Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentication entirely. That makes the choice of an intelligence vendor in this space an operational decision, not a box-checking exercise. 

Top 10 Infostealer Intelligence Vendors 

1. Cyble

Cyble is a preferred vendor for organizations that want infostealer data inside a broader threat intelligence workflow rather than as a standalone feed. Its Cyble Vision platform combines compromised credential monitoring with dark web surveillance, brand protection, and attack surface management, so a leaked employee login can be connected to related exposure elsewhere.   The company's research arm, Cyble Research and Intelligence Labs, publishes regular analysis of new stealer families and campaigns. For teams that need context across several threat categories in a single console, Cyble is a strong starting point. Buyers focused narrowly on deep machine-level forensics should test that capability directly during a trial.

2. Flare

Flare is a full CTI platform that treats stealer logs as a core dataset rather than an add-on. Its interface is one of the cleanest in the category, which lowers the learning curve for analysts. Coverage of stealer logs is broad, and the platform provides solid details about infected machines.

3. SpyCloud

SpyCloud focuses on identity threat protection and is particularly strong on session data. It tracks stolen cookies and helps organizations invalidate compromised sessions before attackers can use them. That focus makes it a natural fit for teams worried about MFA bypass. Its free public tooling is more limited than some competitors'.

4. Breachsense

Breachsense takes an API-first approach to dark web and stealer-log monitoring. Its backend is consistent and well-documented, which appeals to teams that plan to pipe alerts directly into a SIEM or SOAR rather than work in a vendor's dashboard.

5. Lunar (Webz.io)

Lunar is built on Webz.io's web data infrastructure and stands out for generous free access to compromised-credential monitoring. Smaller organizations can get meaningful visibility without a large contract. Its API is less mature than those of the leaders, so heavy integration work may take more effort.

6. SOCRadar

SOCRadar positions itself as an extended threat intelligence provider, and its infostealer data sits alongside external attack surface monitoring and digital risk protection. Machine context is a notable strength. Teams looking for a specialist tool may find the platform's breadth more than they need.

7. Constella Intelligence

Constella approaches infostealers through the lens of identity risk, drawing on a large repository of breach and exposure records. Session tracking and API capabilities are both well regarded, which makes it useful for fraud prevention and account takeover defense.

8. Recorded Future

Recorded Future is one of the best-known names in threat intelligence. Infostealer data is one module among many in its intelligence platform. Machine context and API quality are strong, though session-level detail trails the more focused vendors. Organizations already using Recorded Future for other intelligence may find it convenient to extend coverage here.

9. NordStellar

NordStellar comes from Nord Security, the company behind NordVPN. It has gained ground quickly, with strong session coverage and good machine context. It is a relatively new entrant, so buyers should weigh its fast development pace against a shorter track record.

10. KELA

KELA specializes in cybercrime intelligence gathered from underground forums and marketplaces. Its infostealer coverage benefits from that vantage point, and session tracking is solid. Machine context and API depth are moderate compared with the vendors ranked above it. 

What Buyers Should Take Away 

No single vendor wins on every measure. Teams that want infostealer intelligence connected to wider threat monitoring will find Cyble, Flare, and SOCRadar worth a close look. Those focused on stopping account takeover should prioritize session capabilities, where SpyCloud, Constella, and NordStellar perform well. Engineering-heavy teams should put API quality near the top of their criteria, which favors Breachsense and Recorded Future.  Whatever the shortlist, two capabilities deserve extra weight. The first is session coverage, because cookie theft is now a routine way to defeat MFA. The second is machine context, because knowing exactly which device was compromised determines how quickly a team can contain the damage. A trial run against a known set of exposed accounts remains the most reliable way to see how a vendor performs in practice.  (Disclaimer: This article is based on third-party research and publicly available information, credited where applicable. The Cyber Express does not endorse any product or service mentioned. Readers are advised to verify information independently and consult qualified professionals before acting on it.)

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

A text alert about an undelivered package or an unpaid toll may look like a one-off scam. A new Microsoft cybercrime crackdown shows it is often the visible end of a much larger operation. Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and improve operational resilience, have moved to dismantle three services, YAM Store, CoGUI and Iron Man, that supplied criminals worldwide with accounts, hosting and tools to build fake websites and online identities. Since January 2026, the three services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were aimed at Microsoft customers alone. Consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries were targeted, generating tens of millions of dollars for the operators.

