Security Issues in the Korean & Global Financial Sector in June 2026

In June the financial sector saw multi-stage attacks led by phishing (stage 1) that used HTML attachments and links, droppers/downloaders in stage 2 to retrieve additional payloads, and infostealers in stage 3 to harvest account data. HTML-based phishing pages, HTML smuggling, and script-based attachments (html, js, vbe, vbs, bat, hta) were prominent; Korean-language lures mimicked business documents to increase trust. Cases of account information exfiltrated via the Telegram API accounted for ~5% of domestic financial-sector leaks. Dark web activity included large database leaks (e.g., Canada Life, Robinhood, Prudential) and ransomware/data-extortion claims (LAPSUS$, MORPHEUS, Qilin), plus marketplaces selling access credentials and stolen financial/customer data.