Meta’s year so far hasn’t exactly been a picnic. But that didn’t stop one nut-loving creature from seeking some joy inside one of the company’s offices this week.

A squirrel apparently got loose inside a building in Bangkok, Thailand, where some of the tech giant’s regional teams are based. The critter spent at least 20 minutes darting past staff, according to an internal memo seen by WIRED. It noted that the squirrel minorly injured a janitor before finally being caught.

The rodent’s adventure in the office—while potentially terrifying to some—brought a moment of levity to Meta staff around the world who have been dispirited by recent restructurings, mass layoffs, and the launch of an initiative to train AI using employee data without their initial consent. Meta executives have acknowledged the current morale crisis and begun trying to lift the mood internally by funding boozy social outings and promising to improve office food, according to current employees and an internal memo.

In recent years, some Meta workers have complained about losing access to healthy office snacks, like nuts, which they said had been replaced with less nutritious options such as chips. Whether the animal marauder in Bangkok found anything to its liking couldn’t be learned.

The squirrel was delivered to the office inside a package, but it ended up escaping, according to the internal memo. A janitor from a cleaning company accepted the delivery. The reasoning behind the squirrel’s delivery and where it now resides weren’t mentioned in the memo, but some people keep the animals as pets or eat their meat.

Meta declined to comment on the incident.

The injured worker, who was scratched on the finger, received first aid and was later taken to the hospital for a medical examination, according to the memo. The janitor “responsible for bringing the animal onto the premises” formally acknowledged their misconduct and committed to adhering to office regulations to ensure “such an incident does not recur,” the memo added.

New York Times journalist Mike Isaac first reported the incident in a social media post on Tuesday, without specifying the location or the janitor’s role. “Employees are predictably having a field day with it internally,” he wrote. “One person created an AI-generated video mimicking an HR training course on squirrel-related office best practices.”

Squirrels looking for a suitable home in Meta’s empire might find better luck invading Hawaii, where CEO Mark Zuckerberg’s personal cattle dine on home-brewed beer and macadamia nuts.

Additional reporting by Lauren Goode.

A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey.

The attacker is taking advantage of a new capability Microsoft opened to administrators in May, allowing them to run “passkey registration campaigns” to entice users to enrol passkeys for more secure authentication.

The campaign has been running since April and involves calling targeted users and trying to convince them to register a new passkey under the attacker’s control.

To mask the deception, the hacker directs victims to a phishing kit that imitates the legitimate Microsoft passkey enrollment process.

Cloud-based identity and access management (IAM) company Okta attributes the activity to an actor it tracks as O-UNC-066, which operates an extortion operation known as Pink.

Okta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.

The security upgrade ruse

During the campaign, targeted employees are contacted by phone under the pretext that they must enroll a new Microsoft Entra passkey for security reasons and are directed to phishing URLs that contain the word “passkey” in the domain name.

The malicious websites include the victim organization’s branding and mimic the real Entra passkey enrollment portal.

Unlike the more common adversary-in-the-middle (AiTM) proxy, the kit is an operator-controlled PHP panel in which the attacker guides the victim through the phishing process in real time, adapting the flow based on the multi-factor authentication (MFA) method used.

“[The phishing kit] is an operator-controlled PHP panel in which a threat actor steers victims through various stages of authentication in close to real-time using a 1-second heartbeat polling mechanism,” explains Okta.

“The operator can use the kit to adapt the user experience to each victim’s MFA requirements (TOTP, push notification with number matching, SMS OTP) during the session.”

Credentials and MFA responses entered by the victim in the kit’s screens are relayed to the operator, who uses them to authenticate to the victim’s Microsoft account.

While the victim believes they are registering a new passkey on their accounts, the attacker is actually registering a passkey they control.

After gaining access, the phishing site presents the victim with fake Microsoft-branded passkey registration pages, prompting them to save a fake BIP-39 recovery phrase and confirm one word from it.

Okta notes that BIP-39 seed phrases don’t have any role in legitimate Microsoft Entra passkey enrollment, but could serve as a distraction for users who are unfamiliar with the process.