How the Microsoft Cybercrime Crackdown Began

The investigation started in late 2025 after Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. The NPA continued providing intelligence and investigative support throughout the probe as partners traced those campaigns back to the businesses supplying criminals around the world. Investigators expected to find individual campaigns. Instead, they traced the activity to a sprawling Chinese-language marketplace that was difficult for non-native-speaking investigators to penetrate. The probe widened to include the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Drawing on its network of more than 130 member organizations, JC3 linked what appeared to be separate incidents into a broader pattern of scams against Japanese companies and financial institutions. Health-ISAC provided insight into the impact on healthcare organizations.

What the Microsoft Cybercrime Crackdown Uncovered

YAM Store operated much like an online shop. Customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts along with ready-made scam tools, including those used for credential theft. Controlled purchases by Microsoft helped confirm how it worked. In some cases, operators bought internet domains that legitimate organizations had allowed to expire, often in sectors such as non-profits and education, with specialized product offerings for those sectors. They rebuilt the websites to make those organizations appear active, then used them to fraudulently obtain Microsoft 365 accounts for resale. The infrastructure sold through YAM Store was frequently paired with CoGUI. This service supplied ready-made websites and messages impersonating companies, banks, government agencies and other trusted organizations. Rather than build fraudulent sites themselves, criminals could quickly deploy pages designed to steal passwords, payment details and personal data. CoGUI became one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the United States. [caption id="attachment_114817" align="aligncenter" width="600"] Image Source: https://blogs.microsoft.com/[/caption] By mid-2026, CoGUI was increasingly being replaced by Iron Man, which offered thousands of phishing templates tailored to specific brands, industries and countries. Criminals could use them to quickly deploy email, text and web content. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across more than 150 countries. Others mimicked airlines, telecommunications companies and parcel delivery services. Some were built for government impersonation scams, using the look of official authority to pressure victims into paying or sharing sensitive information. Microsoft noted that an organization appearing in these templates does not mean its systems were compromised.

Court Order Backs Microsoft Cybercrime Crackdown

Acting on an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that formed part of the infrastructure behind the three services. Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud, while removing infrastructure hosted on its services. Microsoft also shared intelligence with the U.S. Secret Service and international law enforcement partners. Investigators used AI tools to connect accounts, websites and infrastructure that initially appeared unrelated. The case reflects a trend highlighted in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that help criminals reach more victims. No single organization saw the full picture of this transnational cybercrime network, and uncovering it required two-way information sharing across industries and borders. YAM Store, CoGUI and Iron Man are only part of a larger criminal ecosystem. Still, the Microsoft cybercrime crackdown makes it harder for criminals to obtain the accounts, tools and infrastructure that keep scam messages flowing. Microsoft Threat Intelligence has published a blog with further details on the network and steps customers can take to protect themselves.

A new Kerala Police MoU will bring threat intelligence into cybercrime investigations in the state. Cyble, an AI-native cybersecurity company, has signed a three-year Memorandum of Understanding with Kerala Police that covers intelligence support, investigative assistance and capacity building. The agreement was signed through Cyble's Indian subsidiary, Cyble Infosec India Private Limited. It will support the Kerala Police Cyber Operations wing and Cyberdome in identifying and investigating emerging cyber threats. The announcement was made on October 12, 2026.

Why the Kerala Police MoU Focuses on Threat Intelligence

According to Cyble, cybercriminals increasingly use underground online forums and illicit marketplaces to trade stolen credentials, distribute leaked data, coordinate ransomware operations and facilitate fraud. Identifying these activities before they cause harm requires timely intelligence and effective collaboration between technology providers and law enforcement agencies. [caption id="attachment_114716" align="aligncenter" width="600"] Image Source: Cyble[/caption]

What MoU Covers

Under the MoU, Cyble will support Kerala Police with intelligence relevant to cybercrime investigations. This includes compromised credentials, ransomware activity, data leaks, phishing and fraud infrastructure, and the impersonation of government and police brands. The collaboration has three other parts:

• No-cost evaluation access to select Cyble platforms.
• Training for police officers in open-source intelligence (OSINT) and dark web investigations.
• Joint research into emerging threats such as AI-enabled fraud, deepfakes, mule account networks and investment scams.

Public awareness initiatives will also form part of the collaboration. “Effective cybercrime investigations require timely intelligence, especially when criminal activity originates across borders and moves through hidden online networks,” said Beenu Arora, Co-Founder and CEO of Cyble. “Kerala Police has taken a proactive approach to cyber policing through Cyberdome. Through this collaboration, we aim to help investigators access relevant threat intelligence, strengthen their investigative capabilities, and better understand emerging threats targeting citizens and institutions.” Ankit Asokan, IPS, Kerala Police, said: “Cybercrime investigations increasingly require access to timely intelligence on threats that may originate beyond conventional online channels. This collaboration will support Cyberdome and our officers with relevant intelligence, strengthen investigative capabilities, and contribute to efforts to protect citizens from evolving cyber threats.”

