A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey.

The attacker is taking advantage of a new capability Microsoft opened to administrators in May, allowing them to run “passkey registration campaigns” to entice users to enrol passkeys for more secure authentication.

The campaign has been running since April and involves calling targeted users and trying to convince them to register a new passkey under the attacker’s control.

To mask the deception, the hacker directs victims to a phishing kit that imitates the legitimate Microsoft passkey enrollment process.

Cloud-based identity and access management (IAM) company Okta attributes the activity to an actor it tracks as O-UNC-066, which operates an extortion operation known as Pink.

Okta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.

The security upgrade ruse

During the campaign, targeted employees are contacted by phone under the pretext that they must enroll a new Microsoft Entra passkey for security reasons and are directed to phishing URLs that contain the word “passkey” in the domain name.

The malicious websites include the victim organization’s branding and mimic the real Entra passkey enrollment portal.

Unlike the more common adversary-in-the-middle (AiTM) proxy, the kit is an operator-controlled PHP panel in which the attacker guides the victim through the phishing process in real time, adapting the flow based on the multi-factor authentication (MFA) method used.

“[The phishing kit] is an operator-controlled PHP panel in which a threat actor steers victims through various stages of authentication in close to real-time using a 1-second heartbeat polling mechanism,” explains Okta.

“The operator can use the kit to adapt the user experience to each victim’s MFA requirements (TOTP, push notification with number matching, SMS OTP) during the session.”

Credentials and MFA responses entered by the victim in the kit’s screens are relayed to the operator, who uses them to authenticate to the victim’s Microsoft account.

While the victim believes they are registering a new passkey on their accounts, the attacker is actually registering a passkey they control.

After gaining access, the phishing site presents the victim with fake Microsoft-branded passkey registration pages, prompting them to save a fake BIP-39 recovery phrase and confirm one word from it.

Okta notes that BIP-39 seed phrases don’t have any role in legitimate Microsoft Entra passkey enrollment, but could serve as a distraction for users who are unfamiliar with the process.

Pink extortion gang

According to Palo Alto Networks Unit 42, Pink is a new extortion brand affiliated with the decentralized threat network known as The Com (short for The Community).

The threat actor is known for using vishing (voice phishing) and IT impersonation to collect credentials and multi-factor authentication (MFA) codes, which are used in attacks that steal company data.

The Pink threat group launched an extortion site on May 31, where they publish samples of the stolen data to pressure compromised victims into paying a ransom.

Researchers say that after gaining access to a victim’s account, Pink moves quickly to exfiltrate data from SharePoint and OneDrive services.

Brad Duncan, Principal Threat Researcher at Palo Alto Networks Unit 42, noted in early June that some of the phishing domains used by Pink included the word “passkey.”

Okta recommends that organizations establish methods to better verify the identity of helpdesk personnel when contacting users, as well as deny requests from locations where the company does not offer services.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

A judge has approved a $1.5 million penalty levied against Elon Musk that will settle a U.S. Securities and Exchange Commission lawsuit despite having “significant misgivings” about it.

U.S. District Judge Sparkle Sooknanan noted that her court would accept the settlement, Bloomberg reported Wednesday, which cited her court opinion.

Sooknanan’s approval settles a lawsuit filed by the SEC against Musk in early 2025 over how the billionaire handled his takeover of Twitter. The lawsuit, which was filed only days before Donald Trump took office, revolved around Musk’s failure to disclose to public investors, in a timely manner, his growing stake in the company in 2022.

The fact that Musk did not initially disclose his stake “ultimately saved him a whopping $150 million,” the SEC argued.

In May, Musk reached a settlement with the SEC that stipulated a trust in Musk’s name would be responsible for paying a $1.5 million penalty without admitting wrongdoing.

Sooknanan previously questioned whether Musk was receiving “special treatment” from the Trump administration. Musk helped to bankroll Trump’s campaign during the 2024 presidential race.

In her opinion, Sooknanan noted that her court was “limited to evaluating whether the proposed consent judgment meets minimum standards of fairness and reasonableness,” or whether it “make[s] a mockery of judicial power.”

“Although the Court has significant misgivings about the settlement reached in this case, it cannot say that
the settlement meets that high threshold,” Sooknanan wrote.

Even without previous smash hits “Severance” and “The Studio” airing episodes in the eligibility period, Apple TV has still gathered the most nominations it has ever earned across all of the major categories at the 78th annual Emmy Awards.

In 2025, Apple TV won a record-breaking 22 Emmy Awards, with “Severance” and “The Studio” leading the way. For 2026, neither of those shows were eligible, but a host of new Apple ones were and have been rewarded with nominations.

The Television Academy’s awards cover an enormous range of categories, with more technical ones split off into the Creative Arts Emmys, and the Engineering, Science & Technology ones. In all, Apple TV has scored 89 nominations, versus 79 in 2025.