Pink extortion gang

According to Palo Alto Networks Unit 42, Pink is a new extortion brand affiliated with the decentralized threat network known as The Com (short for The Community).

The threat actor is known for using vishing (voice phishing) and IT impersonation to collect credentials and multi-factor authentication (MFA) codes, which are used in attacks that steal company data.

The Pink threat group launched an extortion site on May 31, where they publish samples of the stolen data to pressure compromised victims into paying a ransom.

Researchers say that after gaining access to a victim’s account, Pink moves quickly to exfiltrate data from SharePoint and OneDrive services.

Brad Duncan, Principal Threat Researcher at Palo Alto Networks Unit 42, noted in early June that some of the phishing domains used by Pink included the word “passkey.”

Okta recommends that organizations establish methods to better verify the identity of helpdesk personnel when contacting users, as well as deny requests from locations where the company does not offer services.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

A judge has approved a $1.5 million penalty levied against Elon Musk that will settle a U.S. Securities and Exchange Commission lawsuit despite having “significant misgivings” about it.

U.S. District Judge Sparkle Sooknanan noted that her court would accept the settlement, Bloomberg reported Wednesday, which cited her court opinion.

Sooknanan’s approval settles a lawsuit filed by the SEC against Musk in early 2025 over how the billionaire handled his takeover of Twitter. The lawsuit, which was filed only days before Donald Trump took office, revolved around Musk’s failure to disclose to public investors, in a timely manner, his growing stake in the company in 2022.

The fact that Musk did not initially disclose his stake “ultimately saved him a whopping $150 million,” the SEC argued.

In May, Musk reached a settlement with the SEC that stipulated a trust in Musk’s name would be responsible for paying a $1.5 million penalty without admitting wrongdoing.

Sooknanan previously questioned whether Musk was receiving “special treatment” from the Trump administration. Musk helped to bankroll Trump’s campaign during the 2024 presidential race.

In her opinion, Sooknanan noted that her court was “limited to evaluating whether the proposed consent judgment meets minimum standards of fairness and reasonableness,” or whether it “make[s] a mockery of judicial power.”

“Although the Court has significant misgivings about the settlement reached in this case, it cannot say that
the settlement meets that high threshold,” Sooknanan wrote.

NATO is building a vast AI network along its eastern flank, designed to spot an attack early and strike back fast. The plan is called the Eastern Flank Deterrence Initiative, and internal documents name one adversary outright: Russia.

German tabloid BILD obtained the papers and shared them through the Axel Springer network, Business Insider reported.

The documents keep returning to one phrase: a “Kill Web”. It describes a tightly linked digital mesh that ties together satellites, reconnaissance drones, radar, ground sensors and cameras. If one node drops out, another takes over.

The network watches the whole border at once, from Finland down to Romania.

See first, decide first, strike first

The idea is to shrink the time between spotting a target and hitting it. In the past, a drone would flag a target to headquarters. Analysts checked it, then passed a firing order down the chain. That took time NATO no longer wants to lose.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Under the new model, data from every member flows into one shared picture. Palantir’s Maven Smart System acts as the AI brain, sorting sensor feeds so commanders can decide faster. Other contractors plug in around it, including RTX, Rheinmetall, Saab, Lockheed Martin and Boeing.

NATO sums the loop up in six words: “See first. Decide first. Strike first.”

In practice, a drone might catch a Russian armoured column. The system cross-checks it against satellite images, radar and ground sensors at once. A commander then picks the weapon, be it a drone, artillery or a rocket launcher, by range and by the target’s value.

Machines take the first hit

The front line changes too. NATO wants uncrewed systems to meet an attacker before its soldiers do. A forward zone of drones, ground robots and sensors would absorb the first blow. The logic is cold but simple: machines, not troops, take the opening hit.

Tanks and jets do not go away. Leopard 2s, Abrams, HIMARS and F-35s stay the backbone. “EFDI does not replace tanks, artillery, fighter aircraft, or soldiers,” said Maj. Matt Blubaugh, a spokesman for US Army Europe and Africa. “It is designed to help preserve their combat power and give commanders more time and decision advantage.”

