Security Issues in the Korean & Global Financial Sector in May 2026

May 2026 reporting for the Korean and global financial sector highlights an increased phishing-driven initial access trend and active distribution of droppers, backdoors, and infostealers, along with notable ransomware double-extortion incidents and multiple large database/credit-card data leaks posted or sold on dark web forums and dedicated leak sites; the report also documents sale of corporate access credentials, exfiltration to Telegram channels, and concentrations of malicious attachments and script-based extensions that indicate active exploitation and use of LOLBins.