Democracy without a safety net.

CISA scales back its Election Day role. Google takes down a massive Android TV botnet. The UK warns of AI-powered attacks on critical infrastructure. German lawmakers face potential spyware threats. An AI-enabled infostealer ranks its victims. Ivanti patches more exploited zero-days. NATO launches cyber war games in Estonia. A Harvard breach exposes data linked to 850,000 email addresses. Our guest is Alex Weinert, Chief Product Officer at Semperis, on protecting the identity fabric in the AI era. Democracy is calling. And texting.

Today is Tuesday November 3rd 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

CISA steps back from the midterms. 

The Cybersecurity and Infrastructure Security Agency is taking a dramatically reduced role in today’s midterm elections, abandoning the coordinated national election security operation it has maintained since 2018, the New York Times reports.

Under the Trump administration, CISA has lost roughly a third of its workforce, scaled back intelligence sharing, and discontinued election-specific cybersecurity assessments. There will be no national election security war room or scheduled press briefings, leaving state and local officials with less federal support for responding to cyber threats, technical disruptions, and disinformation.

CISA insists it's fully prepared, pointing to regional teams available to assist election officials and hundreds of security-related engagements.

Former officials disagree, warning that the retreat leaves dangerous gaps in nationwide threat awareness and coordination.

States have significantly strengthened their election defenses since 2016, including expanded use of paper ballots. But experts say the federal government's ability to identify and communicate threats that cross state lines has substantially weakened.

Google dismantles a set-top-box botnet. 

Google says it has dismantled a massive botnet built from more than 1.3 million Android TV set-top boxes shipped with malware already installed.

The botnet, dubbed XCPE, allegedly originated with Chinese manufacturer Videostrong Technology, which Google says secretly turned customers' devices into residential proxies, renting their internet connections to third parties for activities including advertising fraud and other cybercrime.

Google severed ties with Videostrong and took legal action against the infrastructure controlling the botnet. Researchers say the disruption could also cut off access to more than 10 million additional compromised devices.

The malware wasn't limited to streaming boxes. Researchers also found it on Android-based healthcare equipment, karaoke machines, and digital signage.

Google says it has addressed the weakness that allowed the malware to activate during initial device setup. The case highlights a troubling supply-chain threat: devices compromised before customers even plug them in.

The UK’s NCSC warns of likely attacks on critical infrastructure. 

Britain’s National Cyber Security Centre warns that AI-powered malware is highly likely to feature in financially motivated cyberattacks against critical infrastructure, including hospitals, airports, and power stations, by 2028.

In its annual State of the Cyber Nation report, the NCSC also predicts Russia and China will routinely incorporate AI into their cyber operations.

Agency chief Richard Horne says the danger isn't necessarily new attack techniques, but AI's ability to discover and exploit existing vulnerabilities at unprecedented speed and scale.

He criticized organizations for running outdated systems, postponing security upgrades, and failing to monitor their networks.

The British government is responding with new investments in cyber defenses, AI security research, and vulnerability detection.

Horne warned that organizations face a choice: invest in resilience now, or risk serious disruptions to essential services later.

Warnings from Apple prompt German authorities to highlight potential spyware. 

German authorities are warning lawmakers and prominent public figures about possible spyware attacks following a new round of threat notifications from Apple.

Germany’s federal cybersecurity agency, the BSI, confirmed that members of parliament and other notable individuals received alerts indicating they may have been targeted by sophisticated surveillance software.

Apple sent similar warnings to users in 99 countries. The company doesn't identify suspected attackers or confirm whether targeted devices were successfully compromised.

The spyware involved in these campaigns can potentially steal messages, location data, and other sensitive information, sometimes exploiting vulnerabilities that require no interaction from victims.

German officials say they're taking the warnings seriously and advise recipients to assume their devices may be compromised.

It's unclear who's responsible for the latest campaign, or whether any German officials were successfully hacked.

A new infostealer uses AI to identify the most valuable victims. 

Researchers at Cisco Talos have uncovered a new infostealer that uses artificial intelligence to analyze stolen data and identify the most valuable victims.