Lessons from Ukraine

The concept comes straight from the war in Ukraine. Cheap drones, robots and sensors, fielded in their thousands, aim to offset Russia’s edge in sheer numbers and speed. It echoes the kill chains both sides built on that battlefield, now stretched across an entire alliance.

It also fits a wider European push. NATO has been funding defence startups and folding autonomous ground systems into its plans, even as who controls the underlying AI stays a live question.

Why it matters

NATO calls the strategy “deterrence by denial”. The aim is not just to repel Russia, but to make an attack look pointless before it starts. It marks a real shift, from holding ground with troops to contesting it first with software and machines. The hard part is trust: an alliance that hands early decisions to AI has to be sure the machines read the battlefield right.

Self-driving company Waymo added four more cities where it will service riders: Denver, San Diego, Las Vegas and Tampa. Waymo’s parent company, Alphabet, announced the expansion on Wednesday. 

Waymo’s robotaxi service is currently available in big US cities such as San Francisco, San Antonio, Orlando, Phoenix and many others. Since rolling out Waymo’s self-driving cars, Alphabet has relied on electronic vehicles that use AI to detect objects under distinct weather conditions. Its fleet is predominantly the fully electric Jaguar I-Pace, though it recently added the roomier Ojai, a modified Zeekr vehicle. 

Waymo’s newest vehicle, the Hyundai Ioniq 5, will be available with a specialist behind the wheel to validate the hardware and software before unleashing a rider-only rollout to the public.

Waymo stated in a blog post that the robotaxis being added in the new cities will initially be available only to Alphabet employees, but will be open to other riders soon. The self-driving company has made headlines since 2020 for introducing autonomous taxis to the public, but not always positively. 

In recent months, nearly 4,000 Waymos were affected by a recall by the National Highway Traffic Safety administration after the robotaxis drove into construction zones on the highway in Phoenix, Arizona and San Francisco. The NHTSA report states that the cars incorrectly prioritized other highway hazards and failed to recognize the construction zones. Additionally, in May, another recall affected Waymo after it was reported that the vehicles were driving into flooded roadways. 

Despite this debacle, Waymo is actively preparing to launch in New York, Chicago, London and Tokyo. Waymo also faces competition from Zoox, another robotaxi company owned by Amazon, which has continued to expand its operations across cities. 

A Waymo representative was not available for comment. 

Google is giving Photos another dose of Gemini. The company has announced Video Remix, a new AI-powered editing tool that can transform ordinary video clips into stylized creations with just a few taps. Rather than requiring professional editing skills, Google says the feature lets users quickly reinvent existing videos using creative AI effects directly inside Google Photos.

Think of it as Photo Remix, but for videos

Available from the Create tab in Google Photos, Video Remix uses Gemini Omni to apply AI-powered transformations to an existing video clip. Instead of trimming footage or manually layering effects, users simply choose a creative template, and Gemini generates a new version of the clip with a completely different look and feel.

The available effects go well beyond simple filters. Video Remix can apply cinematic relighting to brighten dark footage, swap plain backgrounds for entirely new environments, or turn videos into artistic creations with styles such as watercolor, raw sketchbook, and oil painting. Google even showcases examples like giving a video a morning glow, placing someone inside a greenhouse, or transforming a clip into dreamy watercolor artwork.

There are a few limitations, though. Video Remix currently works only with video clips up to 10 seconds long, and longer recordings need to be trimmed before the AI begins generating a new version. The process itself can also take a couple of minutes, depending on the edit.

Rolling out first to Google AI subscribers

Video Remix is rolling out starting today for eligible Google AI Plus, Pro, and Ultra subscribers in select countries, including India, the U.S., Japan, South Korea, Brazil, Mexico, and several others.

The launch continues Google’s steady push to bring Gemini deeper into Photos. Over the past year, the app has gained AI-powered image editing, smarter search, and creative tools for photos. Video Remix extends that philosophy to videos, making it less about traditional editing and more about letting AI completely reinvent how a familiar clip looks—all without leaving Google Photos