In today's briefing, Microsoft announces a major shift in identity security by mandating a transition away from SMS and voice-based multi-factor authentication for Entra ID by February 2027. This move is driven by the increasing sophistication of AI-powered phishing and SIM swapping attacks. To counter these mobile threats, Surfshark has launched new real-time smishing protection for mobile users. On the tactical front, the Lazarus Group has been identified exploiting a Windows zero-day in AFD.sys to target defense-sector companies as part of 'Operation Dream Job.' Additionally, researchers have exposed the 'Jewelbug' APT, a mercenary group likely linked to China that performs both state-sponsored espionage and massive cryptocurrency theft from a unified control panel. Logistics provider Uber Freight is also investigating a significant data incident involving the Helix extortion group, which claims to have stolen one million files using vishing tactics. Finally, we analyze a critical vulnerability in Adobe Commerce that allows attackers to hijack customer accounts, and the emergence of WindRelay NFC malware capable of executing fraud in under 13 minutes.