Year in Review: The Top 6 Cyber Attacks That Targeted Financial Firms in 2025

The financial sector remains one of the key targets for cyberattacks due to direct financial gain, sensitive data, and access to their interconnected systems. According to CrowdStrike’s 2025 Threat Hunting Report, financial services were still among the top targets in 2025.

With the rise of AI, attacks have become more sophisticated than ever, which calls for even more robust systems to defend against them. In this article, I’ll walk you through some of the most common attacks financial firms faced in 2025.

The goal is to help leaders and other key stakeholders in finance understand which threats to prioritize in their 2026 security strategy. Some of these attacks will feel familiar, while others caught many organizations off guard. With that said, let’s get started.

#1: AI-Powered Deepfake Fraud (The New Major Threat)

2025 has clearly been the year of AI, and attackers have actively taken advantage of the growing availability of AI tools to make their attacks even harder to detect. Unsurprisingly, one of the most significant attacks in 2025 targeting has been AI-powered deepfake fraud.

Attackers are no longer focused only on stealing usernames and passwords; instead they are now impersonating real people to authorize transactions. By using advanced AI tools, criminals can now clone the voices and faces of senior executives and use them in live video calls.

A widely reported incident involved a multinational company in Hong Kong that lost $25 million after an employee joined a video meeting where every other participant was a deepfake of their colleagues.

Beyond internal fraud, AI-powered are also being used to bypass biometric security. High-quality face swaps and voice clones have successfully defeated Know Your Customer (KYC) checks at banks and crypto exchanges.

#2: “Encryption-Less” Ransomware

For many years, ransomware attacks were mainly known for encrypting data and demanding payment so victims could regain access. However in 2025, ransomware attacks have evolved with many groups moving away from traditional file encryption.

Instead of locking organizations out of their systems, attackers now focus on stealing sensitive data and using it as leverage. This data extortion approach involves quietly exfiltrating financial records, customer information, and internal documents, then threatening to publish the data if a ransom is not paid.

By skipping the encryption step, attackers reduce noise and remain undetected for longer periods, increasing the pressure on victims. Groups such as RansomHub and Qilin have been particularly active this year, deliberately targeting financial firms because of the high value and sensitivity of their data.

For many organizations, this shift has made backups less effective as a sole defense, since the primary risk is now data exposure rather than system downtime.

#3: AI-Enhanced Social Engineering

Social engineering and phishing attacks became far more effective in 2025 due to the use of AI. Phishing is no longer generic or poorly written, making it harder to spot.

Attackers now use AI tools to create highly personalized and convincing messages tailored to specific individuals and organizations.

One major example is vishing (voice phishing), where attackers use AI-generated voice clones to call employees of financial firms while posing as IT support staff or internal fraud teams. These calls often trick employees into revealing one-time passwords or multi-factor authentication codes.

Email-based phishing has also become much harder to detect. AI enables attackers to write flawless, context-aware emails that reference real internal projects, recent meetings, or company events, removing the spelling mistakes and odd phrasing that once served as warning signs.

As a result, even experienced staff have found it difficult to distinguish legitimate communications from malicious ones.

#4: Mobile Banking and App Malware

In 2025, almost every adult (mainly in developed countries) uses some form of mobile banking, and attackers are increasingly taking advantage of this shift. Attackers are now using malware targeting mobile banking applications and smartphones became.

They mainly use malicious apps and trojanized software to steal login credentials, capture one-time passwords, or silently intercept transactions in real time. A real-world example of this trend in 2025 is the Albiriox Android banking malware.

Researchers discovered that Albiriox targeted more than 400 financial, banking, payment, and crypto apps worldwide. Once installed, this malware gives attackers remote control of infected smartphones, allowing them to initiate transactions directly from the victim’s device.

Mobile malware apps such as Albiriox are commonly distributed through social engineering campaigns that mimic legitimate app stores or trusted brands.

#5: Supply Chain Compromise

As attackers realize that financial firms’ defenses are becoming stronger year after year, they are now increasingly choosing to exploit weaknesses in third-party vendors instead of targeting the firms directly.

They are now targeting software providers, HR platforms, payroll processors, and cloud service vendors of financial firms. This vendor-hopping technique allows attackers to breach a smaller and less secure organization and then pivot into the networks of major financial firms.

Several high-profile incidents highlighted this risk, including data breaches at Evolve Bank & Trust and Prudential Financial in late 2024 and 2025. In both cases, these attacks were traced back to vulnerabilities in third-party systems.

#6: Distributed Denial of Service (DDoS) Attacks

As in previous years, DDoS attacks remained a persistent threat to financial firms throughout 2025. In these attacks, the criminals overwhelm online banking platforms, payment systems, or customer portals with massive volumes of traffic, making services unavailable to legitimate users.

Attackers often time these campaigns to coincide with peak business hours, major financial events, or periods of high customer activity to maximize disruption. While DDoS attacks may not always result in data breaches, they can cause significant operational downtime, customer frustration, and reputational damage.

It is important to note that in some cases, DDoS attacks are also used as a distraction to divert security teams’ attention while other, more targeted attacks are carried out in parallel.

My Take on These Cyber Attacks

Even though many of the attacks seen in 2025 may look similar to those from previous years, it is clear that attackers have changed how they execute them. For example, phishing is still common, but it is now far more precise and effective due to the use of AI tools like ChatGPT.

The same shift applies to ransomware attacks, which are increasingly focused on exfiltrating sensitive data and demanding a ransom, rather than encrypting systems.

As we move into 2026, it is important for financial firms to rethink their security strategies and account for these new attack techniques. This may require a modest increase in security budgets to support more robust solutions capable of addressing modern threats.

Firms must also strengthen their monitoring capabilities and stay aware of emerging attack methods, as cybercriminals continue to evolve their tactics.

If your firm needs support in keeping up with these threats, RFA can serve as your cybersecurity partner.

Our teams bring decades of experience and can audit your environment, recommend effective security improvements, and implement solutions to help you stay ahead of modern attacks. Contact us today to learn more.