Bank fraud is now a supply chain: what a new threat report shows

According to Intel 471, the biggest threats to banks in 2026 are not coming through the front door. They are coming through vendors, voice calls and forged documents built to pass identity checks rather than break them.

The report, called Follow the Money: Cyber Threats to the Financial Sector, is based on monitoring of closed-access forums, data leak sites, marketplaces and Telegram groups, backed by human intelligence gathered between January 2025 and June 2026. It tracks named threat actors, specific incidents and the underground marketplaces that sell access to financial institutions and the tools to defraud their customers.

What the incidents have in common

Two U.S.-based banks were breached in April 2026 by a group called Everest, which runs a data extortion service. Both banks confirmed the breach did not come from their own networks being hacked directly. It came through a third-party vendor. A U.K.-based payments and commerce company was claimed as a victim by the CLOP group in January 2026, a group with a history of hitting one widely used enterprise product and catching every downstream customer of that product at once.

Separately, a group called BlackFile ran voice phishing campaigns against U.S. hedge funds and investment managers in early 2026. Callers posed as IT support staff and walked employees to fake login pages built to look like Okta or Microsoft 365. The pages were built to capture passwords, session tokens and multi-factor codes in one pass, which is enough to get into cloud services without ever needing to guess a password.

The pattern underneath the incidents

None of these break-ins required defeating a bank's own defenses. Each one found a weaker link connected to the bank instead: a vendor, a shared piece of enterprise software, an employee on a phone call. The report also documents a separate underground economy built around the same idea applied to individual customers rather than institutions, stolen identities sold already packaged with financial profiles, document forgery paired with mules who complete the verification step in person, and AI voice tools built to sound like a bank's own IT desk.

What connects the enterprise breaches and the consumer-facing fraud is the same move: attackers do not try to look legitimate from scratch, they attach themselves to something already trusted, a vendor relationship, a login portal, a verification process, and ride it in.

Why this is the kind of pattern worth watching for

Individually, a vendor breach, a vishing call and a forged document look like separate problems. Lined up together, they show fraud increasingly built around trust relationships rather than technical weak points. That is the kind of pattern Flggd watches for across consumer-facing scams, not just enterprise breaches. Spotting it early depends on tracking these underground marketplaces and actor groups over time rather than reacting to each incident on its own.