAdvisory

Mistral AI raises 3 billion euros in Europe's largest-ever tech funding round despite lagging behind rivals

Mistral AI closed a €3 billion Series D led by Samsung Electronics, valuing the lab at over €21 billion.

Mistral AI raised €3 billion in what it calls the largest equity round ever by a European tech company, lifting its valuation past €21 billion after ASML valued it near €12 billion in September 2025. Samsung Electronics leads the round with EQT's Scaleup Europe Fund and PSG Equity as co-leads; new investors include Advent, BlackRock-managed funds, and Luxembourg. The company also took an $830 million loan in March to fund its own data centers and serves 125+ enterprise customers including Airbus, ASML, and HSBC. Mistral Medium 3.5 trails open rivals like Qwen and Kimi and doesn't compete with top closed US models.

The Decoder·Sep 8, 07:45 UTC · 8d agoAI industry1

Financial Stability Board Sounds the Alarm Over Frontier AI Risks

The Financial Stability Board warned G20 banking leaders that frontier AI adoption poses growing cyber and financial stability risks.

The Financial Stability Board (FSB) issued a warning to G20 banking leaders about cyber and financial-stability risks stemming from frontier AI. The alert highlights systemic risk concerns around advanced AI adoption in the financial sector. No specific incidents or regulatory actions were announced.

Infosecurity Magazine·Sep 1, 09:20 UTC · 15d agoAI policy

Mistral raises €3B

Mistral raised a Samsung-led €3B Series D at a €21B+ valuation — the largest European tech equity round — to scale compute and frontier AI research.

Mistral announced a €3 billion Series D at a post-money valuation above €21 billion, the largest equity round ever by a European technology company. Samsung Electronics led the round, with co-leads Scaleup Europe Fund (managed by EQT) and PSG Equity; new investors include Advent, BlackRock, and the Grand Duchy of Luxembourg. The company operates across 20 countries, serves 125+ enterprises including Airbus, ASML, and HSBC, and says funds will expand frontier research, compute capacity, and international growth.

Hacker News · AI·Sep 8, 05:06 UTC · 8d agoAI industryHN 648↑ · 468 comments

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online·Sep 7, 10:09 UTC · 9d agoIndustry

Indonesia Hit by Android Banking App-Cloning Campaign

GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.

The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.

Dark Reading·updated Sep 11, 12:14 UTC · 5d ago·first Sep 11, 01:00 UTC · 5d agoThreat actor in the wild 3 sources

Banking Trojans: Ursnif Global Distribution Networks Identified

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Palo Alto Unit 42·Aug 17, 12:56 UTC · Aug 17, 2026Malware in the wild

Hackers Expose Data of 1.2 Million Heights Finance Customers

Heights Finance is notifying over 1.2 million customers that hackers accessed a third-party cloud platform holding contact, bank and government ID data.

Heights Finance, a U.S. consumer lender, discovered unauthorized access on May 7, 2026 to a third-party cloud platform used to store customer data; its internal loan management systems and operations were not affected. Exposed data varies by person and may include contact details, financial and bank account information, government IDs and dates of birth for customers, loan applicants, inquirers, and former borrowers of Curo Management and related brands. The company is offering 24 months of free credit monitoring and identity protection; dark web monitoring found no evidence of publication and no threat actor has claimed responsibility.

Security Affairs·Aug 18, 17:55 UTC · 28d agoData breach in the wild

ICE Is Buying Access to Credit Card Records

Schneier on Security·Aug 7, 10:27 UTC · Aug 7, 2026Phishing & fraud

Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group

Recorded Future details Tajin Group, a Chinese-speaking vendor on Telegram guarantee marketplaces running phishing, carding, and money laundering operations targeting Chinese banks.

Insikt Group analyzed Tajin Group, a Chinese-speaking threat actor operating on Telegram-based guarantee marketplaces Dabai Guarantee and, since May 2026, Xinbi Guarantee. The group conducts phishing, payment card theft, and money laundering targeting mainland Chinese citizens and banks, testing stolen cards from twelve countries on platforms like CCAvenue and Geidea. Operators bought and sold at least 100 Telegram usernames and anonymous virtual numbers via Fragment Market to strengthen OPSEC, linking multiple usernames to single Telegram accounts. Recorded Future warns Tajin Group's TTPs are likely to be replicated by other vendors on Chinese-language guarantee marketplaces at global scale.

Recorded Future·Sep 15, 00:00 UTC · 1d agoThreat actor

Anthropic's Enterprise Frontier Safeguards lets your Claude logs stay in your cloud

Anthropic launches Enterprise Frontier Safeguards, letting regulated customers keep Claude usage logs in their own cloud storage under their own keys with automated misuse detection.

