First Pass

8 stories from 6 sources

Messaging attacks and authentication gaps dominated cybersecurity concerns

Day’s Recap

Supporting Articles

6:05 PMArs Technica

US offers $10 million for info on group behind Signal and WhatsApp hacking spree

Summary

The US is offering up to $10 million for information on the operators behind an ongoing campaign targeting Signal and WhatsApp. The activity is attributed to two Russia state-linked groups and has reportedly persisted since at least March.

Why it matters

A large reward signals the US is prioritizing disruption of a sustained messaging-platform intrusion campaign, raising stakes for both operators and high-risk users.

Link to Story
11:20 AMAirguide Info

FBI Warns Microsoft 365 Users About Kali365 Phishing Scam

Summary

The FBI is warning Microsoft 365 users about Kali365, a phishing campaign designed to defeat or bypass passwordless authentication. The scam uses convincing lures and authentication prompts to capture access and take over accounts.

Why it matters

Passwordless reduces password risk, but it does not stop attackers from stealing sessions and approvals, so defenders need new controls and telemetry.

Link to Story
12:05 PMSchneier on Security

Factoring RSA Keys with Many Zeros

Summary

Researchers identified a class of weak RSA keys where the modulus is unusually sparse, containing many zero bits in structured patterns. A large number of these keys appear in real-world datasets pulled from Certificate Transparency logs, internet-wide TLS and SSH scans, and PGP key collections.

Why it matters

If weak RSA keys are both detectable and common, attackers can turn global key inventories into a prioritized compromise list.

Link to Story

Other Developments

A curated list of other prominent stories from this day.

8:01 PMFinextra

Mastercard launches Africa Cybersecurity Centre of Excellence

Summary

Mastercard unveiled a pan-African, multiyear initiative to strengthen cyber resilience across Africa. The program is positioned as a coordinated effort to improve capabilities and readiness across the region.

Why it matters

Africa's digital payments growth is outpacing security maturity, and a major network is trying to shape the continent's cyber baseline.

Link to Story
4:56 PMFinextra

Mphasis joins Microsoft Intelligent Security Association

Summary

Mphasis has joined the Microsoft Intelligent Security Association, aligning its security offerings with Microsoft Security products. The membership positions Mphasis as a partner that can deliver integrated solutions to help customers respond to rising cyber threats.

Why it matters

Security buyers are standardizing on integrated ecosystems, and MISA membership can directly influence which service providers win Microsoft-heavy accounts.

Link to Story
4:18 PMThe Verge

Leaked iPhone 18 Pro photos reportedly wound up on the dark web

Summary

Photos and parts lists reportedly tied to the iPhone 18 Pro appeared on the dark web after a breach at a key Apple supplier. The material includes imagery of a device undergoing drop testing and details on components.

Why it matters

Supply chain breaches turn product secrets into tradable assets and can force expensive security and process changes across an entire manufacturing network.

Link to Story
8:10 AMFinextra

Digital ID provider Wultra raises $7.75m in funding round

Summary

Wultra raised €6.8 million in a Series A round to expand its post-quantum authentication and digital identity products for banks and fintechs. The company positions the funding as fuel to scale deployments and product development as financial institutions prepare for stronger identity and authentication requirements.

Why it matters

Identity and authentication sit on the critical path for fraud reduction and future-proofing against post-quantum cryptographic risk in financial services.

Link to Story
4:00 AMPYMNTS

Why It’s Time to Know Your Agent

Summary

Companies are deploying AI agents to run procurement end to end, from supplier outreach to purchase orders and payments. Suppliers typically cannot verify whether the ordering agent is legitimate, authorized, or impersonating a real buyer.

Why it matters

If businesses cannot prove who an agent is and what it is allowed to do, automated commerce will scale fraud faster than it scales efficiency.

Link to Story

Make it yours

Build Your First Pass.

Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!