Microsoft counted more than 1 million CEO-impersonation scam emails in three days as passkey-themed lures handed ShinyHunters and Helix the keys to Microsoft 365 tenants.
Quiet day: only 38 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Fraud crews send a million lures in three days, and Fred Heiding finds frontier models skilled enough at emotional manipulation to make passkey scams land on Microsoft 365.
- Trend Governance fights at software vendors carry security weight, with Matt Mullenweg claiming control of Automattic days after his board's leave vote and Zitron dissecting Hock Tan's Broadcom.
- Update · new Washington posted a $10 million bounty for an unnamed Iranian cyber official as researchers detailed the Chinese group QTFY's military ties and the InjectEave campaign.
- Trend Wired finds Meta failing to curb AI-generated child abuse videos as a photo-scraping class action proceeds, while Cal Newport calls superintelligence a fairy tale with real costs.
- Update · new Locally, a Jefferson County woman became the county's first measles death, another line of storms crosses Pittsburgh tonight, and Clover Commons residents push House Bill 1250.
- Update · new The U.S. women meet France for the FIBA World Cup title in Germany as the Steelers open against Atlanta running back Bijan Robinson.
Security
1. Passkey Lures and CEO Impersonation Hit Microsoft 365
Latest developments: Microsoft put numbers on the fraud wave on September 13, 2026, counting more than 1 million scam emails sent between August 3 and August 5, 2026 by operators who posed as chief executives and pushed the messages through third-party email delivery services, a campaign running alongside the passkey and single sign-on social engineering that ShinyHunters, Helix, and other extortion crews aim at corporate Microsoft accounts.
read more
The passkey lures talk employees into enrolling an authentication method the attacker controls, which yields durable access to Microsoft 365, SharePoint, OneDrive, and mail; the invoice and payment scams stack legitimacy tricks with AI help. Administrators should review recent authentication method enrollments and restrict which outside senders may deliver mail under the company's domain.
Sources: The Hacker News · BleepingComputer · The Record · ↑ top
2. Meta Faces AI Image Suit and Abuse Video Failures
Latest developments: Wired reported that Meta has failed to stop AI-generated videos of child abuse from spreading across its platforms, days after plaintiffs filed a proposed class action accusing the company of harvesting Facebook and Instagram photos to train its AI image-generation models and to build NameTag, an unreleased face recognition feature.
read more
Meta's generative image work now draws pressure from two sides: civil claims over the photographs that trained the models and moderation failures on the synthetic media those tools help produce. Both threads feed the coming rules on training data and synthetic content.
Sources: Wired Security · Wired Security · ↑ top
3. Frontier Models Learn to Work on Humans
Latest developments: Fred Heiding of Menlo Park Intelligence told the Dark Reading News Desk that his tests of frontier models measure their ability to steer human behavior and cultivate emotional dependency in a target, and Bruce Schneier posted the DEF CON talk he gave last month on what follows when AI systems become the hackers, which passed 100,000 YouTube views within days.
read more
Persuasion now counts as an attack capability of large language models, on top of the exploit code they write for intruders. Dark Reading separately warned that adversaries can bend the reasoning of AI defensive tools to move through a network quietly, which puts every model an enterprise runs under the governance question.
Sources: Dark Reading · Schneier on Security · Dark Reading · ↑ top
4. Iran Bounty, QTFY Ties, and InjectEave
Latest developments: SecurityWeek reported that the United States has posted a $10 million bounty for information on an Iranian cyber official whom it declines to name publicly, that researchers documented the military ties of the Chinese hacking group QTFY, and that a technique called InjectEave joins phishing which hides invisible Unicode characters to clear mail filters.
read more
The items trace state hacking crews back to their governments and show filter evasion moving down into character encoding, where a gateway that never normalizes text scores a malicious message as clean. Mail security teams should confirm their filters normalize Unicode before they score a message.
