AhnLab Report Details August 2026 Malware Trends and Alleged Financial-Sector Data Leaks
Summary
AhnLab’s August 2026 review reports phishing-led malware distribution and multi-stage attacks targeting the financial sector, alongside alleged database, account, and payment-card leaks. Some breach claims could not be verified.
Key points
- Phishing was the leading initial attack stage at 2.1, up from 1.8 the previous month; droppers/downloaders and infostealers declined.
- Phishing accounted for 41.9% of malware types, with downloaders at 17.6% and unclassified malware at 12.1%.
- HTML and script-based files were prominent, with the report noting phishing pages, HTML smuggling, and abuse of legitimate system tools (LOLBins).
- AhnLab identified cases of financial-sector account information leaked to threat actors via the Telegram API; domestic financial accounts represented 3% of the total reported.
- The report describes alleged database leaks involving Alipay and Robinhood users, and a Bank of Baroda database sale claim whose authenticity and scale were unverified.
- Extortion groups including CRPx0, Dysphor1A, and LockBit claimed or listed financial-sector victims; the scale and breach details for some claims remain unverified.
- Posts offered millions of payment-card records for sale on BreachForums and RaidForums, with samples reportedly showing card details and related information.
Article Details
- Publisher
- Asec Ahnlab
- Report Period
- August 2026
- Scope
- Security issues affecting the Korean and global financial sector, including malware distribution, alleged data leaks, and ransomware activity.
- Key Statistics
- Phishing accounted for 41.9% of malware types reported; Downloader accounted for 17.6% and Unclassified for 12.1%.
- HTML was the most common file type at 29.1%; HTML was also the most common file extension at 30.0%.
- Financial-sector accounts leaked via Telegram during August accounted for 3% of the total; the report does not specify the total population.
- A user identified as “mosad” claimed a leak of 820 million Alipay records; the claim was not independently verified in the report.
- CRPx0 claimed to have stolen 2.3 GB of HR data from qnbfinansbank.Com.
Threat Actors
CRPx0Ransomware group reported to have claimed theft of HR data from qnbfinansbank.Com.DYSPHOR1ARansomware group reported to have claimed a data leak related to allianz.Co.Th.LockBitRansomware group reported to have listed usbank.Com as a victim; the breach scale and path were unverified.LockBit 5.0Listed as a ransomware group targeting the financial sector.
Industries
BankingAllianz-Thailand Ayudhya-TH-Insurance Bank-of-Baroda banking Bfpussy BreachForums China credit-card-data-leak Crpx0 Cyprus DarkForums DarkWeb data-breach DLS DYSPHOR1A 멕시코 미국 베네수엘라 딥웹 다크웹 Finance FINANSBANK FinTechFinancial ServicesInsuranceAllianz-Thailand Ayudhya-TH-Insurance Bank-of-Baroda banking Bfpussy BreachForums China credit-card-data-leak Crpx0 Cyprus DarkForums DarkWeb data-breach DLS DYSPHOR1A 멕시코 미국 베네수엘라 딥웹 다크웹 Finance FINANSBANK FinTech