Security Lab · Threat Map
Every attack in this demo is modelled on a documented 2026 Nigerian financial-sector incident. The unprotected app reproduces the breach; the protected app blocks it. Open the Attack Console →
Sterling Bank (Mar 2026)
- What happened
- Oracle WebLogic middleware auth-bypass; PII for 900,000+ customers exfiltrated.
- In this demo
- SQLi login bypass · BFLA admin export · BOLA profile read (BVN).
- Nemesis defense
- Application Shield blocks auth bypass, cross-tenant reads and bulk PII/credential export.
Remita (Apr 2026)
- What happened
- Cloud misconfiguration exposed ~3TB: KYC docs, DB dumps, source, HSM keys, 35k+ password hashes.
- In this demo
- Exposed backup / secrets endpoint (env, DB creds, HSM ref, MD5 hashes).
- Nemesis defense
- Access to a backup / secrets artifact is off-baseline and blocked.
FCMB (2026)
- What happened
- API exploitation siphoned ₦677M of a ₦3.5B fraudulent attempt.
- In this demo
- Mass assignment (self-promote) · money-logic (negative / over-balance) · SSRF import.
- Nemesis defense
- Privileged-field writes, malformed amounts and server-side egress are blocked; Omniguard scores movement.
Insider + mule accounts (NIBSS 2024-25)
- What happened
- Staff-registered BVNs on mule accounts; ~₦1.1bn cycled; NIP instant-payment fraud +603%.
- In this demo
- Transfer ₦1.5m to a flagged mule account on the irreversible NIP rail.
- Nemesis defense
- Omniguard beneficiary / mule intelligence declines the push before it settles.
Zenith Bank (Aug 2026)
- What happened
- Database breach exposed customer PII (emails, phones); phishing wave followed.
- In this demo
- BOLA profile harvest · stored XSS (phishing payload persisted for staff/customers).
- Nemesis defense
- Cross-tenant PII reads and stored script payloads are blocked.
Card-testing / e-commerce fraud
- What happened
- Stolen-card BIN probing and checkout fraud across POS / web channels.
- In this demo
- ₦100 probe on a card-testing BIN; device velocity + impossible travel.
- Nemesis defense
- Omniguard BIN intelligence + velocity declines the probe; browser SDK guards the card field.
CVE-2025-29927 · Next.js middleware bypass
- What happened
- A crafted x-middleware-subrequest header skips Next.js middleware entirely on vulnerable versions (< 15.2.3). Vercel blocks hosting the vulnerable version; self-hosted banks running it are exposed.
- In this demo
- Fire the bypass header at the middleware Shield. This app runs a patched Next, so the header is rejected.
- Nemesis defense
- Defense-in-depth: the SQLi route guard + Omniguard enforce in-app, so security never depends on one middleware hook.