Aim of the Kerala Police MoU

The MoU reflects a shared focus on strengthening cybercrime response through collaboration, intelligence sharing and knowledge development. By combining Cyble's threat intelligence capabilities with Kerala Police's investigative expertise, the partnership aims to support more informed investigations and improve awareness of emerging cyber risks. Cyble describes itself as an AI-native cybersecurity company that helps governments and enterprises identify, prioritize and respond to cyber threats. It is headquartered in Cupertino, California, and serves customers globally, with offices in regions including Australia, Malaysia, Singapore, the Middle East and India.

This weekly roundup covers a stark small-business cyberattack report out of the UK, a hardware flaw exposing Nintendo Switch owners to nearby attackers, the largest known seizure of AI deepfake porn websites, a candid conversation on AI's role in offensive security, new US legislation targeting elder fraud, and a fresh national threat-intelligence partnership in the UAE.  From consumer hardware to national policy, this week's developments show that exposure isn't limited to large enterprises or nation-state targets — small businesses, individual console owners, and everyday victims of fraud and non-consensual imagery are all squarely in scope, even as governments and industry move to close the gaps. 

The Cyber Express Weekly Roundup 

UK Small Businesses Face Higher Cyberattack Rates Than Global Peers, Hiscox Report Finds 

UK small firms are being hit by cyberattacks at a rate well above the global average, according to Hiscox's 10th annual Cyber Readiness Report. The survey of nearly 7,000 smaller businesses worldwide, including 1,000 in the UK, found that 38% of UK firms suffered a successful attack in the past year, compared with a 29% global average — the highest rate among all markets surveyed. Read more… 

Cyble Signs MOU with UAE Cyber Security Council to Boost National Threat Intelligence 

Cyble, an AI-native cybersecurity firm, has signed a Memorandum of Understanding with the UAE's Cyber Security Council to strengthen the country's national threat intelligence capabilities. Announced in Abu Dhabi in September 2026, the agreement centers on delivering advanced threat intelligence, early warning capabilities, and insights into emerging cyber risks facing government and critical infrastructure entities across the UAE. Read more… 

Nintendo Switch Flaw Let Nearby Attackers Run Code, Steal Data 

Nintendo has patched a flaw in the original Switch that let nearby attackers hijack its QR-code-based "Send to Smartphone" feature to run unauthorized code or steal data, including account information stored on the console. Tracked as CVE-2026-82079, the bug affected consoles on firmware older than version 23.0.0; the Switch 2 is unaffected. Read more… 

Manhattan D.A. Seizes 12 Deepfake Porn Websites in Largest Known Takedown of Its Kind 

The Manhattan District Attorney's Office has seized 12 websites allegedly used to create, sell, and distribute AI-generated deepfake pornography targeting roughly 1,200 real people without their consent. Announced by D.A. Alvin L. Bragg Jr., it's described as the largest known seizure of AI-generated celebrity deepfake websites to date, and the investigation is ongoing. Read more… 

Rahul Singh Choudhary on AI's Growing Role in Cryptanalysis and Offensive Security 

In the latest episode of Security Pill Season 2.0, The Cyber Express interviewed cybersecurity analyst Rahul Singh Choudhary about how AI is reshaping cryptanalysis, vulnerability research, and penetration testing. The conversation opens with a key question: has AI moved from merely assisting security research to actively participating in it — particularly around the cryptographic assumptions underpinning wallets, exchanges, and smart contracts? Read more… 

US House Passes GUARD Act to Boost Law Enforcement Fight Against Elder Fraud, Crypto Scams 

The U.S. House of Representatives has passed the bipartisan GUARD Act (H.R. 2978) on September 15, 2026, aimed at strengthening law enforcement's ability to combat elder financial fraud and cryptocurrency scams. Co-led by Representatives Josh Gottheimer, Zachary Nunn, and Scott Fitzgerald, the bill now heads to the Senate. Read more… 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk — from small UK businesses absorbing a disproportionate share of attacks, to a hardware-level flaw putting console owners at physical-proximity risk, to AI tools being weaponized for non-consensual imagery at unprecedented scale.   Meanwhile, policy responses are accelerating on multiple fronts: US lawmakers are moving to arm local investigators against crypto-enabled elder fraud, and the UAE is deepening its national threat-intelligence posture through public-private partnership.  Taken together, the stories point to a widening gap between the speed of exploitation — whether by scammers, deepfake operators, or nearby attackers exploiting hardware — and the pace of institutional response, even as that response visibly picks up. 