Dubbed Volta-Autodoxer, the malware collects passwords, authentication tokens, cookies, payment information, and cryptocurrency credentials. It also targets active sessions on platforms including Discord, Telegram, Steam, and Roblox.

But Volta goes beyond simply stealing data. It conducts additional searches through victims' accounts, gathering information about their locations, habits, and purchases to build detailed personal profiles.

The malware then submits that information to commercial AI models, asking them to act as intelligence analysts and produce structured assessments that help attackers prioritize targets.

Volta defaults to Anthropic's Claude Opus 4.6, with fallback options including Moonshot AI's Kimi and Google's Gemini.

Researchers haven't confirmed the malware has been deployed in the wild, but its design demonstrates how AI could make traditional credential theft more targeted and efficient.

Ivanti patches additional Connect Secure zero-days. 

Ivanti has patched two additional Connect Secure vulnerabilities exploited in zero-day attacks since early October. Attackers chained a privilege escalation flaw and a file upload vulnerability with an authentication bypass bug patched last month, enabling unauthenticated root-level code execution. Researchers at Volexity say the attackers avoided deploying malware, instead repeatedly exploiting devices to execute commands and tampering with logs to hide their activity. CISA has ordered federal agencies to patch the authentication bypass vulnerability by Friday. More than 5,000 Connect Secure instances remain exposed to the internet.

NATO’s Crossed Swords cyber exercise kicks off in Estonia. 

NATO's Cooperative Cyber Defence Centre of Excellence has launched Crossed Swords 2026 in Tallinn, Estonia, bringing together more than 250 participants from over 40 countries.

The exercise focuses on coordinating offensive and defensive cyber operations with conventional military and special operations missions, where timing can be critical down to the minute.

This year's exercise introduces a dedicated AI agent track, allowing participants to build, deploy, and work alongside autonomous systems while maintaining human oversight. The training environment also incorporates OpenAI's Daybreak cyber defense technology.

Military cyber operators, threat hunters, forensic specialists, and command staff are participating, alongside civilian partners helping integrate critical infrastructure protection into operational planning.

Crossed Swords has grown significantly since its beginnings in 2014, reflecting the increasing importance of coordinating cyber capabilities with traditional military operations.

A data breach at Harvard exposes more than 850,000 email addresses. 

A data breach at Harvard University exposed personal information associated with more than 850,000 email addresses, according to breach notification service Have I Been Pwned.

Attackers compromised Harvard's Alumni Affairs and Development systems in November 2025, stealing names, email addresses, phone numbers, physical addresses, dates of birth, donation details, and other biographical information.

Harvard says the affected systems did not contain Social Security numbers, passwords, or payment card information.

The ShinyHunters extortion gang claimed responsibility and published a 1.1-gigabyte archive of stolen data in February after Harvard reportedly refused to pay a ransom. Harvard has not publicly attributed the attack.

The incident was part of a broader series of university breaches, with Princeton and the University of Pennsylvania also reporting compromises involving donor information in November 2025.

 

Stick with us after the break, we are joined by Alex Weinert, Chief Product Officer at Semperis, is talking about protecting the identity fabric in the AI era. And….

Alex Weinert, Chief Product Officer at Semperis, and I recently sat down to talk about protecting the identity fabric in the AI era. Here is our conversation.

If you enjoyed this conversation, be sure to check out the full interview in the show notes. 

Democracy is calling. And texting. 

As Americans head to the polls for today's midterm elections, WIRED reporter Dhruv Mehrotra has a cautionary tale about the machinery behind political fundraising.

Since 2022, he's received more than 1,700 fundraising texts intended for a relative named John, whose modest donations to Democrats somehow got associated with Mehrotra's phone number.

Mehrotra replied STOP 49 times. The messages kept coming.

Investigating the deluge, he traced nearly half this year's messages to tracking codes apparently associated with Sterling Data Company, which uses AI and personal information to identify potential donors.

Sterling's CEO acknowledged that campaigns can rent the same contact records and that database mistakes happen, but didn't confirm responsibility.

His advice was to stop responding entirely.

So, on Election Day, a reminder that while Americans get one vote apiece, political fundraising texts apparently come with no such limits.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.