Anthropic unveiled Enterprise Frontier Safeguards, co-designed with eight members of the Analysis and Resilience Center for Systemic Risk and more than 100 customers including Wells Fargo, Goldman Sachs, Visa, Mastercard, Comcast, KPMG, and Salesforce. Misuse-detection activity data can live in the customer's Amazon S3, Azure Blob Storage, or Google Cloud Storage under customer-managed keys, with fully automated review and no human inspection by Anthropic; automated systems watch for offensive cyber or biological capability development and signs of stolen credentials. The offering replaces the friction around Fable 5's 30-day retention policy, costs nothing extra, spans Claude Enterprise, Claude Platform, Amazon Bedrock, Google's Agent Platform, and Microsoft Foundry, with broad availability targeted for later this fall.

Help Net Security·Sep 2, 00:00 UTC · 14d agoAI industry1

Iranian banks' SSL certificates are being revoked due to OFAC sanctions

OFAC sanctions are reportedly causing Iranian banks' SSL certificates to be revoked, threatening secure HTTPS access to their services.

A Hacker News discussion highlights a report that Iranian banks' SSL/TLS certificates are being revoked as a consequence of OFAC sanctions. Certificate revocation would degrade or break trusted HTTPS connections to affected banking domains for users in Iran. The item is a headline-only discussion post with limited detail on which certificate authorities or banks are affected.

Hacker News · security·Sep 14, 17:58 UTC · 1d agoPolicy & legalHN 23↑ · 6 comments

Payroll system of mosques, madrasahs hit by ransomware; staff details potentially compromised

Ransomware hit Avelogic's SmartHRMS payroll system serving Singapore mosques and madrasahs under MUIS, potentially exposing staff details.

The SmartHRMS human resources and payroll system used by mosques and madrasahs overseen by Singapore's Islamic Religious Council (MUIS) was hacked and held for ransom. The system is supplied by Singapore-based software vendor Avelogic, which posted a cybersecurity incident notice on its website. Staff details are potentially compromised, according to The Straits Times.

DataBreaches.net·Sep 15, 22:08 UTC · 19h agoRansomware in the wild

Legora reviewed 41 documents in minutes with GPT-6 Astra

Legal-tech firm Legora says GPT-6 Astra reviewed 41 financial documents in minutes, catching all four planted errors and boosting accuracy about 40%.

Legal technology company Legora reported using OpenAI's GPT-6 Astra to review 41 financial-statement documents in minutes. The workflow found all four planted errors and improved performance by nearly 40% compared to prior processes. The case study highlights AI-assisted financial review adoption in professional services.

OpenAI News·Sep 3, 12:00 UTC · 13d agoAI industry

Microsoft Teams Has Become a Haven for Scammers in China

Scammers in China are exploiting Microsoft Teams and Webex to trick Chinese victims into transferring large sums of money.

WIRED reports that fraudsters are abusing enterprise chat platforms including Microsoft Teams and Cisco Webex to run scams against victims in China. Victims are socially engineered into transferring large sums of money. The campaign has generated a wave of complaints, highlighting how scam groups abuse legitimate business communication tools.

WIRED · Security·Aug 28, 18:23 UTC · 18d agoPhishing & fraud in the wild

Nearly half of enterprises have no one leading PQC migration

Axiad survey finds 46% of enterprises lack a single leader for post-quantum cryptography migration despite most maintaining cryptographic inventories.

Axiad research on post-quantum cryptography (PQC) readiness found 75% of respondents maintain continuously updated inventories of certificates, keys, and algorithms, but 46% have no single person owning the migration. About half have never formally assessed whether public-facing infrastructure supports post-quantum key exchange. 67% said the harvest-now-decrypt-later threat is an active priority, with competing priorities, budget constraints, and lack of regulatory guidance cited as top obstacles; executives were more confident than PKI practitioners.

Help Net Security·Aug 21, 00:00 UTC · 26d agoPolicy & legal

IBM security advisory (AV26-862)

Canada's Cyber Centre relayed an IBM advisory disclosing vulnerabilities across SPSS, MQ, Maximo, Instana, Concert and other IBM products.

The Canadian Centre for Cyber Security (AV26-862) published an IBM security advisory dated August 31, 2026, noting vulnerabilities affecting multiple IBM products as of August 28, 2026. Affected products include SPSS Collaboration and Deployment Services, IBM MQ Agent, Maximo Application Suite Monitor Component, Observability with Instana agent, Financial Transaction Manager for Red Hat OpenShift, Engineering Test Management, Control Center, Concert Software and Tivoli System Automation. No CVE identifiers, CVSS scores or exploitation details are provided in the relayed text.

Canadian Centre for Cyber Security·Aug 31, 15:52 UTC · 16d agoAdvisory

Is Cyber Facing an Affordability Crisis?

Dark Reading analysis argues record breach costs and roughly $240 billion in cyber defense spending leave small businesses dangerously exposed, threatening supply chains.

The analysis examines an affordability crisis in cybersecurity, noting breach costs have reached record highs while defense spending approaches $240 billion. It argues small businesses are dangerously under-protected relative to rising attack costs. Weak small-business defenses are framed as a supply chain security risk for larger organizations.

