Protecting Financial Services From Supply Chain Attacks
How Mudals Managed Security Services helped a financial institution respond to a compromised third party script while protecting customer journeys, banking applications and critical APIs.
The attack started outside the bank
A financial institution used several trusted third party services across its digital banking experience. These included identity verification, credit services, payment processing, customer support and analytics.
One analytics provider was compromised. A malicious JavaScript update was then delivered through the trusted integration and loaded by the bank’s loan application portal.
One compromised integration created multiple risks
The incident moved from a trusted third party component into customer facing applications and backend services.
Third Party Compromise
A trusted analytics provider distributed a malicious JavaScript update.
Customer Data Targeted
The script attempted to capture information entered during loan and card applications.
Sessions Targeted
Stolen session information was used to support automated login and API activity.
Attack Surface Expanded
Attackers moved toward banking applications, APIs and customer facing services.
Malicious Traffic Increased
Automated activity and high volume traffic added another layer of pressure.
The impact could reach far beyond the application
Customer Data Exposure
Sensitive information entered during financial applications could be exposed.
Account Takeover
Stolen session information could support unauthorized access attempts.
Fraud Risk
Attackers could target loan, card and payment workflows.
Service Disruption
High volume malicious requests could affect application availability.
Compliance Pressure
A customer data incident could create additional regulatory obligations.
Trust Impact
A security incident involving financial services can directly affect customer confidence.
Protection was built around the attack
Instead of relying on one security control, Mudals coordinated several layers of protection and continuously tuned them as the attack changed.
Web Application Firewall
Mudals investigated attack events across applications and APIs, then strengthened protection around high value banking endpoints.
Stronger protection against application attacks while keeping legitimate customer traffic flowing.
DoS Protection and Rate Control
Traffic patterns were analyzed and controls were tuned around login, OTP, loan, card and payment services.
Malicious request surges were reduced without depending only on static IP blocking.
Client Reputation
Suspicious traffic from scanners, scrapers, anonymizers and other high risk sources was investigated and correlated with attack behavior.
High risk traffic could be challenged or denied while legitimate customers remained accessible.
IP and Network Lists
Confirmed attacker infrastructure was identified and rapidly added to centralized security lists.
Threat infrastructure could be contained quickly across relevant security controls.
Bot Manager
Automated login attempts, scraping, account enumeration and form abuse were investigated and classified.
Malicious automation was reduced while trusted bots and approved business automation continued.
Bot Manager Premier
More advanced automation was analyzed using behavioral signals, browser integrity and bot risk indicators.
High risk automation could be blocked while medium risk activity received additional checks.
Security decisions were based on real traffic
Mudals continuously reviewed traffic behavior, security events and application patterns before changing policies.
WAF Policy Tuning
Security policies were strengthened around critical customer journeys while legitimate traffic was protected through granular exceptions.
Traffic Analysis
Request behavior was examined across applications and APIs to separate normal customer activity from malicious patterns.
Granular Exceptions
When legitimate traffic was affected, protection was not simply switched off. Exceptions were created around specific application behavior.
Adaptive Bot Protection
Bot policies were continuously adjusted as attacker behavior changed, while trusted automation remained available.
One incident. Multiple layers of protection.
Each stage of the attack was connected to a specific security response so the team could move from detection to containment and continuous optimization.
Security that protects the customer experience
The goal was not simply to block attacks. The goal was to protect important banking services while allowing genuine customers to continue using them.
Faster Containment
Attack indicators were investigated and mitigation policies were adjusted as the incident evolved.
Protected Banking Services
Login, loan, card, payment and API journeys received focused protection.
Reduced False Positives
Application aware tuning helped maintain protection without unnecessarily blocking customers.
Improved Availability
Malicious traffic and application layer attacks were managed while critical services remained accessible.
Adaptive Security
Policies were continuously refined as application behavior and attacker techniques changed.
Operational Support
Mudals provided continuous monitoring, investigation, policy updates and security optimization.
Enterprise security requires continuous attention
Ongoing security operations can require significant engineering effort across policy tuning, monitoring, incident analysis, configuration changes and application support.
Keep security moving as fast as the threat
Mudals helps organizations continuously monitor, investigate, tune and optimize their security environment while protecting the digital experience their customers depend on.
Talk to Our Security Team