Reference #18.50200117.1777971336.4337902
https://errors.edgesuite.net/18.50200117.1777971336.4337902
Reference #18.50200117.1777971336.4337902
https://errors.edgesuite.net/18.50200117.1777971336.4337902
Voters in the US state of Ohio are set to go to the polls in the state’s primaries, where they will pick candidates for several key positions in the upcoming midterm elections in November.
The outcomes of several races in the Midwestern state could have important implications for the crucial midterms, widely seen as a referendum on United States President Donald Trump’s second term and as a vote that will decide which party controls Congress for the remainder of his time in office.
When does voting take place, which races are being watched, and who are some of the main candidates? We answer those questions and more in this brief explainer.
The Ohio primary will take place on Tuesday, May 5, 2026.
Polls will open on Election Day at 6:30am local time (10:30 GMT) and close at 7:30pm (23:30 GMT).
Voters will have the chance to choose candidates in primaries for races for the US Senate, US House, governor, attorney general, secretary of state, treasurer, state supreme court, state senate and state house.
The special election for one of Ohio’s two US Senate seats and the race to replace Republican Governor Mike DeWine have attracted the most attention due to their ties to national politics.
In the gubernatorial race, Trump-backed former presidential candidate and tech entrepreneur Vivek Ramaswamy is facing off against internet personality Casey Putsch for the Republican nomination.
That race could test how much influence Trump still holds as a potential kingmaker with Republican voters.
The Ohio Senate race is also essential for the Democratic Party’s hopes of recapturing the US Senate, where Republicans currently hold a slim majority, in November. Former US Senator Sherrod Brown, a Democrat, is seeking to return to the Senate after losing his seat to a Republican challenger in 2024.
Amy Acton, the former head of Ohio’s Department of Health, is running unopposed in the Democratic gubernatorial primary and will face the Republican primary winner in November.
The Republican primary is more contested. While Ramaswamy has emerged as the party’s frontrunner, he faces a challenge from the populist right by Putsch, an auto racing engineer and right-wing political commentator.
Putsch, who the Associated Press reported had less than $9,000 in his campaign account at the end of April compared with $31m for his rival, has pitched himself as a more earnest representative of Trump’s “America First” ideology than Ramaswamy.
Ramaswamy has the endorsement of the state Republican Party as well as Trump himself, who called him “young, strong, and smart” while offering his “complete and total endorsement” in a social media post in November.
A third Republican candidate, Heather Hill, was disqualified after her running mate for lieutenant governor withdrew from the race, after the two spent several days exchanging insults over social media. Her name will still appear on the ballot, but her votes will not be counted.

The US Senate race in Ohio is expected to be one of the closest of the midterms and an important step towards the Democratic Party’s goal of snatching the majority from Republicans.
The special election will fill a Senate seat vacated by Vice President JD Vance, who was elected as Trump’s running mate in 2024.
Jon Husted, who was appointed to fill the seat temporarily after Vance stepped down, is running as the incumbent, unchallenged Republican candidate.
Former Senator Sherrod Brown, who lost his 2024 re-election race to Republican challenger Bernie Moreno, is considered the frontrunner in the Democratic primary.
He is facing Ron Kincaid for the Democratic nomination, but maintains a strong fundraising and name recognition advantage. Polls anticipate a tight race between Brown, considered the presumptive Democratic nominee, and Husted in November.
Ohio requires voters to show a form of identification, including a state driver’s licence, state ID card, passport, or military ID card.
IDs must be current and include a photograph and the voter’s name as it appears on the poll list to be accepted.
Republican lawmakers have long called for more stringent voter identification requirements, which they say are essential to safeguarding election integrity.
There is no evidence of widespread voter fraud in the US, but President Trump and his allies have used false claims of rampant illegal voting to push for greater restrictions on access to voting, including through methods such as mail-in ballots.

Any registered voter can participate in any party’s primary elections. The state does not register voters by party, but considers voters affiliated with the party if they participate in its primary.