Dark Reading·Aug 25, 14:53 UTC · 22d agoIndustry

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 15, 14:29 UTC · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access

SOCRadar reports underground posts claiming a Bangladeshi e-commerce database, Vedicline data leak, Langflow RCE, ASUS breach, and energy-sector shell access.

SOCRadar's Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database offered for sale. The roundup also covers a claimed Vedicline data leak, Langflow remote code execution, an ASUS breach claim, and energy-sector shell access sales. Details on record counts and victims were not provided in the excerpt.

SOCRadar·Sep 7, 09:20 UTC · 9d agoData breach

From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO

Cyble argues security teams should express cyber risk in financial terms for CFOs instead of high/medium/low ratings, citing its 2025 threat forecast results.

Cyble published guidance on cyber risk quantification, arguing qualitative high/medium/low ratings fail to convey financial exposure to executives. The piece notes that over 80% of its 2025 threat predictions, including AI-driven ransomware and supply-chain attacks, materialized as anticipated.

Cyble·Aug 25, 09:45 UTC · 22d agoIndustry

G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules

G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.

Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.

Infosecurity Magazine·Sep 4, 09:25 UTC · 12d agoPolicy & legal

ToxicPanda Banking Trojan Matures Into Enterprise Threat

The ToxicPanda Android banking trojan has matured with new features that expand its global reach beyond users' financial apps.

Researchers report that the latest version of the ToxicPanda Android banking trojan includes new capabilities that broaden its global distribution and increase its threat to enterprises, not just individual users' financial applications. The trojan's evolution signals it is operating at a more professional, enterprise-targeting level. The report outlines expanded features and reach rather than a single incident.

Dark Reading·Aug 24, 14:34 UTC · 23d agoMalware

Healthcare Giant McKesson Investigates Data Breach Incident

ShinyHunters claims theft of 284 million records from healthcare giant McKesson, which says it is investigating the alleged breach.

ShinyHunters claims it stole 284 million records from McKesson, one of the largest healthcare distribution companies. McKesson confirmed it is investigating a data breach incident. The claimed scale of the theft has not yet been independently verified, and extortion activity is implied by the actor's involvement.

Infosecurity Magazine·Sep 1, 08:25 UTC · 15d agoData breach1

Weverse Data Leak Affects More Than 422,000 K-Pop Fan Accounts

HYBE-affiliated Weverse confirmed a leak affecting 422,584 K-pop fan accounts, exposing mainly internal identifiers unusable outside the platform.

Weverse, the fan platform operated by HYBE-affiliated Weverse Company, confirmed a security incident affecting 422,584 user accounts. The exposed information consisted mainly of internal identifiers that cannot be used outside the platform. The company was notified by the Korea Internet & Security Agency (KISA) on September 3.

DataBreaches.net·Sep 7, 12:30 UTC · 9d agoData breach

At UBS, AI skills are now a condition for landing a job

UBS will require 2027 graduate and intern applicants in Global Banking to demonstrate AI skills, among the first major banks to do so.

Per the Financial Times, UBS will require candidates for 2027 graduate and internship roles in Global Banking and Markets to show how they use AI to improve outcomes and efficiency, with AI questions included in interviews. The requirement supplements, not replaces, traditional criteria, and Santander is similarly seeking advanced AI users for some trainee programs. Morgan Stanley analysts project more than 200,000 European banking jobs could disappear within five years as routine junior work is automated; UBS is also testing analyst avatars for client presentations.

The Decoder·Sep 7, 13:13 UTC · 9d agoAI industry

Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites

Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.

Fortinet identified an August 2026 Casbaneiro banking Trojan campaign targeting users in Argentina, Peru, Colombia, and Mexico through phishing PDFs styled as urgent invoices or legal notices. The staged chain uses IP-based geo-filtering, a Base64-encoded ZIP, an HTA file, and a legitimate AutoIt interpreter before injecting into RegSvcs.exe or mobsync.exe and persisting via a Startup shortcut. The Trojan exfiltrates address book and Outlook data unencrypted, stays dormant until victims visit targeted bank sites, then accepts commands for keyboard control, clipboard pasting, file execution, and command execution. It uses an expected HTTP 403 response from a second server and malformed HTTP requests to complicate network analysis.

Cyber Security News·Sep 14, 08:42 UTC · 2d agoMalware in the wild

HHS Releases Updated Security Risk Assessment Tool

HHS OCR and ONC released version 3.7 of the Security Risk Assessment Tool for healthcare organizations.

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Office of the National Coordinator for Health IT (ONC) released version 3.7 of the Security Risk Assessment (SRA) Tool. The tool helps covered entities conduct HIPAA security risk assessments. ONC and OCR provided guidance on the updates.

DataBreaches.net·Sep 13, 14:49 UTC · 3d agoTools