💾

Cyble, a global AI-native cybersecurity company, has signed a Memorandum of Understanding (MOU) with the Cyber Security Council of the United Arab Emirates to strengthen national threat intelligence capabilities. The agreement was announced in Abu Dhabi in September 2026 and formalizes a strategic collaboration between Cyble and the federal entity responsible for strengthening the UAE's cybersecurity posture.

The MOU marks a significant milestone in Cyble's engagement with the UAE's national cybersecurity ecosystem, bringing together a global cybersecurity provider and a national authority tasked with protecting the country's digital environment.

Focus on National Threat Intelligence

The MOU establishes a framework for Cyble to support the Council's mission of protecting the UAE's digital infrastructure. The collaboration centers on delivering advanced threat intelligence, early warning capabilities, and actionable insights into emerging cyber risks facing government and critical infrastructure entities across the country. These focus areas are intended to help the Council anticipate and respond to threats before they escalate into significant incidents.

The partnership reflects the UAE's continued commitment to building a resilient, forward-looking cybersecurity posture at the national level. It also positions Cyble as a trusted technology partner in that effort.

By working closely with the Council, Cyble aims to strengthen visibility into threat actors, malicious campaigns, and vulnerabilities that could affect the UAE's most critical systems and services. This visibility is expected to support the Council's broader objective of maintaining a secure and stable digital environment for government and critical infrastructure operators.

Leadership Statements on the MOU

Beenu Arora, CEO and Co-Founder of Cyble, described the agreement as more than a routine partnership announcement. He called it a strategic validation of Cyble's capabilities at the national cybersecurity level and a potential gateway to the UAE government and critical infrastructure ecosystem. This is not just a partnership announcement. It is a strategic validation of Cyble's capabilities at the national cybersecurity level and potentially a gateway to the UAE government and critical-infrastructure ecosystem," said Arora.

Arora added that working alongside the Cyber Security Council underscores the trust placed in Cyble's threat intelligence platform and reflects the growing importance of proactive, intelligence led defense in protecting nations against increasingly sophisticated cyber threats.

Dr. Mohamed Al Kuwaiti, Chairman of the Cyber Security Council of the United Arab Emirates, said the Council is committed to building strategic partnerships with world class technology providers that strengthen the UAE's cyber resilience at every level. He noted that the MOU with Cyble reflects a shared commitment to safeguarding the nation's digital infrastructure through advanced threat intelligence and proactive, intelligence led defense, ensuring the UAE remains at the forefront of global cybersecurity readiness.

"This MOU with Cyble reflects our shared commitment to safeguarding the nation's digital infrastructure through advanced threat intelligence and proactive, intelligence-led defense — ensuring the UAE remains at the forefront of global cybersecurity readiness," said Dr. Mohamed Al Kuwaiti.

The agreement builds on Cyble's broader strategy of deepening engagement with government and regulatory bodies across the Middle East. It reinforces the company's position as a trusted partner to national cybersecurity authorities navigating an increasingly complex threat landscape, and it adds to a growing list of engagements between Cyble and public sector organizations in the region.

Role of Cyble Vision and Blaze AI

Cyble Vision, the company's threat intelligence platform powered by Blaze AI, will play a central role in the collaboration. The platform is designed to deliver rapid detection, automated analysis, and contextual insights into ransomware, phishing, fraud, and other evolving threats relevant to national security priorities. Through this platform, Cyble intends to provide the Council with tools that support faster identification and analysis of threats targeting the UAE's digital infrastructure.

Cyble is a global, AI-native cybersecurity company specializing in threat intelligence, digital risk protection, and dark web monitoring. Its flagship platform, Cyble Vision, powered by Blaze AI, delivers rapid threat detection, automated analysis, and contextual insights into ransomware, phishing, and fraud.

Media Contacts: enquiries@cyble.com | +1 678 379 3241 | www.cyble.com

At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country.

The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at the University of Toronto and by Amnesty International's Security Lab.

Citizen Lab, in its own findings, said it verified an infection with NSO Group's Pegasus on the iPhone of a student activist who asked not to be named. High-confidence infection indicators span December 2025 through January 2026, delivered by a zero-click iMessage exploit that required no interaction from the target. Apple has since patched the underlying flaw; the fix shipped in iOS 18.4.1. Pegasus grants an operator access to notes, photographs and messages decrypted on the device, and can silently activate the microphone and camera.