Sources: SecurityWeek · ↑ top
5. Mullenweg Says He Runs Automattic Again
Latest developments: Matt Mullenweg says he is back in control of Automattic, three days after the company's board voted to put him on leave, and workers there told 404 Media the company has absorbed years of chaotic leadership decisions.
read more
Automattic owns WordPress.com and employs the people who operate WordPress.org, the channel that pushes plugin updates to millions of sites and that began screening every plugin release automatically last week. Who holds authority over that pipeline is a supply chain question for every organization running WordPress.
Business and Politics
Brics Closes Ranks Over the Gulf War
Latest developments: The Financial Times reported Sunday, September 13, that the Brics summit produced rare unanimity, with the bloc pressing for peace in the Gulf and lining up against American tariffs and sanctions.
read more
Brics, the bloc built around Brazil, Russia, India, China, and South Africa, normally splits over agendas, and worry about the widening Iran conflict, U.S. tariffs, and U.S. sanctions handed this summit an easy consensus. Rivalry between India and China over trade and regional influence still caps how far their rapprochement runs.
Sources: FT Home · FT World · ↑ top
A Banking Scandal Reaches Brazil's Supreme Court
Latest developments: The Financial Times reported Sunday, September 13, that a banking scandal has pulled Brazil's Supreme Federal Court into an unprecedented crisis, with a bitter feud between justices spilling into public view.
read more
Brazil's Supreme Federal Court settles the country's biggest political and financial disputes, and the fight among its justices lands weeks before the October presidential election, which the crisis could sway. Investors hold heavy exposure to Brazilian sovereign debt and to the banks now caught up in the affair.
Pittsburgh
Weather
Today: Partly Sunny then Slight Chance Showers And Thunderstorms, high 84F.
Tonight: Chance Showers And Thunderstorms, low 59F.
Monday: Sunny, high 73F.
Business
Trade Schools Fill Up as AI Unsettles Office Work
Latest developments: The Post-Gazette reported Sunday, September 13, that trade and technical schools are posting enrollment increases as students weigh artificial intelligence against the security of white-collar careers.
read more
Students choosing welding, electrical, and other skilled trades over four-year degrees cite the reach of artificial intelligence into entry-level office jobs, along with the cost of college. The shift reaches Western Pennsylvania employers who have spent years short of licensed tradespeople.
Sources: Pittsburgh Post-Gazette · ↑ top
Superloads Come With the Data Centers
Latest developments: TribLive's editorial board wrote Sunday, September 13, that the oversized hauls now crossing Western Pennsylvania roads are an inseparable part of the data center buildout, citing the Pew Research Center's count of roughly 1,500 data centers in development nationwide.
read more
Transporters started moving superloads carrying equipment as heavy as 380 tons through the region this month, slowing traffic on several busy roads across multiple counties for months. The deliveries feed the computing campuses developers are building around Pittsburgh, and the editorial argues residents weighing those projects should count the road disruption as part of the price.
Around Town
Measles Kills a Jefferson County Woman
Latest developments: The Jefferson County coroner confirmed Sunday, September 13, that a 40-year-old woman died Saturday from complications of measles, the county's first measles death.
read more
Pennsylvania has counted 676 measles cases this year, the most of any state, and about 100 of those arrived in the week before September 11. Two infants died of measles-related causes in the state last month, and this death is the first adult the outbreak has claimed.
Another Line of Storms Sunday Night
Latest developments: Forecasters expect one more line of showers and storms to cross the Pittsburgh area between 6 and 10 p.m. Sunday, September 13, carrying heavy rain and locally damaging wind gusts, after flash flooding hit the city of Washington again Saturday evening.
read more
Fast-moving water flooded roads and damaged homes, vehicles, and businesses across Washington and Allegheny counties Saturday night, and the flood-control work Washington has planned keeps slipping as the rain returns; the city declared a state of emergency. Sunday stays humid with highs near 80 and feels-like readings in the mid-80s for the Steelers' 1 p.m. kickoff, and the storms move fast enough to keep the flood risk low.
