An Israeli spyware operation posed as a digital advertising firm while targeting Al Jazeera journalists’ devices. The campaign used that cover to help deliver spyware to media workers.
5:05 PMAl Jazeera13 stories from 7 sources
AI Security Consolidates as Zero-Click Spyware Spreads
Day’s Recap
Supporting Articles
Targeted advertisements delivered exploits that infected devices without requiring victims to click or interact with them. The incident is likely the first confirmed case of mercenary spyware being distributed through targeted ads.
4:32 PMArs Technica
A Citizen Lab investigation says an Israeli advertising-technology firm helped deliver spyware through advertisements, infecting dozens of devices used by Al Jazeera personnel. The operation allegedly used ad infrastructure as the route for malware deployment.
12:32 PMAl Jazeera
Researchers at Citizen Lab and Confiant say an Israeli ad tech company worked with spyware vendors to infect devices through online advertisements, including devices used at Al Jazeera. They identified technical evidence of a zero-click attack, in which users do not need to click or interact with an ad for exploitation to occur.
10:10 AMThe Verge
Proofpoint plans to acquire Varonis Systems for $6.3 billion, combining Proofpoint's human and agent cybersecurity products with Varonis's data and AI security capabilities. The deal is intended to create a large pure-play cybersecurity company focused on protecting data and AI systems.
9:48 PMPYMNTS
The article argues that AI is making cybersecurity attacks faster, more persistent, and more expensive to counter. Citing Bank of England Deputy Governor Sarah Breeden, it says organizations may increasingly compete based on how long they can sustain investment in defense.
8:36 PMPYMNTS
Bank of England Deputy Governor Sarah Breeden warned that advances in artificial intelligence have made AI-powered cyberattacks a systemic risk to the global financial system. She said banks cannot assume their existing defenses make them immune.
2:58 PMPYMNTS
Bank of America assigned 3,000 employees and 1,000 contractors to fix software vulnerabilities identified by Anthropic's Mythos and other frontier AI models. The contractors were added in the second quarter and remain on the effort, according to the report.
10:39 AMPYMNTS5:05 PMAl Jazeera
Israeli ‘ad’ firm helped infect spyware into Al Jazeera devices
Summary
An Israeli spyware operation posed as a digital advertising firm while targeting Al Jazeera journalists’ devices. The campaign used that cover to help deliver spyware to media workers.
The operation blurred the line between commercial advertising infrastructure and offensive cyber activity. Journalists face
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Spyware disguised as advertising expands the attack surface for journalists and makes malicious targeting harder to identify.
4:32 PMArs Technica
Targeted ads delivered 0-click exploits to install mercenary malware
Summary
Targeted advertisements delivered exploits that infected devices without requiring victims to click or interact with them. The incident is likely the first confirmed case of mercenary spyware being distributed through targeted ads.
The decisive shift is that ad delivery became the infection mechanism, while victims had no
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Zero-click attacks delivered through targeted advertising can compromise high-value users at scale without relying on phishing or user error.
12:32 PMAl Jazeera
Israeli ad-tech firm helped place spyware on Al Jazeera devices
Summary
A Citizen Lab investigation says an Israeli advertising-technology firm helped deliver spyware through advertisements, infecting dozens of devices used by Al Jazeera personnel. The operation allegedly used ad infrastructure as the route for malware deployment.
The decisive fact is that malicious advertising allegedly turned a routine media channel into a
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Spyware delivered through ads can compromise targets without requiring them to open a suspicious message or install a conspicuously malicious app.
10:10 AMThe Verge
An Israeli firm is sending spyware through online ads, researchers say
Summary
Researchers at Citizen Lab and Confiant say an Israeli ad tech company worked with spyware vendors to infect devices through online advertisements, including devices used at Al Jazeera. They identified technical evidence of a zero-click attack, in which users do not need to click or interact with an ad for exploitation to occur.
Malvertising is becoming a delivery channel for commercial spyware, turning ordinary ad exposure into a
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
A routine web activity can now deliver sophisticated spyware without user action, raising the security stakes for anyone handling sensitive communications.
2 stories · 2 sources
9:48 PMPYMNTS
Proofpoint Plans to Buy Varonis For $6.3 Billion to Combat AI Risks
Summary
Proofpoint plans to acquire Varonis Systems for $6.3 billion, combining Proofpoint's human and agent cybersecurity products with Varonis's data and AI security capabilities. The deal is intended to create a large pure-play cybersecurity company focused on protecting data and AI systems.
The acquisition would shift Proofpoint from primarily human-centered security toward a broader platform covering users,
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Security vendors are consolidating around the data and AI controls enterprises will need as autonomous systems expand.
