Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
Humanity Protocol Taps Mastercard Open Finance to Bridge Web3 Identity and Traditional Banking
Humanity Protocol is integrating its palm-biometric “Human ID” framework with Mastercard’s open finance network to connect decentralized digital identity with traditional banking systems. The integration allows users to verify financial data such as income or account ownership through zero-knowledge proofs, enabling privacy-preserving access to credit and loans. By combining reusable KYC with biometric proof-of-personhood, users can establish one verified identity across both Web3 and regulated finance. The rollout will begin in the U.S., marking Humanity Protocol’s expansion beyond crypto ecosystems and into fintech. The company, now valued at over $1 billion after raising $50 million this year, says the partnership enables users to prove eligibility “without time-consuming manual processes.”
Nordic-Baltic Ministers Adopt Joint Declaration for EUDI Wallet Certification
Digital ministers from Nordic and Baltic nations have signed a declaration to create a shared certification scheme for European Digital Identity (EUDI) Wallets, ensuring security and cross-border interoperability ahead of the EU’s 2026 deadline. The initiative aims to prevent fragmentation by harmonizing technical and privacy standards across the region, effectively creating a “roaming” system for digital IDs. Ministers identified “identity matching” across national registries as a key challenge but said joint certification would smooth adoption. By defining consistent compliance benchmarks early, the bloc positions itself to set the de facto standard for wallet certification in Europe and influence private-sector implementation.
CISA Issues Critical 9.8 CVSS Advisory for Survision LPR Camera Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical 9.8 CVSS advisory for Survision’s License Plate Recognition Cameras, warning that all versions lack authentication by default. Attackers can remotely access configuration controls without credentials, granting full system access to live feeds, logs, and network pivot points. The vulnerability, CVE-2025-12108, violates basic “secure-by-default” principles and affects installations across commercial facilities. Firmware v3.5 adds authentication but requires users to enable passwords manually and define limited access roles. CISA advises immediate patching and password enforcement to prevent potential exploitation in physical-security environments.
Microsoft Teams Vulnerabilities Allowed Executive Impersonation, Forged Caller ID
Check Point Research disclosed four critical vulnerabilities in Microsoft Teams that allowed attackers to impersonate executives, alter messages, and forge caller identities. Exploits included manipulating displayName parameters to make fraudulent calls appear to come from trusted contacts, spoofing notifications, editing messages without trace, and relabeling chats. The flaws could have enabled Business Email Compromise–style fraud via voice and video channels. Microsoft patched the issues following responsible disclosure, with all vulnerabilities resolved by October 2025. The findings highlight how collaboration platforms have become prime vectors for social-engineering attacks exploiting user-interface trust.
Google Warns of State-Sponsored “Just-in-Time AI” Malware Evading Detection
Google’s Threat Intelligence Group reports that state-sponsored hackers are deploying generative AI to build adaptive “just-in-time” malware capable of rewriting its code in real time to bypass endpoint detection. The malware represents an evolution beyond polymorphic attacks by analyzing local defenses and generating new payloads “on the fly.” GTIG attributes the activity to groups in North Korea, Iran, and China, marking the operational arrival of AI-driven cyber weapons. The report warns that signature-based antivirus models are now obsolete, urging a shift toward behavioral AI defenses that detect malicious intent rather than static code patterns.
Identy.io Achieves Perfect Score in iBeta Level 2 Liveness Detection Test
Identy.io’s Face SDK v6.3.0 achieved a perfect 0 percent attack-error rate in iBeta’s ISO/IEC 30107-3 Level 2 presentation-attack test, successfully blocking 1,500 spoof attempts using masks, 3D prints, and deepfakes. Only one false rejection occurred among 550 genuine users. The certification underscores the growing importance of third-party validation amid an expanding deepfake threat landscape, as transaction volumes using facial liveness checks are projected to exceed 50 billion annually by 2027. Identy.io claims to be the only mobile vendor certified for both server-based and full on-device processing, addressing industry demand for privacy-preserving yet scalable liveness verification.
Bulgarian eID Provider Evrotrust Raises $7.5M for European Expansion
Sofia-based Evrotrust has raised €6.6 million (US$7.5 million) led by 3TS Capital Partners to expand its qualified trust and eID services across Central and Eastern Europe and the DACH region. Already Bulgaria’s official national digital-identity provider with 1.8 million users, Evrotrust operates as a Qualified Trust Service Provider under EU law. The funding positions it to meet rising demand ahead of the 2026 EUDI Wallet deadline, offering a turnkey, scalable model for other member states. Prior backers include the Bulgarian Development Bank and Silverline Capital, with total financing exceeding €12 million.
MOSIP Releases ‘Inji Certify’ Developer Tool for Verifiable Credential Issuance
MOSIP has launched Inji Certify v0.12.2, an open-source tool for issuing verifiable credentials (VCs) under the OpenID4VCI standard. The release adds APIs for Certificate Authority integration and certificate-management workflows, moving MOSIP from foundational to functional identity. Inji Certify, together with Inji Wallet and Inji Verify, forms a complete open-source VC stack enabling governments, universities, and employers to issue and verify credentials across ecosystems. The initiative positions MOSIP as the “Linux for digital identity,” offering a non-proprietary alternative to closed commercial frameworks as global adoption of open identity rails accelerates.
iProov First to Meet New NIST Biometric Verification Requirements
iProov has become the first vendor to meet the U.S. National Institute of Standards and Technology’s updated SP 800-63-4 Digital Identity Guidelines for biometric verification and liveness. Independent testing confirmed compliance with new anti-deepfake and injection-attack standards at the highest assurance levels. iProov’s Dynamic Liveness system detects video injection and replay attacks using its Flashmark illumination process and real-time threat monitoring. The recognition reinforces its role in federal and enterprise digital-identity programs, with customers including ID.me and government agencies in the UK and U.S. The NIST alignment sets a benchmark for AI-resilient authentication across industries.
–
By the ID Tech Editorial Team