The ballot box meets the bot.

The briefing opens with a ProPublica report that political appointees at the Department of Homeland Security asked CISA to secretly acquire and hack a voting machine, then report the results to the White House. Career employees resisted because they feared the findings could be used to challenge election outcomes, and the request was eventually abandoned. The report is presented as part of a broader retreat from CISA’s election-security mission since President Trump returned to office. CISA has lost more than 1,000 employees—about one-third of its workforce—and cut monitoring and support services. State election officials said the agency was largely absent while they prepared for the November midterms. They also said the administration’s release of previously confidential election-security information damaged years of cooperation and left states questioning whether sensitive information could still be trusted with CISA. Although CISA released an election-security plan in late September, officials said it arrived too late to have much practical effect. Separately, the FBI and CISA warned that AI-generated phishing could target election officials, candidates, and political organizations before the midterms. Attackers can now produce convincing emails, texts, deepfake audio, and video without the traditional clues of poor grammar. The agencies recommended phishing-resistant multifactor authentication, stronger email filtering, and independent verification of suspicious requests. They described this as an emerging threat, not evidence of a specific ongoing attack.

ConnectWise suspended its cloud backup service and took two other cloud services offline after attackers stole credentials belonging to seven application identities. Those credentials allowed the attackers to impersonate trusted ConnectWise applications without knowing individual customers’ passwords, potentially exposing customer Microsoft 365 environments. Huntress found suspicious sign-ins across roughly 1,000 Microsoft tenants, including about 300 successful authentications. Researchers also observed a targeted campaign against 16 organizations in sensitive sectors, although those attempts failed. ConnectWise said it disabled the compromised credentials and found no evidence that encrypted backup archives had been accessed. Nevertheless, backup and restoration services remained unavailable, and Huntress warned that attackers might have established persistent access inside affected tenants before the credentials were revoked. The briefing then describes a separate phishing campaign that turns ordinary calendar invitations into credential traps. Check Point identified more than 300,000 unique phishing emails aimed at over 40,000 organizations, often disguised as Microsoft Teams meetings or other workplace appointments. The links lead to counterfeit Microsoft login pages, while some invitations include legitimate calendar attachments to appear authentic. More than 740,000 messages were recorded during the first two weeks of October. The attackers were not exploiting a Microsoft vulnerability; they were exploiting employees’ trust in routine meeting requests. Check Point recommended scrutinizing unexpected invitations and using passkeys or hardware security keys.

Chinese online retailer Temu agreed to pay Texas $3 million to settle allegations that it improperly collected user data that could potentially be accessible to the Chinese government. The agreement requires Temu to store personal data on U.S. servers, restrict transfers to China, conduct independent product-safety testing, and strengthen consumer protections. Violations of certain data-security provisions could produce annual penalties of $8 million. Temu denied wrongdoing. Texas is the first state to reach a settlement, although several other states have filed similar lawsuits. In Toronto, police arrested seven men over the alleged kidnapping of a cryptocurrency-exchange owner, including three active members of the Canadian Armed Forces. Investigators said the victim was abducted at gunpoint in July, handcuffed, and assaulted while his captors tried to gain access to cryptocurrency holdings and business security systems. He was released after being threatened not to contact police. The investigation uncovered firearms with 3D-printed receivers, silencers, more than 2,700 rounds of ammunition, GPS trackers, illicit drugs, and other equipment. Police allege that about 2,500 rounds were stolen from the Canadian military. The suspects collectively face 82 charges, and the investigation remains ongoing.

The G7 urged governments and businesses to accelerate migration to post-quantum cryptography. Led by France’s National Cybersecurity Agency, the group said quantum computing should be treated as a near-term cybersecurity concern even though nobody knows when a cryptographically capable quantum computer will be developed. The recommendations begin with identifying critical systems and inventorying cryptographic assets, followed by phased migration plans. Organizations are encouraged to introduce quantum-safe technologies as part of routine equipment upgrades, which could reduce the cost and disruption of a later emergency transition. The G7 also called for national strategies, more research, public-private partnerships, and updated cybersecurity requirements. France plans to begin rejecting security products that lack quantum-safe encryption during certification reviews starting in 2027. The underlying concern is that widely used encryption may eventually be undermined, so organizations should begin planning and replacing vulnerable systems before a capable quantum computer exists.

The Monday business briefing reports that eight AI-driven cybersecurity companies announced funding rounds totaling nearly $143 million. San Francisco-based Harmonic Security led with a $50 million Series B. Israeli startups Pluto Security and Rain Security raised $42 million and $25 million, respectively. Other recipients were France’s NetSec and Flore AI, Tennessee-based Hilt, London’s CodeWall, and Utah’s Guardrail Technologies. The companies said the money would support product development, hiring, and international expansion. The acquisition activity was larger in headline value. Quantum-computing company IonQ agreed to buy zero-trust security firm Elicity in an all-stock transaction valued at up to $1.3 billion. CrowdStrike was reportedly negotiating a $500 million acquisition of Israeli data-loss-prevention startup Orion Security. The briefing also notes that government contractor SAIC acquired cryptographic software provider Information Security Corporation, while Singapore-based VKey announced a majority investment in AI-security firm CloudSign AI. Together, the deals show investment moving across AI security, zero trust, data loss prevention, cryptography, and quantum computing.

Ben Yelin interviews Kevin Tien, CEO and co-founder of Doppel, about the company’s work with the San Francisco 49ers. Tien says the 49ers face a distinctive threat because they are a large, consumer-facing brand with players, coaches, personnel, and a huge fan base to protect. AI makes it easier to run disinformation campaigns and impersonate personnel. A team can be attacked directly, but criminals can also use the team’s brand to defraud fans, creating a much larger pool of potential victims. Tien says the same pattern applies to financial institutions, retailers, and other brands with large followings. Doppel and the 49ers have used fan-facing experiences to make the warning concrete. At the stadium, the “Doppel game” shows a franchise legend such as Jerry Rice and uses a camera to find a fan who resembles him, asking whether the image is “real or fake.” Tien describes this as both entertainment and security awareness. Yelin jokes that the 49ers were undefeated since partnering with Doppel, while Tien also mentions similar success with the Knicks the previous postseason; both acknowledge they might be jinxing the team. On the broader AI contest, Tien says the same technology that enables bad actors also lets defenders build capabilities they could not previously build. He says AI is already writing more secure code than humans according to objective third-party benchmarks. But even flawless code and infrastructure cannot eliminate social engineering, which remains a lucrative long-tail attack path. Tien’s advice is to secure both technology and “social protocol,” including human-to-human, human-to-agent, and agent-to-agent communications. He gives a practical deepfake test: ask a supposed version of him a personal question, such as his favorite city; in a live demonstration, the deepfake failed that test.

The closing story says MapQuest, once known for printed driving directions and the printer ink needed to produce them, has added a surveillance layer to its mobile app. Users can now see the locations and directions of known license-plate readers and outdoor security cameras along their routes. The feature includes equipment from Flock Safety, Motorola Solutions, Axon, Verkada, and other surveillance vendors. Flock alone reportedly operates at least 120,000 cameras in the United States, while independent projects had already been mapping their locations. MapQuest is now bringing that information into its navigation tools, allowing users to identify surveillance infrastructure as they travel. The host summarizes the change with a joke: the company that once helped people avoid getting lost can now help them see who is watching them. The episode then ends with the CyberWire’s request for ratings, reviews, survey responses, and feedback by email.