The through-line in this week's cyberattack coverage is not sophistication but convenience. Attackers are still picking the easiest available seam, and defenders are still deferring the hardest work. The result is a threat landscape where the most damaging incidents come from ordinary behavior rather than novel exploits.
Prey That Never Learned to Run
The Verge's reporting on energy-system security is a useful corrective to AI-doom framing. Joshua Corman, executive in residence for public safety and resilience, told The Verge that energy systems "were always prey. We were just kind of surviving at the appetite of our predators." That is a blunt statement about human-driven risk. It also reframes the recent high-profile hacks that prompted speculation about rogue AI: the vulnerability predates the AI panic by years, and the growth of the risk is tied to the expansion of connected infrastructure, not to the arrival of a new autonomous adversary.
For US technology companies, this matters because energy is upstream of nearly everything they operate. Data centers, payment networks, logistics systems, and cloud regions all depend on a grid whose defenses are partly human. A cyberattack that interrupts power does not need to be clever; it needs to find a person, a vendor, or a misconfiguration. The Verge's piece suggests that the threat is not a future AI scenario but a present condition of interconnected, under-protected systems.
The Long Goodbye to Passwords
Microsoft's reminder to Entra ID administrators, reported by BleepingComputer, is the defensive mirror image of the same pattern. The company is retiring SMS first-factor sign-in starting in February 2027 and is telling admins to migrate users to phishing-resistant authentication such as passkeys. The stated reason is to avoid sign-in disruptions, but the underlying reason is that SMS-based authentication has been the path of least resistance for attackers for years.
The deadline is still months away, which means the migration is currently optional in practice. That is exactly the gap attackers exploit. Administrators who delay the move keep a weak first factor in place; users who resist change keep using it. The February 2027 date is a forcing function, but until it arrives, the easiest route into many Entra ID tenants remains a text message. Microsoft's notice is not a technical breakthrough; it is an administrative one, and administrative work is where security programs most often stall.
Supply Chain Attacks That Hide in Plain Sight
The third story, also from BleepingComputer, describes an ongoing npm malware campaign involving the 'indexed-btree' package. The malicious code does not live in install scripts, where defenders have learned to look. It hides in the package's normal runtime behavior. That is an attacker choosing the path of least resistance with precision: rather than defeat install-script scanning, the campaign simply avoids the scripts that scanners examine.
This is a direct challenge to the supply-chain security model that US technology companies have invested in heavily. Much of that investment has gone into detecting malicious installation activity, dependency confusion, and typosquatting. A package that only misbehaves at runtime can pass those checks and still execute in production. For US consumers, the practical effect is that the software supply chain remains a vector even when the visible hygiene looks good. For US companies, it means that static checks are necessary but not sufficient, and that runtime monitoring of dependencies is now part of the attack surface.
