Financial sector threats in 2026 are being driven by identity abuse

At a glance

What this is: This is Intel 471’s analysis of 2026 financial-sector threats, with the key finding that attackers are increasingly abusing identity, verification, and third-party access rather than relying on pure malware or perimeter attacks.

Why it matters: It matters because IAM, fraud, and security teams need to treat KYC bypass, session theft, and supplier access as one governance problem across human, machine, and service identities.

By the numbers:

• Intel 471 recorded 340 victims in 74 countries in financial services during the reporting period.
• Intel 471 tracked 562 DDoS attacks claimed against the financial sector in the reporting window.
• Initial access brokers advertised unauthorized access impacting 159 financial services entities over the period.

Context

Financial-sector defence now fails at the points where identity, fraud, and access management overlap. Even heavily defended institutions can be reached when attackers use trusted third parties, session token theft, KYC bypass, or social engineering to make legitimate systems accept illegitimate actors.

In this article, the primary question is not whether the sector is targeted, but how adversaries are converting identity proofing gaps, supplier trust, and cloud authentication flows into access. That is a direct IAM and NHI concern because stolen sessions, compromised vendor access, and delegated authentication all behave like unmanaged identities once they are in play.

The attack patterns described here are typical for a regulated sector that has raised baseline security but still carries large trust dependencies across vendors, customer onboarding, and remote support.

Key questions

Q: What breaks when third-party access is not governed in embedded finance?

A: The relationship between business intent and actual access state breaks down. Partners can retain broad or unclear entitlements after the original use case changes, which creates unmanaged exposure across financial workflows, data, and delegated operations. The failure is not only technical. It is governance drift between the contract and the identity record.

Q: Why do stolen MFA codes and session tokens still lead to account takeover?

A: Because authentication success is not the same as session trust. If an attacker captures a valid code, token, or refreshed browser session, they can operate as the user until those artifacts are revoked or bound to stronger context. That is why identity teams must govern session lifetime and token reuse, not just passwords.

Q: What are the signs that an AI vishing call is trying to bypass controls?

A: The main signs are urgency, secrecy, pressure to skip normal verification, and a request to keep the conversation isolated from colleagues. Small voice delays or incomplete knowledge can help, but the strongest warning is any attempt to stop you from using a second channel. That is the point to terminate the call and verify independently.

Q: Should financial institutions prioritise KYC hardening or supplier access governance first?

A: If the article’s patterns are your guide, supplier access governance usually comes first because it closes direct pathways into enterprise systems and customer data. KYC hardening remains essential, but onboarding controls do less for an attacker who already has a trusted vendor foothold or stolen session inside the environment.

Technical breakdown

Third-party access turns supplier trust into an entry path

A third-party compromise becomes a sector-wide problem when downstream organisations inherit the supplier’s trust relationship without equivalent visibility. In these campaigns, attackers used vendor compromise, stolen VPN credentials, and exposed remote access to bypass direct perimeter defences. The mechanism matters because the access path is not always a software exploit; it is often an authenticated relationship that was never tightly scoped, continuously monitored, or revoked fast enough.

Practical implication: classify supplier access as a governed identity surface, not a network exception.

Token theft and MFA capture defeat cloud authentication

Phishing pages that imitate Okta or Microsoft 365 are designed to collect more than passwords. They harvest credentials, MFA codes, and sometimes session tokens, which lets an attacker operate inside the cloud service as if they are the legitimate user. Once a session is stolen, traditional password resets may not remove the attacker if tokens remain valid or if the account has lingering delegated access.

Practical implication: bind cloud access policy to session assurance and token lifecycle, not login success alone.

AI voice agents compress social engineering into a short abuse window

An AI voice agent can industrialise vishing by speaking fluently, following scripts, and cycling through languages at scale. In the Astaroth pattern, the attacker only needed a few minutes to extract a one-time passcode before expiry, which shows how automation narrows the defender’s response window. The technical shift is that social engineering now behaves more like a timed access workflow than a one-off phone scam.

Practical implication: treat real-time voice fraud as an access-control problem with stricter step-up checks and code binding.

Threat narrative

Attacker objective: The attacker’s objective is to turn trusted identity paths into monetisable access for extortion, fraud, disruption, or theft without triggering obvious perimeter alarms.

