A checkmark for trust, a payload for theft.

CyberWire Daily summarizes a range of active cybersecurity issues: credential-stealing Microsoft packages, critical SAP patches, an actively exploited Chrome zero-day patched by Google, the CanisterWorm npm supply-chain campaign, macOS backdoor distribution via fake Google Ads, a French secure-messaging account-hijack breach, and related topics including insurance implications of AI, an FBI fraudsters list, and an espionage guilty plea.