Fraudsters targeting credit unions aren’t breaking in. They’re walking through the front door using stolen identities, exploited processes, and borrowed trust, and your cybersecurity posture probably wasn’t built to stop that.

A recent analysis from Flare puts it plainly: structured loan fraud against credit unions relies on passing legitimate verification steps, not bypassing them. Meanwhile, Progress Software just patched a critical authentication bypass in MOVEit Automation (CVE-2026-4670) that could hand attackers administrative control before a single alarm fires. The thread connecting these two stories is the same one that runs through almost every breach: attackers go where the controls are soft, whether that’s a biometric check, a file transfer portal, or a loan officer’s inbox.

The Fraud Model That Skips the Firewall

Credit union fraud isn’t a hacking problem. It’s a process problem dressed up to look like one.

Flare’s research describes how criminals use stolen personal data to impersonate real members, clear identity verification, and then walk away with loan funds. No brute-force. No exploit. No packet captures needed. The attacker exploits the gaps between steps, where one system trusts the output of another without independent validation.

This is a harder problem than patching a CVE, because the vulnerability lives in a business workflow, not a line of code. Financial institutions often layer identity checks at onboarding and then progressively relax them as a relationship ages. Fraudsters know this. They’re patient enough to build a synthetic profile that survives the first round of scrutiny, then push harder once they’ve established a foothold inside the institution’s trust model.

The cybersecurity parallel is exact. Attackers do the same thing with compromised credentials, OAuth tokens, and API keys: get past the gate once, then operate freely inside. The defensive answer in both cases is the same: stop treating initial verification as a permanent clearance.

MOVEit Is Back, and the Auth Bypass Is Critical

Progress Software patched CVE-2026-4670 in MOVEit Automation this week. The vulnerability is an authentication bypass, meaning an unauthenticated attacker can reach functionality that should be locked behind a login. A second flaw, CVE-2026-5174, enables privilege escalation once access is gained. Both were reported privately by Airbus researchers, and there’s no confirmed exploitation in the wild, but if MOVEit’s recent history tells you anything, the window between “no known exploitation” and “actively ransomed” can be brutally short.

MOVEit Transfer has been a ransomware group favorite for years. MOVEit Automation sits in the same product family and handles the same sensitive file-movement workflows. If you’re running it and haven’t applied the patch, you’re betting that the threat actors who turned MOVEit Transfer into a mass-exploitation event haven’t noticed this one yet.

That’s not a bet worth making.

What You Can Actually Do This Week

Both the fraud story and the MOVEit disclosure point toward the same defensive posture: don’t let a single verification event carry the weight of your entire security model. Here’s where to focus your effort:

• Patch MOVEit Automation immediately. Progress rates CVE-2026-4670 as critical. Upgrade to a fixed version and verify the upgrade succeeded. Don’t wait for a CAB meeting.
• Review what MOVEit-adjacent accounts can reach. Authentication bypass flaws matter most when the authenticated surface includes admin functions, file access, and outbound transfer scheduling. Audit those permissions now, not after an incident.
• Segment file transfer infrastructure from internal networks. MOVEit-class tools should not have flat access to backend systems. If yours does, put a compensating control in place while the patch is applied.
• Apply continuous verification to high-value workflows. Whether it’s a loan approval or a privileged API call, one-time authentication isn’t enough. Step-up authentication, behavioral anomaly detection, and transaction velocity checks all reduce the blast radius when an identity is compromised.
• Map your incident response plan to business process abuse, not just technical indicators. If your IR runbooks only trigger on SIEM alerts, you’ll miss fraud-style attacks that never generate a firewall log.

The Silver Fox APT story this week is worth a mention here too. The China-backed group sent over 1,600 socially engineered messages across India and Russia, deploying a new backdoor called ABCDoor and the ValleyRAT remote access tool. Tax-themed lures. Targeted sectors. The initial access phase was entirely social, and the payload followed only after the human layer failed. Threat detection that stops at the perimeter misses the entire first half of that attack chain.

Defense in depth, done properly, means applying friction at every layer, including the human one. Security awareness training, rigorous help desk verification, and behavioral controls on your business processes all belong in the same conversation as firewall rules and patch management.

Frequently Asked Questions

What is CVE-2026-4670 and how severe is it?

CVE-2026-4670 is a critical authentication bypass in Progress Software’s MOVEit Automation product. An unauthenticated attacker can potentially gain administrative control and access sensitive data. Progress has released a patch and strongly advises upgrading immediately.

How do fraudsters pass identity verification at credit unions?

Structured loan fraud typically uses stolen or synthetic identity data that satisfies verification checks designed for legitimate customers. The attacker doesn’t hack the system; they present credentials that pass the process as designed, exploiting gaps between verification steps rather than any technical flaw.

What does defense in depth mean for business process security?

Defense in depth applied to business processes means not relying on a single verification event to grant ongoing access or trust. It includes continuous behavioral monitoring, transaction anomaly detection, step-up authentication for high-risk actions, and incident response plans that account for process-level abuse, not just technical intrusions.

Does Silver Fox APT pose a broad threat or is it targeted?

Silver Fox is currently focused on organizations in India and Russia across multiple sectors, using tax-themed social engineering to deliver malware. While the campaign is targeted, the lure techniques and ABCDoor backdoor are documented and can inform defensive controls for any organization facing spear-phishing risk.

Sources

• They don’t hack, they borrow: How fraudsters target credit unions – BleepingComputer
• Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670) – Help Net Security
• Silver Fox Springs Tax-Themed Attacks on Orgs in India, Russia – Dark Reading