Amnesty's Security Lab confirmed a new variant of NoviSpy, an Android implant first identified in Serbia in 2024, on two additional devices. SHARE said the rebuilt version was designed to evade the detection methods that exposed its predecessor.

Also read: Investigative Journalists in Serbia Hit by Advanced Spyware Attack

The circumstances of two infections are what elevate the findings beyond routine spyware reporting. SHARE said one NoviSpy infection appeared after police seized a student's phone during questioning, and another after private messages from that device were published by a pro-government media outlet. Donncha Ó Cearbhaill, who heads Amnesty's Security Lab, said the evidence suggests "infections are being carried out during detention by Serbian authorities."

Suspicion centers on Serbia's Security Information Agency, or BIA. Amnesty's December 2024 report "A Digital Prison" found earlier NoviSpy samples configured to send collected data to IP addresses associated with BIA servers, and documented the agency's parallel use of Cellebrite extraction tools on journalists and activists. In March 2025, Amnesty reported that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus.

The current cases surfaced through Apple's threat notification wave of Aug. 13, which reached users in 110 countries. The timing is politically loaded. The targeting overlaps with protests that followed the November 2024 collapse of a railway station canopy in Novi Sad, spans local elections held March 29 in 10 municipalities, and precedes October parliamentary elections widely read as a test of the ruling Serbian Progressive Party.

Ana Toskic Cvetinovic, a legal expert cited in the reporting, noted that deploying intrusive software without judicial authorization is unlawful under Serbian law. SHARE published an analysis of the domestic legal framework in January arguing the same. Criminal complaints filed over the 2024 cases remain pending before Serbian courts, with no resolution.

Also read: 7 New Pegasus Infections Found on Media and Activists’ Devices in the EU

NSO has been on the U.S. Commerce Department's Entity List since 2021.

Serbia is an accession candidate, the European Parliament has previously questioned the Commission over unlawful spyware use in the country, and the Commission published its 2026 enlargement country report in July. Amnesty's submission for that package raised surveillance directly.

Both groups urged at-risk users to enable Lockdown Mode on iOS or Advanced Protection on Android.

A cyberattack on Wall Street recently targeted several leading hedge funds, including Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel. The attackers used voice phishing, or "vishing," to trick employees into revealing sensitive information or granting access to internal systems.  Cybersecurity experts say such attempts are common because financial institutions store highly sensitive data. However, the latest incidents highlight how cybercriminals are increasingly combining traditional social engineering tactics with artificial intelligence to make impersonation attempts more convincing. 

Point72 Says No Client Data Was Compromised 

According to reports, Point72 Asset Management informed investors on August 5 that it had been targeted in the latest cyberattack on Wall Street. Bloomberg first reported the communication, citing a source familiar with the matter.  The firm said it was reviewing the incident and that no client information had been stolen. Point72 declined to comment publicly.  The campaign extended beyond Point72, with hackers also attempting to breach the information systems of Millennium Management, Two Sigma Investments, and Citadel, according to sources. 

Voice Phishing Remains an Effective Attack Method 

The attackers relied on voice phishing, a social engineering technique in which criminals impersonate trusted individuals—often IT support staff—to persuade employees to disclose confidential information or provide system access.  Cybersecurity experts told Reuters that these attacks are routine because of the valuable information held by financial firms. Rather than exploiting software vulnerabilities, voice phishing succeeds by manipulating human behaviour.  The tactic has also been used successfully by the cybercriminal group "Scattered Spider," a loosely organized network of young hackers that has targeted numerous companies in recent years. 

AI Is Increasing the Sophistication of Cyberattacks 

Security experts say the attempted cyberattack on Wall Street demonstrates how artificial intelligence is making social engineering campaigns more persuasive and difficult to detect.  A similar trend was highlighted in June, when Google's cybersecurity unit published a report detailing a campaign targeting U.S. law firms and other professional and financial services organizations.   According to the report, attackers posed as IT support personnel through voice phishing calls and, in some cases, even visited offices while pretending to be IT maintenance staff. 

Growing Cyber Risks for Financial Firms 

The attempted cyberattack on Wall Street comes as organizations worldwide face a rise in AI-powered cyberattacks and ransomware incidents that disrupt operations and steal sensitive data.  In response to the growing threat, the White House announced a working group earlier this year that brings together AI developers and critical infrastructure operators to share threat intelligence and strengthen cyber defenses.  Although Point72 said no customer information was compromised, the attempted attacks on several prominent hedge funds underscore the persistent cybersecurity risks facing the financial sector and the increasing use of AI-enhanced social engineering by threat actors.