Archive for October, 2025

Black-led startups secure record $400,000 at DMZ’s largest Black Innovation Summit to date

Posted in Commentary with tags on October 31, 2025 by itnerd

Toronto Metropolitan University’s DMZ held its fifth annual Black Innovation Summit, where 10 Black-led tech startups from across Canada pitched their businesses for the chance to secure over $300,000 CAD in funding to accelerate their growth — a total that ultimately surpassed expectations, reaching $400,000 CAD awarded by the end of the event.

DMZ’s largest Black Innovation Summit to date, the event gathered over 400 guests from the Black entrepreneurial community. Designed to bring together the Black tech ecosystem and celebrate Black excellence, this year’s theme, ‘Black Means Business,’ underscored a powerful message: investing in Black founders is not only the right thing to do, it is a strategic imperative that fuels economic growth and the startup economy. According to a recent report by the BDC, Black entrepreneurs remain underrepresented in Canada’s business landscape yet demonstrate strong export potential and optimism for growth, clear indicators of untapped economic opportunity. The Summit put capital behind this conviction, awarding the most in its history.

The Summit featured a powerful lineup of speakers, including successful Black entrepreneurs such as Frank Baylis, Canadian businessman and Executive Chairman of Baylis Medical Technologies, and award-winning artist, entrepreneur and DMZ Advisory Council member Keshia Chanté and The Honourable Graham McGregor, Minister of Citizenship and Multiculturalism for the Government of Ontario. The day brought together entrepreneurs, investors, corporate leaders and government to celebrate Black-led innovation, culminating in a startup pitch competition exclusively for Black founders.

DMZ Ventures, Tribe Network, and Capital M Ventures led this year’s investments and grants were made possible by DMZ and the Black Founders Network. The investment funds are now proceeding to finalize investment terms. 

  • OutreachGenius, a solution that provides AI-powered agents to answer sales calls and revive cold prospects for home-service businesses, received 200,000 CAD in investment commitments. 
  • Happly.AI, a platform that helps startups find and secure funding, received 75,000 CAD in investment commitments and a $50,000 CAD grant. 
  • Kiwi Charge, a solution that provides autonomous charging units for electric vehicles in buildings that lack a charging infrastructure through a charging-as-a-service model, received a $30,000 CAD grant. 
  • Cellect Laboratories, nanotech-powered products for women to screen for HPV and cervical cancer, received a $20,000 CAD grant. 

The Black Innovation Summit also recognized exceptional Black-identifying young entrepreneurs through its Youth Entrepreneurship Award. The Honourable Graham McGregor, Minister of Citizenship and Multiculturalism from the Government of Ontario, joined the Summit to present the awards. Five outstanding young entrepreneurs shared a $25,000 pool in youth grants:

  • Daniel Martinovic, Nodalli 
  • Samira Mohamed, Stardoe Studio
  • Merveille Mukoko, Yekola
  • Chevon Riley, NORM 
  • Alexis Stackhouse, Global Elevation Network 

The Ontario Government, a longstanding partner of DMZ’s Black Innovation Programs, invested $16.5 million in over 65 Black-focused programs earlier this year, including renewed support for DMZ’s programs.

DMZ is proud to have brought the Summit to life in collaboration with presenting partners Scotiabank and the Government of Ontario; contributing partners Black Founders Network, CapitalM Ventures, DCCM Foundation, DMZ Ventures, Humi by Employment Hero, Torys LLP and Tribe; and community partners Black Entrepreneurship Alliance, Black Women Talk Tech, Brampton Innovation District, Founders Connect, Futurpreneur, LBIH, Nobellum, Rep Matters and Startup Ecosystem Canada.

The annual Black Innovation Summit serves as the marquee event for DMZ’s Black Innovation Programs (BIP), which were launched in 2019. A first-of-its-kind initiative in Canada, DMZ’s Black Innovation Programs were created to increase the number of Black-led startups in the tech ecosystem and break the cycle of inequity. To date, DMZ has supported over 2,500  Black-identifying founders and has distributed over $3 million in grants and services.

Black founders in DMZ’s Black Innovation Programs receive additional opportunities and specialized support, such as free legal services, subsidized hiring grants, professional development opportunities, mentorship, a peer network, exclusive events, and connections to investors dedicated to supporting Black-led innovation—on top of the standard programming all DMZ founders receive.

Black founders seeking hands-on, tailored support to take their businesses to the next level can learn more about DMZ’s Black Innovation Programs at dmz.to/bip.

Surfshark protects against phishing attacks with the email scam checker

Posted in Commentary with tags on October 31, 2025 by itnerd

Surfshark has launched the email scam checker to help protect against email phishing attacks. This on-demand solution aims to provide users with an additional security layer against sophisticated scams, considering the alarming statistic of 3.4 billion phishing emails sent daily and 1.5 million new phishing websites created every month.