Reference #18.c5d07868.1777970671.c8c0ca1
https://errors.edgesuite.net/18.c5d07868.1777970671.c8c0ca1
Reference #18.2d4adc17.1778019064.12303a8
https://errors.edgesuite.net/18.2d4adc17.1778019064.12303a8
Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate email services to direct users to attacker-controlled domains and steal authentication tokens.
The multi-stage campaign, observed between April 14 and 16, 2026, targeted more than 35,000 users across over 13,000 organizations in 26 countries, with 92% of the targets located in the U.S. The majority of phishing emails were directed against healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%) sectors.
“The lures in this campaign used polished, enterprise-style HTML templates with structured layouts and preemptive authenticity statements, making them appear more credible than typical phishing emails and increasing their plausibility as legitimate internal communications,” the Microsoft Defender Security Research Team and Microsoft Threat Intelligence said.
“Because the messages contained accusations and repeated time-bound action prompts, the campaign created a sense of urgency and pressure to act.”
The email messages used in the campaign employ lures related to code of conduct reviews, using display names like “Internal Regulatory COC,” “Workforce Communications,” and “Team Conduct Report.” Subject lines associated with these emails include “Internal case log issued under conduct policy” and “Reminder: employer opened a non-compliance case log.”
“At the top of each message, a notice stated that the message had been ‘issued through an authorized internal channel’ and that links and attachments had been ‘reviewed and approved for secure access,’ reinforcing the email’s purported legitimacy,” Microsoft explained.
It’s assessed that the emails are sent from a legitimate email delivery service. The messages also come with a PDF attachment that purportedly gives additional information about the conduct review, luring victims to click on a link within the document to initiate the credential harvesting flow.
The attack chain has been found directing victims through multiple rounds of CAPTCHA and intermediate pages that are designed to lend the scheme a veneer of legitimacy, at the same time keeping out automated defenses.
Ultimately, it ends with a sign-in experience that leverages adversary‑in‑the‑middle (AiTM) phishing tactics to harvest Microsoft credentials and tokens in real-time, effectively allowing the threat actors to bypass multi-factor authentication (MFA). The final destination, per Microsoft, depends on whether the malicious flow was triggered from a mobile device or a desktop system.
The disclosure comes as Microsoft’s analysis of the email threat landscape between January and March 2026 revealed that QR code phishing emerged as the fastest-growing attack vector, while CAPTCHA-gated phishing evolved “rapidly” across payload types. In all, the tech giant said it detected about 8.3 billion email-based phishing threats.
Of these, nearly 80% were link-based, where large HTML and ZIP files accounted for a huge chunk of the malicious payloads distributed via phishing emails. The end goal of a vast majority of these attacks was credential harvesting, with malware delivery declining to a mere 5-6% by the end of the quarter.
Microsoft also said the operators of the Tycoon 2FA phishing-as-a-service (PhaaS) platform have attempted to shift hosting providers and domain registration patterns following a coordinated disruption operation in March 2026.
“Toward the end of March, we saw Tycoon 2FA moving away from Cloudflare as a hosting service and now hosts most of its domains across a variety of alternative platforms, suggesting the group is attempting to find replacement services that offer comparable anti-analysis protections,” it added.
In a report published back in February, Palo Alto Networks Unit 42 highlighted how threat actors are abusing QR codes as URL shorteners to disguise malicious destinations, in-app deep links to steal account credentials, and bypass app store security by linking to direct downloads of malicious apps.
Data from Microsoft shows a massive surge in QR code phishing during the three-month time period, as attack volumes jumped from 7.6 million in January to 18.7 million in March, representing a 146% increase. One notable development observed in late March was the use of QR codes embedded directly in email bodies.
Business email compromise (BEC) scams, on the other hand, exhibited more fluctuations, crossing more than 4 million in attack volume in March 2026, up from over 3.5 million in January and more than 3 million in February. Collectively, 10.7 million BEC attacks were recorded.