8:36 PMPYMNTS
The ‘C’ in CFO Now Stands for Cybersecurity, Thanks to AI
Summary
The article argues that AI is making cybersecurity attacks faster, more persistent, and more expensive to counter. Citing Bank of England Deputy Governor Sarah Breeden, it says organizations may increasingly compete based on how long they can sustain investment in defense.
AI is turning cybersecurity from a technical risk into a financial endurance test, making budgets
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI is moving cybersecurity into the CFO's core mandate because resilience now depends on sustained financial capacity.
2:58 PMPYMNTS
BoE Warns Banks Against AI Cybersecurity Risks
Summary
Bank of England Deputy Governor Sarah Breeden warned that advances in artificial intelligence have made AI-powered cyberattacks a systemic risk to the global financial system. She said banks cannot assume their existing defenses make them immune.
The risk has shifted from isolated attacks to a potential threat to financial stability. Banks
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
A successful AI-enabled attack on one major lender could disrupt confidence and expose weaknesses across interconnected financial institutions.
10:39 AMPYMNTS
Bank of America Deploys 4,000 Workers to Patch Vulnerabilities Found by Frontier AI
Summary
Bank of America assigned 3,000 employees and 1,000 contractors to fix software vulnerabilities identified by Anthropic's Mythos and other frontier AI models. The contractors were added in the second quarter and remain on the effort, according to the report.
Frontier AI is moving from a security research tool into a labor-intensive vulnerability discovery engine.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI-assisted vulnerability discovery could expose more flaws than companies can quickly repair, forcing banks to expand secure engineering teams and processes.
Other Developments
A curated list of other prominent stories from this day.
A new project estimates the research effort devoted to analyzing major public-key cryptographic assumptions by classifying roughly 16,000 papers and mapping authors to estimated research years. Its preliminary measure suggests lattice cryptanalysis has only recently surpassed elliptic-curve cryptanalysis, while warning that publication-based estimates may overstate actual effort.
12:24 PMSchneier on Security
Cohere plans to acquire AISLE, which develops autonomous systems that identify and repair vulnerabilities in critical software. Cohere said the deal reflects the growing security demands that arise as enterprises move AI systems from experimentation into production.
10:17 AMPYMNTSNew Zealand's central bank and financial markets regulator have outlined supervisory expectations for managing cyber risks linked to frontier AI. The guidance addresses how financial firms should assess and control risks as advanced AI systems enter critical operations.
10:12 AMFinextra
The Eiliko robot connects over Wi-Fi and sends conversations with its AI companion to servers in China. That means users, including children, may be sharing sensitive information with a remote service whose data practices and security they cannot directly control.
7:00 AMThe Verge12:24 PMSchneier on Security
Measuring Human Cryptanalysis Effort
Summary
A new project estimates the research effort devoted to analyzing major public-key cryptographic assumptions by classifying roughly 16,000 papers and mapping authors to estimated research years. Its preliminary measure suggests lattice cryptanalysis has only recently surpassed elliptic-curve cryptanalysis, while warning that publication-based estimates may overstate actual effort.
The key shift is methodological: cryptographic confidence is being compared through accumulated human scrutiny rather
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Security assumptions backed by more sustained, independent analysis may deserve greater confidence, but the ranking depends heavily on how research effort is counted.
10:17 AMPYMNTS
AI Startup Cohere Moves to Acquire Cybersecurity Firm AISLE
Summary
Cohere plans to acquire AISLE, which develops autonomous systems that identify and repair vulnerabilities in critical software. Cohere said the deal reflects the growing security demands that arise as enterprises move AI systems from experimentation into production.
The acquisition would give Cohere in-house capabilities for automated vulnerability detection and remediation, rather than
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI providers are beginning to buy security capabilities directly, making vulnerability management part of the enterprise AI product stack.
10:12 AMFinextra
New Zealand regulators set out cyber and AI risk expectations
Summary
New Zealand's central bank and financial markets regulator have outlined supervisory expectations for managing cyber risks linked to frontier AI. The guidance addresses how financial firms should assess and control risks as advanced AI systems enter critical operations.
The shift is from treating AI as an emerging technology issue to supervising it as
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Financial firms must now treat frontier AI governance as part of their core cybersecurity and operational resilience obligations.
7:00 AMThe Verge
Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked
Summary
The Eiliko robot connects over Wi-Fi and sends conversations with its AI companion to servers in China. That means users, including children, may be sharing sensitive information with a remote service whose data practices and security they cannot directly control.
The central risk is not the toy's appearance but its cloud architecture: ordinary conversations become
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Connected toys can turn private family conversations into persistent, externally hosted data without users fully understanding the tradeoff.
Make it yours
Build Your First Pass.
Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!