Sources: WPXI · WPXI · WTAE · ↑ top
Clover Commons Residents Press for House Bill 1250
Latest developments: TribLive reported Sunday, September 13, that nearly 60 residents of Clover Commons in Plum took to the streets of their community last week over rising land rent and asked Pennsylvania senators to pass House Bill 1250.
read more
The Clover Commons residents own their homes and rent the ground beneath them, and the seniors among them live on fixed incomes that the rent increases outrun. House Bill 1250 would hold that land rent in check, and the protesters want the state Senate to move it.
Events
Latrobe Italian Festival's Final Day
Latest developments: WPXI reported Saturday night, September 12, that the Latrobe Italian Festival has drawn growing crowds through the first of its two days, leaving Sunday, September 13, as the closer.
read more
The Latrobe Italian Festival runs two days in Latrobe, Westmoreland County, with food, music, and demonstrations of Italian tradition, and it ends Sunday, September 13.
Game Lands Driving Tours Open September 20
Latest developments: TribLive reported Sunday, September 13, that the Pennsylvania Game Commission will again open state game lands to self-guided driving tours starting Sunday, September 20.
read more
The Game Commission lets drivers roll through wildlife habitat on state game lands roads normally closed to vehicles, a fall tradition aimed at people who want to watch wildlife without hiking. The tours begin Sunday, September 20, and run through the fall.
Sports
Pirates (74-75)
Sat Sep 12 · Pirates 3 · Cubs 4 · Final
Up Next · Pirates @ Cubs · Sun Sep 13, 2:20 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Bijan Robinson Tops the Steelers' Worry List
Latest developments: The Post-Gazette published its Steelers-Falcons scouting report Sunday morning, September 13, naming Atlanta running back Bijan Robinson the weapon Pittsburgh's defense has to stop, and beat writer Gerry Dulac posted his Week 1 picks for the full NFL slate the same morning.
read more
The Steelers open the season against the Atlanta Falcons at 1 p.m. Sunday, September 13, at Acrisure Stadium, with Mike McCarthy coaching his first regular-season game for Pittsburgh and Aaron Rodgers at quarterback. Robinson, Atlanta's every-down back, forces the front seven Patrick Graham has spent camp resyncing to hold up against both the run and the screen game.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Team USA
U.S. Women Meet France for the World Cup Title
Latest developments: The United States plays France on Sunday, September 13, for the FIBA Women's World Cup title in Germany, a rematch of the 2024 Olympic gold medal game.
read more
Kara Lawson's team pulled away from Spain 76-66 in Saturday's semifinal to reach the final unbeaten in the tournament. France arrived by routing host Germany 86-64, with guard Gabby Williams scoring 22 points and pulling down five rebounds.
Sources: ESPN Olympics · ESPN Olympics · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To Broadcom. Zitron dissects Broadcom under chief executive Hock Tan, opening with Tan's 2024 coffee chat introducing his management style to employees of the freshly acquired VMware and its 100-acre Palo Alto campus. He argues the company's model runs on buying entrenched software businesses and squeezing them.
- Stratechery — The iPhone Duo, The Intelligent Personal Hub, Apple Watch Audio Intelligence. Ben Thompson credits Apple's latest launch as another demonstration of hardware and software integration done well, from the iPhone Duo to Apple Watch audio intelligence. He argues Apple's largest artificial-intelligence blind spot is its conviction that apps remain the organizing layer of computing.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport responds to Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a story the industry tells itself. He argues the pursuit still does real damage through the resources, expectations, and political capital it consumes.
Markets
S&P 500 7,655.43 ▼ -0.4% Dow 52,643.67 ▼ -1.1% Nasdaq 26,319.30 ▼ -0.1% WTI crude 96.62 ▲ +9.4% EUR/USD 1.1620 ▲ +0.1% GBP/USD 1.3537 ▲ +0.1% USD/JPY 153.79 ▼ -2.8%
Feed Health
Security: 24 of 24 feeds loaded, 38 items in the 48-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (382s of model time; $1.78 at API list price).