The email scam checker, a new feature of the Surfshark Chrome browser extension, offers a robust security layer against drastically increasing email phishing attacks. This tool helps improve users’ online security by allowing them to check suspicious emails and get notified about fraud and phishing attempts.

By identifying malicious attachments and links, Surfshark’s email scam checker significantly reduces the risk of potential fraud and malware infections on users’ devices. Using AI-driven technology, the new feature rapidly detects phishing attempts, safeguarding users’ sensitive data with increased accuracy. With the email scam checker, users can browse the internet with greater confidence and safety, having a powerful ally to combat email scam threats whenever needed.

This advanced protection is crucial because email phishing scams are a growing threat, becoming increasingly sophisticated and harder to detect. With the rapid advancement of AI tools, scammers are constantly evolving their tactics, making fraudulent emails more convincing and the problem harder to control.

The email scam checker is now available on the Surfshark Chrome browser extension for Gmail users with a Surfshark One or One+ subscription.

Wealthsimple Customers Are Also Targets Of The Questrade Phishing Threat Actors

Posted in Commentary with tags on October 30, 2025 by itnerd

After posting this story about an ongoing large scale Questrade phishing campaign, I checked my honeypot and discovered that the same threat actors behind this campaign are also going after Wealthsimple customers. That’s evidenced by this phishing email:

Now this email is extremely similar to the one that was being used in the Questrade campaign. And walking through the phishing scam, I found the website that was created was of similar quality as the one behind the Questrade campaign. I say was because it has been taken down by its host which appears to be based in China. While that suggests that the threat actors are Chinese, it is possible that the threat actors are from someplace else and are using a Chinese web host for cover. The emails are very similar as well which seems to point to the fact that these are the same threat actors are behind both campaigns.

My honeypot has received these emails as recently as 4 hours ago. So this is clearly an ongoing campaign that will likely evolve. Thus keep your head on a swivel to ensure that you don’t fall victim to one of these campaigns.

Kaizen raises $21 million to re-build government’s digital front door

Posted in Commentary with tags on October 30, 2025 by itnerd

America’s public institutions were once legendary examples for how governments ought to engage their citizens. While these services are critical to maintaining the Country’s social fabric, the technologies that facilitate them are known for being slow, hard to use, and multiple generations behind our expectations. Kaizen is changing that for America’s public agencies, one digital roadblock at a time. The company announced a $21 million funding to accelerate its mission to restore public faith in government services through beautifully designed, modern e-government solutions.

The Series A funding round was led by NEA with participation from 776, Accel, Andreessen Horowitz, and Carpenter Capital. This follows an $11m seed co-led by Accel and Andreessen Horowitz’s American Dynamism practice. To date, Kaizen has raised $35 million.

Kaizen is specifically focused on modernizing “resident services” — the essential public-facing institutions that deliver constituent services and facilitate high-volume, e-commerce–style transactions. Common examples include parks & recreation, transit, DMVs, hunting and fishing licenses, utility billing, courts management, passport renewals, social security, tax filing, and more. These services span all levels of government, including city, county, state, and federal agencies. 

Across the Country, these agencies rely on clunky systems and long-term contracts that charge tax-payers billions in service charges and junk fees. Kaizen offers an alternative: a unified commerce and purchase platform that lets governments launch essential services to their communities in weeks. On the back-end, Kaizen gives administrators powerful digital building blocks to create service offerings, manage operations, and process payments. On the front-end, Kaizen serves a branded and hyper-configurable purchase experience for the constituent simple. The result is a consumer-grade experience for residents to access, enjoy, and explore their public services – and a way for governments to build a stronger bond with the communities they serve.

The timing for Kaizen couldn’t be better. Across the country, governments are investing billions to modernize outdated digital systems and make public services as intuitive as the private-sector apps people use every day. The federal government recently instituted a new National Design Office, tasked with leading a $10 billion modernization effort to overhaul more than 25,000 government portals  Kaizen is building the resident-first technology that embodies this new era of accessible, human-centered government.

For founders Nikhil Reddy and KJ Shah, the company’s mission is deeply personal. Reddy, an early engineer at defense-tech pioneer Anduril, saw firsthand how modern software can power critical operations with speed and precision. Shah, who began his career in M&A and was exposed to public-sector technology companies at William Blair, witnessed how legacy software and fragmented tools were holding government agencies back. Together, they founded Kaizen to help power a new era for these kinds of public services. “For decades, public servants have been forced to use stagnant software built through acquisitions, not product innovation. Our agencies need and deserve a platform built natively and designed to grow with them,” said Shah.