1. Entry occurred through third-party compromise, vishing, phishing pages, or brokered unauthorized access rather than direct exploitation of the victim network.
2. Credential capture followed through harvested passwords, MFA codes, session tokens, VPN logins, or remote shell access, allowing the actor to act inside trusted environments.
3. Escalation came from using that legitimate access to reach cloud services, corporate data, or downstream customer systems for extortion, fraud, or disruptive campaigns.
4. Impact included data theft, extortion, DDoS disruption, and in some cases large-scale financial loss or access to sensitive institutional environments.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity abuse is now the primary unifying control problem in financial-sector compromise. The article ties together third-party access, vishing, session theft, KYC bypass, and AI-enabled impersonation because attackers are repeatedly finding that identity controls sit at the junction of prevention and exploitation. Financial institutions are not facing one threat class, but a blended access economy where human, supplier, and customer identities can all be turned into entry points. Practitioners should govern those identities as one attack surface rather than as separate teams and tools.

Financial-sector KYC failure is increasingly a trust failure, not a paperwork failure. The report’s examples of deepfake selfies, forged documents, mules, and AI voice agents show that verification is being attacked as a workflow, not as a single checkpoint. That creates a verification trust gap: the control assumes presented evidence maps to a real person, while the attacker now controls the evidence itself. Practitioners should treat onboarding and recovery as adversarial identity flows that require layered assurance, not just stronger forms.

Standing supplier access remains one of the most under-governed paths into regulated environments. When a bank confirms that a breach began with a third-party vendor, the issue is rarely only vendor security; it is the lifecycle and scope of the access that vendor was allowed to hold. This is an NHI governance problem as much as a third-party risk problem because service accounts, remote support tokens, and delegated credentials often outlive the reason they were issued. Practitioners should reduce supplier access to task-bound, reviewable, and revocable entitlements.

AI-enabled fraud is collapsing the gap between social engineering and automation. A voice agent that can sustain a believable call for one to four minutes changes defender expectations about how long an authentication event needs to be protected. The important shift is not novelty but scale: attacker productivity rises while the victim’s validation window stays fixed. Practitioners should design controls for compressed interaction windows, especially where one-time codes, recovery channels, or customer support workflows remain trusted too easily.

Financial-sector defence needs a named concept for blended identity attacks: verification trust gap. This article shows how attackers exploit the space between what a control verifies and what the business assumes it verified. That gap appears in MFA, KYC, supplier onboarding, and support desks when the organisation treats an authenticated interaction as equivalent to a legitimate one. Practitioners should measure controls by what an attacker can still impersonate after the check passes.

What this signals

Verification trust gap: financial institutions should assume that attackers will continue to exploit the space between a control passing and a person, session, or supplier actually being legitimate. The practical response is to govern identity proofing, support workflows, and supplier access as one continuous risk chain rather than separate processes.

The sector’s next governance challenge is not just stronger authentication, but shorter trust lifetimes. Session tokens, vendor access, and recovery pathways should be treated as ephemeral privileges that expire as quickly as the business case for them does.

For practitioners

• Tighten supplier identity lifecycles Map every third-party account, remote support path, and vendor token to an owner, expiry date, and offboarding trigger. Remove any access that cannot be tied to a current business need.
• Harden session and token handling Treat MFA as necessary but not sufficient. Add session binding, token revocation, and conditional access checks so stolen credentials do not automatically become working access.
• Rework recovery and verification workflows Assume forged documents, deepfakes, and mule-assisted verification will pass weak checks. Add challenge layering, out-of-band validation, and fraud review for high-risk onboarding and recovery steps.
• Reduce exposure from customer support channels Constrain call-centre reset and override processes so no single voice interaction can release credentials, bypass MFA, or free a locked account without secondary approval.
• Hunt for brokered access before it becomes extortion Monitor for credential sales, VPN access offers, and RDP or shell listings tied to your sector or suppliers, then prioritise those indicators as likely pre-incident signals.

Key takeaways

• Financial-sector attackers are increasingly winning by abusing identity, verification, and supplier trust rather than by breaking through the perimeter alone.
• The report shows how vishing, session theft, AI voice impersonation, and forged documents combine to defeat controls that look strong when viewed in isolation.
• Practitioners need to govern customer, employee, and third-party identity flows as one attack surface, with tighter lifecycle control and shorter trust windows.

Key terms

• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
• Authentication Token Theft: Authentication token theft is the unauthorized capture and use of a credential that proves a user, service, or agent has already authenticated. Technically, it includes stealing session cookies, bearer tokens, refresh tokens, or API tokens, then replaying them to bypass login controls and impersonate the original identity until the token expires or is revoked.
• Brokered Unauthorized Access: Unauthorized access bought, rented, or sold through an intermediary such as an initial access broker. This turns access into a tradable asset and often gives attackers a working foothold without needing to compromise the target directly.
• AI Vishing: Voice phishing that uses synthetic or cloned speech to impersonate a trusted person and pressure a target into approving an identity action. In practice, it is a social engineering attack against recovery and support workflows, not just against end users.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps security and identity practitioners connect identity lifecycle control to the broader security programme.