FlagThis — Daily Cybersecurity Intelligence Briefing

A new wave of AI-orchestrated phishing campaigns is targeting the global financial sector, utilizing Large Language Models (LLMs) and deepfake synthesis to bypass legacy security perimeters. Attackers are deploying high-velocity automation, executing campaigns at an observed rate of one attack every 19 seconds. Technical vectors include Device Code Phishing designed to hijack OAuth authentication flows, AI-generated malware tailored for financial environments, and sophisticated brand impersonation that evades linguistic-based spam filters. This paradigm shift from manual templates to high-fidelity, automated social engineering significantly increases the success rates of Business Email Compromise (BEC) and session hijacking.

Threat actors are leveraging Large Language Models (LLMs) to automate hyper-personalized phishing campaigns, targeting the global financial sector with unprecedented velocity. By utilizing AI-driven reconnaissance and LLM-generated lures, attackers are successfully evading traditional keyword-based and template-matching detection mechanisms. This transition from bulk spam to automated precision targeting facilitates Business Email Compromise (BEC) 2.0 through deepfake audio/video assets and AI-optimized malware variants designed to bypass behavioral heuristics. The current attack velocity has reached one attempt every 19 seconds, significantly increasing the operational cost of defense for financial institutions despite improved SOC response speeds.

In early July 2026, River Bank & Trust, a subsidiary of River Financial Corp, suffered a ransomware attack resulting in the exfiltration of sensitive customer financial records. The threat actor gained unauthorized access to the network, leading to material operational disruption. River Financial Corp formally disclosed the breach via an SEC Form 8-K, identifying the incident as a material event. While the specific ransomware strain remains unidentified in initial disclosures, the breach involved unauthorized access logs and the theft of PII and financial data, triggering immediate regulatory scrutiny and multiple class-action lawsuits regarding data negligence.