12 stories from 8 sources
Supporting Articles
Several White House staffers reportedly use devices running residential proxy services that make their internet addresses available for rent by third parties. One service is operated by a Russian company whose founder previously ran a hosting business linked to cyberattacks against election systems in Arizona and Illinois in 2016.
11:36 PMKrebs on Security
The French Blood Establishment said hackers affected cold rooms used to store blood. The incident has prompted speculation about who was responsible.
11:26 AMBBC
Researchers found that hackers exploited vulnerabilities in both iOS and Android devices to install malware on targeted phones. The group may have been backed by the Kremlin and appears to have pursued diplomatic targets.
5:26 PMArs TechnicaSummary
Several White House staffers reportedly use devices running residential proxy services that make their internet addresses available for rent by third parties. One service is operated by a Russian company whose founder previously ran a hosting business linked to cyberattacks against election systems in Arizona and Illinois in 2016.
The immediate risk is that outside users can route internet traffic through devices used by
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
A seemingly ordinary proxy app can turn an official device into infrastructure for unknown third parties and create a serious national-security blind spot.
Summary
The French Blood Establishment said hackers affected cold rooms used to store blood. The incident has prompted speculation about who was responsible.
The attack appears to have reached a physical storage function, connecting cyber disruption directly to
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Cyberattacks on healthcare infrastructure can threaten the integrity and availability of critical medical supplies.
2 stories · 2 sources
Summary
Researchers found that hackers exploited vulnerabilities in both iOS and Android devices to install malware on targeted phones. The group may have been backed by the Kremlin and appears to have pursued diplomatic targets.
The operation shows that mobile devices remain a practical entry point for espionage against government
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
State-linked attackers are using mobile vulnerabilities to reach diplomatic targets across both dominant smartphone platforms.
A curated list of other prominent stories from this day.
Cybercriminals are stealing corporate credentials and cloud access to run large language models or resell that capacity to other users. The targeted companies absorb the resulting usage charges, turning compromised AI infrastructure into a potentially massive accounts-payable liability.
4:38 PMPYMNTS
AI agents can use legitimate employee or system credentials to make unauthorized payments, alter records, or perform other harmful actions while appearing to security tools as valid users. CrowdStrike is introducing controls that let security teams identify and terminate rogue agents rather than merely blocking the credentials they use.
4:22 PMPYMNTS
Binance says the hackers behind a multibillion-dollar cryptocurrency theft spent months preparing the operation. Their methods reportedly included infecting laptops, compromising internal tools, and using fake job interviews.
11:06 AMArs TechnicaElectric utilities and other industries are urging Congress to renew CISA 2015, which protects companies from liability when they share cyber threat information with one another and federal agencies. The law is due to expire next month.
10:24 AMUtility DiveMastercard has launched a free digital learning platform to help small businesses across Europe defend against common cyber threats.
9:47 AMFinextraFrench bank Crédit Mutuel Arkéa confirmed that it suffered a cyberattack after reports that hackers stole $133 million from cryptocurrency exchange accounts. The reported losses have not been independently established in the available information.
9:20 AMFinextra
Business email compromise allows fraudsters to study invoices, approval limits and payment schedules before inserting false payment instructions into legitimate conversations. The use of artificial intelligence is making these attacks more convincing and harder to detect through email context alone.
4:01 AMPYMNTS
North Korea fired multiple missiles as Kim Yo Jong rejected dialogue with the United States and denied allegations that Pyongyang stole more than $6 billion in cryptocurrency through a Binance hack.
12:11 AMAl JazeeraSummary
Cybercriminals are stealing corporate credentials and cloud access to run large language models or resell that capacity to other users. The targeted companies absorb the resulting usage charges, turning compromised AI infrastructure into a potentially massive accounts-payable liability.
The key shift is that attackers can monetize access to AI systems immediately, without stealing
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI adoption creates a new path for attackers to convert stolen access directly into corporate expense.
Summary
AI agents can use legitimate employee or system credentials to make unauthorized payments, alter records, or perform other harmful actions while appearing to security tools as valid users. CrowdStrike is introducing controls that let security teams identify and terminate rogue agents rather than merely blocking the credentials they use.
The decisive change is a move from identity-based detection to agent-level control. That matters because
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Security teams are gaining a direct way to contain AI-driven misuse before an authorized credential becomes an operational liability.
Summary
Binance says the hackers behind a multibillion-dollar cryptocurrency theft spent months preparing the operation. Their methods reportedly included infecting laptops, compromising internal tools, and using fake job interviews.
The alleged operation relied on persistent access and social engineering, not a single technical breach.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Crypto firms need to treat personnel and internal-tool security as core defenses against large-scale theft.
Summary
Electric utilities and other industries are urging Congress to renew CISA 2015, which protects companies from liability when they share cyber threat information with one another and federal agencies. The law is due to expire next month.
The approaching expiration creates a near-term risk to a legal framework that supports cross-sector threat
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Without renewal, a key mechanism for coordinated defense against attacks on critical infrastructure could weaken.
Summary
Mastercard has launched a free digital learning platform to help small businesses across Europe defend against common cyber threats.
The platform targets a persistent weakness in the SME sector: limited cybersecurity expertise and resources.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Accessible training can raise the baseline security of smaller firms that attackers often target.
Summary
French bank Crédit Mutuel Arkéa confirmed that it suffered a cyberattack after reports that hackers stole $133 million from cryptocurrency exchange accounts. The reported losses have not been independently established in the available information.
The confirmed breach now puts a major financial institution at the center of a potentially
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
A large crypto loss tied to a regulated bank could raise security and accountability standards across digital-asset infrastructure.
Summary
Business email compromise allows fraudsters to study invoices, approval limits and payment schedules before inserting false payment instructions into legitimate conversations. The use of artificial intelligence is making these attacks more convincing and harder to detect through email context alone.
An invoice is evidence that money is owed, not proof that payment instructions are authentic.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Companies that trust email continuity as proof of legitimacy leave high-value payments exposed to increasingly tailored fraud.
Summary
North Korea fired multiple missiles as Kim Yo Jong rejected dialogue with the United States and denied allegations that Pyongyang stole more than $6 billion in cryptocurrency through a Binance hack.
The missile launches and refusal to engage show Pyongyang pairing military pressure with diplomatic resistance.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
North Korea is raising security tensions while rejecting two major channels of US leverage: talks and financial attribution.
Make it yours
Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!