Many of the nominations span the most prestigious acting categories. Apple’s shows are up for:

• Best Actor in a Comedy Series: Jason Segel for “Shrinking”
• Best Actor in a Comedy Series: Matthew Rhys for “Widow’s Bay”
• Best Actor in a Drama Series: Gary Oldman for “Slow Horses”
• Best Actress in a Comedy Series: Elle Fanning for “Margo’s Got Money Troubles”
• Best Actress in a Drama Series: Rhea Seehorn for “Pluribus”

On top of those, Apple TV shows have scored multiple nominations in the highest profile categories:

• Best Comedy Series: “Margo’s Got Money Troubles,” “Shrinking,” and “Widow’s Bay”
• Best Drama Series: “Pluribus,” “Slow Horses,” and “Your Friends & Neighbours”

This is the first year that the Television Academy has announced all of its Emmy nominees at the same time. Previously the organization has separated the announcements for the main and Creative Arts Emmys.

The organizers say that this is so promotional campaigns, such as the famous “For Your Consideration,” can start immediately with all of the nominations.

As ever, though, the award winners will be announced separately. The Television Academy has confirmed that its main ceremony will be on September 14, 2026, and hosted by Mariska Hargitay.

Apple is not the leader in nominations. HBO Max gathered 122, and both Disney’s combined brands and Netflix accumulated 111 each. Amazon and MGM+ gathered 39, with Paramount+ and Showtime combined getting a total of two.

The Creative Arts Emmys will be announced over two nights, September 5, and September 6.

NATO is building a vast AI network along its eastern flank, designed to spot an attack early and strike back fast. The plan is called the Eastern Flank Deterrence Initiative, and internal documents name one adversary outright: Russia.

German tabloid BILD obtained the papers and shared them through the Axel Springer network, Business Insider reported.

The documents keep returning to one phrase: a “Kill Web”. It describes a tightly linked digital mesh that ties together satellites, reconnaissance drones, radar, ground sensors and cameras. If one node drops out, another takes over.

The network watches the whole border at once, from Finland down to Romania.

See first, decide first, strike first

The idea is to shrink the time between spotting a target and hitting it. In the past, a drone would flag a target to headquarters. Analysts checked it, then passed a firing order down the chain. That took time NATO no longer wants to lose.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Under the new model, data from every member flows into one shared picture. Palantir’s Maven Smart System acts as the AI brain, sorting sensor feeds so commanders can decide faster. Other contractors plug in around it, including RTX, Rheinmetall, Saab, Lockheed Martin and Boeing.

NATO sums the loop up in six words: “See first. Decide first. Strike first.”

In practice, a drone might catch a Russian armoured column. The system cross-checks it against satellite images, radar and ground sensors at once. A commander then picks the weapon, be it a drone, artillery or a rocket launcher, by range and by the target’s value.

Machines take the first hit

The front line changes too. NATO wants uncrewed systems to meet an attacker before its soldiers do. A forward zone of drones, ground robots and sensors would absorb the first blow. The logic is cold but simple: machines, not troops, take the opening hit.

Tanks and jets do not go away. Leopard 2s, Abrams, HIMARS and F-35s stay the backbone. “EFDI does not replace tanks, artillery, fighter aircraft, or soldiers,” said Maj. Matt Blubaugh, a spokesman for US Army Europe and Africa. “It is designed to help preserve their combat power and give commanders more time and decision advantage.”

Lessons from Ukraine

The concept comes straight from the war in Ukraine. Cheap drones, robots and sensors, fielded in their thousands, aim to offset Russia’s edge in sheer numbers and speed. It echoes the kill chains both sides built on that battlefield, now stretched across an entire alliance.

It also fits a wider European push. NATO has been funding defence startups and folding autonomous ground systems into its plans, even as who controls the underlying AI stays a live question.

Why it matters

NATO calls the strategy “deterrence by denial”. The aim is not just to repel Russia, but to make an attack look pointless before it starts. It marks a real shift, from holding ground with troops to contesting it first with software and machines. The hard part is trust: an alliance that hands early decisions to AI has to be sure the machines read the battlefield right.

Self-driving company Waymo added four more cities where it will service riders: Denver, San Diego, Las Vegas and Tampa. Waymo’s parent company, Alphabet, announced the expansion on Wednesday. 

Waymo’s robotaxi service is currently available in big US cities such as San Francisco, San Antonio, Orlando, Phoenix and many others. Since rolling out Waymo’s self-driving cars, Alphabet has relied on electronic vehicles that use AI to detect objects under distinct weather conditions. Its fleet is predominantly the fully electric Jaguar I-Pace, though it recently added the roomier Ojai, a modified Zeekr vehicle. 