The results are already clear. In Maryland, Kaizen launched a new day-pass system for state parks in less than 60 days, a month ahead of schedule. On the Fourth of July weekend, the parks hit full capacity with no major check-in delays for the first time in years. Virtually overnight, seven-mile traffic jams were eliminated, visitor satisfaction soared, and the state saved hundreds of thousands of dollars in overtime costs.  The impact even extended beyond human experience: park leadership reported a resurgence of wildlife thanks to the newfound peace and predictability of daily entry. 

Since the start of 2024, Kaizen’s customer base has grown 10x, and ARR has jumped 9x YoY. The company now works with more than 50 agencies across 17 states. In the last eight weeks alone, Kaizen has announced partnerships with Maricopa County, AZ, San Bernardino County, CA, Suffolk County, NY, and the Cherokee Nation, America’s largest tribal organization. The team of 30 will expand to 50 by early next year as Kaizen prepares to expand to Federal agencies and net-new verticals like DMVs, courts management, and licensing.

Kaizen’s long-term vision is to become the technology prime that builds beautiful, effective, and ever-improving interfaces for civic institutions. These constructs empower our democracy, and usable, trustworthy interfaces are necessary for their continued success of our social fabric in America.

EY Canada deploys its FlexiGenAI platform on TELUS’ Sovereign AI Factory

Posted in Commentary with tags on October 30, 2025 by itnerd

TELUS and Ernst & Young LLP (EY Canada) today announced that EY’s advanced agentic AI platform, FlexiGenAI, has been deployed on TELUS’ Sovereign AI Factory – Canada’s first operational, fully sovereign AI infrastructure facility. This implementation offers government agencies and Canadian businesses the ability to harness leading-edge agentic AI capabilities for critical workloads while storing sensitive data securely within national borders and under Canadian control.

EY’s FlexiGenAI is a next-generation agentic AI platform that helps organizations move from AI experimentation to enterprise-scale impact. Designed to make advanced AI more accessible without requiring technical expertise, FlexiGenAI allows users to build and deploy AI solutions while incorporating built-in oversight features, audit trails and privacy controls that meet the stringent requirements of public sector environments. The platform leverages NVIDIA’s latest accelerated computing in TELUS’ high-performance, Canadian-controlled Sovereign AI Factory to deliver enterprise-grade capabilities with enhanced security and performance specifically designed for government and business-critical workloads. This solves a fundamental challenge facing Canadian organizations today: accessing cutting-edge AI capabilities without compromising on data sovereignty or regulatory compliance.

TELUS’ Sovereign AI Factory enables organizations to leverage the complete AI development lifecycle – from building new models to customizing existing ones for specific applications and deploying them in operations. Powered by 99 per cent renewable energy, the TELUS AI Factory operates as one of the world’s most sustainable AI-ready data centres while using significantly less electricity to power AI computing workloads than industry standards.

Outpost24 simplifies PCI DSS compliance with certified expertise and a single platform 

Posted in Commentary with tags on October 30, 2025 by itnerd

Outpost24 today announced a new PCI DSS (Payment Card Industry Data Security Standard) Compliance solution designed to simplify how organizations meet and maintain payment card industry security requirements.

As a PCI Security Standards Council Approved Scanning Vendor (ASV) for more than 20 years, Outpost24 combines certified PCI expertise, advanced automation, and flexible testing options in a single, easy-to-manage platform. The result is faster, more efficient compliance for organizations of any size — without the complexity or cost of managing multiple tools and providers.

Outpost24’s PCI DSS Compliance solution supports the key scanning and testing activities required under the PCI DSS framework, including ASV scanning, internal vulnerability assessments, and application and infrastructure penetration testing. Customers can select the level of coverage they need from several flexible packages, and choose between self-managed or fully managed options supported by Outpost24’s in-house PCI professionals.

The new offering enables organizations to plan, schedule, and manage PCI testing through Outpost24’s platform, delivering better visibility, actionable insights, and streamlined reporting. Customers using Outpost24’s Managed PCI service can further reduce internal workload by entrusting daily compliance tasks to the company’s certified PCI experts, ensuring faster remediation and audit readiness throughout the year.

For more information on Outpost24’s PCI DSS Compliance solution, visit outpost24.com/products/pci.

npm malware campaign stealing developer credentials across platforms

Posted in Commentary with tags on October 30, 2025 by itnerd

Recently, cybersecurity researchers disclosed two sophisticated npm malware campaigns targeting developer credentials across Windows, macOS, and Linux systems. Socket researchers discovered 10 malicious packages with over 9,900 downloads, while Koi Security identified an ongoing campaign dubbed PhantomRaven involving 126 infected packages with 86,434 downloads. Both campaigns use advanced evasion techniques: PhantomRaven exploits Remote Dynamic Dependencies and AI-driven “slopsquatting,” while the Socket-discovered malware uses four layers of obfuscation to harvest credentials from system keyrings, browsers, and authentication services.

You get more details here: 10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

CTO of DryRun Security, Ken Johnson had this comment:

“Attackers are getting better at blending in. The fake “nodejs-smtp” package posing as Nodemailer and a swarm of ten typosquatted npm packages prove it. These weren’t one-off prank packages tossed onto the registry, they behaved like legitimate libraries while performing post-install tricks that turn normal developer workflows into an attack surface.

Both incidents share the same playbook: abuse the packaging and install steps. In the nodejs-smtp case the attacker unpacked and modified an app archive and repackaged it; in the recent npm cluster the payload is triggered automatically via postinstall hooks, spawns a separate terminal to run an obfuscated loader, shows a fake CAPTCHA and then pulls a large PyInstaller stealer. That stealer targets system keyrings, browsers, SSH keys and other persisted secrets on Windows, Linux and macOS, exactly the kinds of credentials developers and CI systems rely on every day.

Vetting dependencies is necessary but no longer sufficient. Teams need visibility and controls that extend beyond “what” is pulled from npm or PyPI to cover “what happens next” packaging, install scripts, build artifacts and runtime behavior. Postinstall hooks, repackaging steps, and terminal-spawned payloads are all legitimate mechanisms that attackers now weaponize, so they deserve attention.

Operationally that means treating installs and builds as untrusted execution: run package installs in ephemeral, isolated CI containers; require reproducible builds and signed artifacts; scan for postinstall hooks and typosquatted names before they reach CI; monitor outbound connections from build hosts; and lock down access to OS credential stores (or use vaults that don’t expose plaintext secrets). Add integrity checks and SBOMs into the pipeline so you can detect unexpected changes to archives and binaries early.

In short: shrink the implicit trust you place in the build and install process. The boundary that used to stop at “dependency X is okay” has moved and attackers are now weaponizing packaging and install-time behavior to reach secrets and persistence. If you only scan package names and static source, you’ll miss the parts of the pipeline where real compromise happens.”

Developers are a key part of security. Thus they need to make sure everything that they do is focused on putting out code that is secure by default. These days it’s a requirement to do so.

When a “Contact Us” Form Becomes “Contact a Cybercriminal” 

Posted in Commentary with tags on October 30, 2025 by itnerd

This morning, the KnowBe4 Threat Lab published a new threat alert regarding an emerging phishing attack whereby cybercriminals are exploiting companies through their ‘Contact Us’ or ‘Book Appointment’ forms. 

This alert breaks down how exactly these bad actors are leveraging these prevalent forms, examples of what it looks like, and the overall impact of such an impact. The alert finds that since September 11th, 2025, this attack form has begun to emerge, and predicts that it will only continue to increase as hackers hijack legitimate communications to meet their ends. 

For full details, the threat findings can be found here: https://blog.knowbe4.com/when-a-contact-us-form-becomes-contact-a-cybercriminal

Fortra Threat Hunts Reveal Emerging MITRE Attack Techniques 

Posted in Commentary with tags on October 30, 2025 by itnerd

Fortra Intelligence and Research Experts (FIRE) initiated more than 2,700 threat hunts across customer environments in August 2025. Using the MITRE ATT&CK framework, FIRE has identified and is sharing the top tactics and the most common techniques used in these attacks.

Identifying these evolving attacker behaviors is a key component to helping security teams strengthen defenses and disrupt threats before they escalate, in addition to understanding how threat actors are refining social engineering and cloud exploitation techniques.

You can read the research here: Top Threat Hunting Metrics & Outcomes | Fortra

Rogers Xfinity Pro Brings Canadians an Elevated WiFi Experience

Posted in Commentary with tags on October 30, 2025 by itnerd

Rogers today announced that Rogers Xfinity is bringing next-generation WiFi to more Canadians with Rogers Xfinity Pro. Our most elevated WiFi experience, available as an optional add-on for all Rogers Xfinity Internet plans, includes an upgrade to our best-in-class WiFi 7-enabled gateway with device prioritization and WiFi back up with Storm Ready WiFi to keep customers connected through the unexpected.

Rogers Xfinity Pro elevates in-home WiFi coverage and includes the best technology to enhance and extend customers’ home WiFi network for an even better experience. With Rogers Xfinity Pro, customers can Boost a Device to get the best possible WiFi connection to the device that matters most. The new monthly add-on also includes WiFi backup to stay connected during power or network outages with Storm-Ready WiFi.

The next-generation Rogers Xfinity Gateway, available with Rogers Xfinity Pro, includes trailblazing WiFi 7 technology that can deliver multi-gig speeds over WiFi and connect more devices – all on Canada’s most reliable internet*

To learn more about Rogers Xfinity Pro, visit rogers.com/rogers-xfinity-pro.