EU court adviser says banks must immediately refund phishing victims

Multiple security and legal developments: an EU CJEU adviser recommended banks must immediately refund customers for unauthorized transactions (including phishing) even when user error is involved; threat actors are abusing the special-use .arpa domain and IPv6 reverse DNS to evade phishing/domain-reputation checks; Termite/Velvet Tempest campaigns use ClickFix social engineering and legitimate Windows utilities to deploy DonutLoader and the CastleRAT backdoor; Microsoft reports widespread attacker use of AI across attack stages; Cognizant TriZetto suffered a breach exposing ~3.4 million患者/ins