Two noteworthy campaigns observed during Q1 2026 are below –
“Interestingly, although messages in this campaign shared common tooling, structure, and delivery characteristics, the infrastructure hosting the final phishing payload was linked to multiple different PhaaS providers,” Microsoft said. “Most observed phishing endpoints were associated with Tycoon 2FA, while additional activity was linked to Kratos (formerly Sneaky 2FA) and EvilTokens infrastructure.”
The findings coincide with the emergence of phishing and BEC campaigns that abuse Amazon Simple Email Service (SES) as a delivery vector to bypass SPF, DKIM, and DMARC checks, and facilitate credential theft via phony sign-in pages. These attacks often work by gaining access to Amazon SES through leaked AWS access keys.
“The insidious nature of Amazon SES attacks lies in the fact that attackers aren’t using suspicious or dangerous domains; instead, they are leveraging infrastructure that both users and security systems have grown to trust,” Kaspersky said.
“By weaponizing this service, attackers avoid the effort of building dubious domains and mail infrastructure from scratch. Instead, they hijack existing access keys to gain the ability to blast out thousands of phishing emails. These messages pass email authentication, originate from IP addresses that are unlikely to be blocklisted, and contain links to phishing forms that look entirely legitimate.”
Iranian officials have responded to accusations that Tehran launched a barrage of missiles and drones at the UAE, setting an oil refinery ablaze. Al Jazeera’s Resul Serdar says comments from Iran’s foreign minister and military leaders neither confirm nor deny responsibility.
Published On 5 May 2026

Reference #18.f3680117.1777970123.5a061a7e
https://errors.edgesuite.net/18.f3680117.1777970123.5a061a7e
The incident is the latest test of a fragile ceasefire agreed between the two countries last month.
Published On 5 May 2026
Afghanistan’s Taliban-led government has accused neighbouring Pakistan of killing three civilians in a cross-border attack, which Kabul has condemned as a “war crime”.
The incident on Monday marked the latest test of a fragile ceasefire between the two countries, brokered by China in April, following months of cross-border fighting that left hundreds dead and injured.
Afghanistan’s deputy government spokesman, Hamdullah Fitrat, said on X that 14 others were injured in the attack. He accused Islamabad of deliberately targeting civilian infrastructure, including homes, schools, a health centre, and mosques in Dangam, Kunar province, which lies along the border with Pakistan.
Islamabad has dismissed the allegations. The Ministry of Information and Broadcasting suggested Kabul may have staged the destruction, saying in a post on X that images released by Afghanistan showed damage inconsistent with artillery strikes. It said the incident could be part of a “propaganda effort” to discredit Pakistan, following cross-border attacks in March and April that killed nine people and that Islamabad blamed on its neighbour.
The rise in tensions comes as one person was killed late on Monday in Pakistan’s Khyber Pakhtunkhwa province, near the Afghan border, when security forces foiled a suicide attack at a checkpoint.
Several others were injured as security personnel opened fire on the attacker’s car, which was packed with explosives and heading towards a military post. The vehicle exploded before reaching its target.
Director of the Pak Institute for Peace Studies (PIPS) Muhammad Amir Rana told Al Jazeera that Pakistan faces multiple challenges in carrying out cross-border attacks.
“Precision is a real problem for Pakistan when it comes to its cross-border strikes. Effective and foolproof intelligence is the critical missing link – without it, controlling collateral damage becomes the central challenge. What we are also seeing is that Pakistan’s security situation has worsened considerably since the war on Iran began on February 28,” he said.
Rana added he was not hopeful of a diplomatic breakthrough anytime soon.
“Pakistan’s diplomatic capital is growing and it is not willing to offer any concessions to Kabul, while the Afghan side is asking why it should concede anything,” he said.
Islamabad accuses Afghanistan of harbouring Tehrik-e Taliban Pakistan (TTP), a Pakistani offshoot of the Afghan Taliban that is waging an armed rebellion against the government. Kabul denies the accusation.
Reference #18.50200117.1777969982.4284745
https://errors.edgesuite.net/18.50200117.1777969982.4284745
Reference #18.49200117.1777969508.476068
https://errors.edgesuite.net/18.49200117.1777969508.476068