Waymo’s newest vehicle, the Hyundai Ioniq 5, will be available with a specialist behind the wheel to validate the hardware and software before unleashing a rider-only rollout to the public.

Waymo stated in a blog post that the robotaxis being added in the new cities will initially be available only to Alphabet employees, but will be open to other riders soon. The self-driving company has made headlines since 2020 for introducing autonomous taxis to the public, but not always positively. 

In recent months, nearly 4,000 Waymos were affected by a recall by the National Highway Traffic Safety administration after the robotaxis drove into construction zones on the highway in Phoenix, Arizona and San Francisco. The NHTSA report states that the cars incorrectly prioritized other highway hazards and failed to recognize the construction zones. Additionally, in May, another recall affected Waymo after it was reported that the vehicles were driving into flooded roadways. 

Despite this debacle, Waymo is actively preparing to launch in New York, Chicago, London and Tokyo. Waymo also faces competition from Zoox, another robotaxi company owned by Amazon, which has continued to expand its operations across cities. 

A Waymo representative was not available for comment. 

Google is giving Photos another dose of Gemini. The company has announced Video Remix, a new AI-powered editing tool that can transform ordinary video clips into stylized creations with just a few taps. Rather than requiring professional editing skills, Google says the feature lets users quickly reinvent existing videos using creative AI effects directly inside Google Photos.

Think of it as Photo Remix, but for videos

Available from the Create tab in Google Photos, Video Remix uses Gemini Omni to apply AI-powered transformations to an existing video clip. Instead of trimming footage or manually layering effects, users simply choose a creative template, and Gemini generates a new version of the clip with a completely different look and feel.

The available effects go well beyond simple filters. Video Remix can apply cinematic relighting to brighten dark footage, swap plain backgrounds for entirely new environments, or turn videos into artistic creations with styles such as watercolor, raw sketchbook, and oil painting. Google even showcases examples like giving a video a morning glow, placing someone inside a greenhouse, or transforming a clip into dreamy watercolor artwork.

There are a few limitations, though. Video Remix currently works only with video clips up to 10 seconds long, and longer recordings need to be trimmed before the AI begins generating a new version. The process itself can also take a couple of minutes, depending on the edit.

Rolling out first to Google AI subscribers

Video Remix is rolling out starting today for eligible Google AI Plus, Pro, and Ultra subscribers in select countries, including India, the U.S., Japan, South Korea, Brazil, Mexico, and several others.

The launch continues Google’s steady push to bring Gemini deeper into Photos. Over the past year, the app has gained AI-powered image editing, smarter search, and creative tools for photos. Video Remix extends that philosophy to videos, making it less about traditional editing and more about letting AI completely reinvent how a familiar clip looks—all without leaving Google Photos

Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university’s network.

In an update published on its website, MRU states that it has engaged technical teams and external cybersecurity experts to investigate the incident and to support recovery efforts following a cyberattack on June 17.

The incident disrupted a broad range of university systems, including online services, internet access, and certain internal systems.

MRU is a public university with a history of more than 100 years. It currently has 11,560 students and 12,500 undergraduates.

So far, the investigation confirmed that the attacker stole data stored on a drive used by students and employees for file storage, and the original copies were wiped to disrupt recovery operations.

“We regret to inform our community that our investigation has now shown that data within certain folders on the University’s “H drive” was accessed and taken by an unauthorized actor,” reads the announcement.

The university specified that the incident affected certain folders on the H drive, which contained information affecting current and former students, current and former employees of the university, and an unspecified category of “other individuals.”

Additionally, the attackers also wiped a separate drive, labeled “J,” which stored departmental data. “There is currently no evidence that J drive data was accessed or copied before it was deleted,” MRU says.

“We are still working to recover deleted J drive data, but a full recovery may not be possible.”

The university stated that the incident has been reported to the Alberta Information and Privacy Commissioner and to law enforcement authorities.

The university states that the exposed data varies by person, and because it has been deleted, determining the exact impact for each individual is complicated and will take time.

Once impacted individuals are identified, they will be contacted directly via personalized notifications.

CMD Organization claims the attack

The MRU attack was claimed by the threat group CMD Organization, which has published samples of the allegedly stolen data, including passport scans and other sensitive documents.

The threat actor asked for a 30 BTC ransom, currently around $1.9 million, and gave the university six days to respond before leaking the full set of stolen information.

CMD Organization appears to use an auction-style system, offering to sell the stolen data exclusively to the highest bidder. The threat group currently lists 30 organizations on its extortion site and operates both a clear web and a dark web portal.

MRU said that the recovery of the affected systems may take between several weeks and months and will provide updates as soon as new details become available.

The university is also offering two years of credit monitoring and identity theft protection to all current employees and individuals employed in the past five years.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper