8 stories from 6 sources
Supporting Articles
The US is offering up to $10 million for information on the operators behind an ongoing campaign targeting Signal and WhatsApp. The activity is attributed to two Russia state-linked groups and has reportedly persisted since at least March.
6:05 PMArs TechnicaThe FBI is warning Microsoft 365 users about Kali365, a phishing campaign designed to defeat or bypass passwordless authentication. The scam uses convincing lures and authentication prompts to capture access and take over accounts.
11:20 AMAirguide InfoResearchers identified a class of weak RSA keys where the modulus is unusually sparse, containing many zero bits in structured patterns. A large number of these keys appear in real-world datasets pulled from Certificate Transparency logs, internet-wide TLS and SSH scans, and PGP key collections.
12:05 PMSchneier on SecuritySummary
The US is offering up to $10 million for information on the operators behind an ongoing campaign targeting Signal and WhatsApp. The activity is attributed to two Russia state-linked groups and has reportedly persisted since at least March.
Why it matters
A large reward signals the US is prioritizing disruption of a sustained messaging-platform intrusion campaign, raising stakes for both operators and high-risk users.
Summary
The FBI is warning Microsoft 365 users about Kali365, a phishing campaign designed to defeat or bypass passwordless authentication. The scam uses convincing lures and authentication prompts to capture access and take over accounts.
Why it matters
Passwordless reduces password risk, but it does not stop attackers from stealing sessions and approvals, so defenders need new controls and telemetry.
Summary
Researchers identified a class of weak RSA keys where the modulus is unusually sparse, containing many zero bits in structured patterns. A large number of these keys appear in real-world datasets pulled from Certificate Transparency logs, internet-wide TLS and SSH scans, and PGP key collections.
Why it matters
If weak RSA keys are both detectable and common, attackers can turn global key inventories into a prioritized compromise list.
A curated list of other prominent stories from this day.
Mastercard unveiled a pan-African, multiyear initiative to strengthen cyber resilience across Africa. The program is positioned as a coordinated effort to improve capabilities and readiness across the region.
8:01 PMFinextraMphasis has joined the Microsoft Intelligent Security Association, aligning its security offerings with Microsoft Security products. The membership positions Mphasis as a partner that can deliver integrated solutions to help customers respond to rising cyber threats.
4:56 PMFinextraPhotos and parts lists reportedly tied to the iPhone 18 Pro appeared on the dark web after a breach at a key Apple supplier. The material includes imagery of a device undergoing drop testing and details on components.
4:18 PMThe VergeWultra raised €6.8 million in a Series A round to expand its post-quantum authentication and digital identity products for banks and fintechs. The company positions the funding as fuel to scale deployments and product development as financial institutions prepare for stronger identity and authentication requirements.
8:10 AMFinextraCompanies are deploying AI agents to run procurement end to end, from supplier outreach to purchase orders and payments. Suppliers typically cannot verify whether the ordering agent is legitimate, authorized, or impersonating a real buyer.
4:00 AMPYMNTSSummary
Mastercard unveiled a pan-African, multiyear initiative to strengthen cyber resilience across Africa. The program is positioned as a coordinated effort to improve capabilities and readiness across the region.
Why it matters
Africa's digital payments growth is outpacing security maturity, and a major network is trying to shape the continent's cyber baseline.
Summary
Mphasis has joined the Microsoft Intelligent Security Association, aligning its security offerings with Microsoft Security products. The membership positions Mphasis as a partner that can deliver integrated solutions to help customers respond to rising cyber threats.
Why it matters
Security buyers are standardizing on integrated ecosystems, and MISA membership can directly influence which service providers win Microsoft-heavy accounts.
Summary
Photos and parts lists reportedly tied to the iPhone 18 Pro appeared on the dark web after a breach at a key Apple supplier. The material includes imagery of a device undergoing drop testing and details on components.
Why it matters
Supply chain breaches turn product secrets into tradable assets and can force expensive security and process changes across an entire manufacturing network.
Summary
Wultra raised €6.8 million in a Series A round to expand its post-quantum authentication and digital identity products for banks and fintechs. The company positions the funding as fuel to scale deployments and product development as financial institutions prepare for stronger identity and authentication requirements.
Why it matters
Identity and authentication sit on the critical path for fraud reduction and future-proofing against post-quantum cryptographic risk in financial services.
Summary
Companies are deploying AI agents to run procurement end to end, from supplier outreach to purchase orders and payments. Suppliers typically cannot verify whether the ordering agent is legitimate, authorized, or impersonating a real buyer.
Why it matters
If businesses cannot prove who an agent is and what it is allowed to do, automated commerce will scale fraud faster than it scales efficiency.
Make it yours
Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!