Latest CyberSec News by @thecyberpicker

81% of attacks are malware-free as AI-driven mimicry hides threats in trusted systems, increasing detection difficulty and risk.

Claude extension flaw enabled silent prompt injection via XSS and weak allowlist, risking data theft and impersonation until Feb 19, 2026 fix.

It hides inside developer tools, then monitors activity and steals data, turning a single infection into a wider risk across the supply chain.

This week in cybersecurity from the editors at Cybercrime Magazine

Russian police arrested a Taganrog resident believed to be the owner of LeakBase, a major online forum used by cybercriminals to buy and sell stolen data and hacking tools.

Five retail misconfigurations that expose customer data, from public file paths to misaligned identity policies and MFA gaps.

Researchers found a new skimmer using WebRTC to steal and send payment data, bypassing traditional security controls.

Validate your security posture with real attacker behavior using continuous, CTI-driven testing to uncover gaps and prove defenses work.

Coruna reuses Triangulation kernel exploits targeting iOS 13–17.2.1 devices, expanding attacks into mass exploitation campaigns.

An Armenian suspect was extradited to the United States to face criminal charges for allegedly helping manage RedLine, one of the most prolific infostealer malware operations in recent years.

In December, the Trump administration signed an executive order that neutered states’ ability to regulate AI by ordering his administration to both sue and withhold funds from states that try to do so. This action pointedly supported industry lobbyists keen to avoid any constraints and consequences on their deployment of AI, while undermining the efforts of consumers, advocates, and industry associations concerned about AI’s harms who have spent years pushing for state regulation. Trump’s actions have clarified the ideological alignments around AI within America’s electoral factions. They set down lines on a new playing field for the midterm elections, prompting members of his party, the opposition, and all of us to consider where we stand in the debate over how and where to let AI transform our lives...

Dissecting the supply-chain attack on LiteLLM – a multifunctional gateway used in many AI agents. Explaining the dangers of the malicious code and how to protect yourself.

La firme de Mountain View vient d'annoncer une migration complète vers la cryptographie post-quantique d'ici trois ans, bien plus tôt que ce que l'industrie anticipait. Une course contre-la-montre qui se matérialise déjà dans Android 17. La semaine de Google aura été chargée. Vingt-quatre heures après avoir publié

Courts are starting to question how platforms are built, not just what’s posted.

Russian authorities arrested the alleged LeakBase admin for running a marketplace selling stolen data since 2021.

WebRTC skimmer exploits PolyShell flaw since March 19, hitting 56.7% stores, enabling stealth data theft bypassing CSP.

Kaspersky GReAT experts look into the Coruna exploit kit targeting iPhones. We discovered that the kernel exploit for CVE-2023-32434 and CVE-2023-38606 is an updated version of the Operation Triangulation exploit.

The Armenian man faces three counts for his role for allegedly administering “one of the most prevalent infostealing malware variants in the world.”

GitHub is adopting AI-based scanning for its Code Security tool to expand vulnerability detections beyond the CodeQL static analysis and cover more languages and frameworks.

The shift suggests the tech titan is worried that 2035 is too late to wait to protect their systems, devices and data for the quantum age.

A Russian hacker got 2 years in prison, $100K fine, and $1.6M judgment for running a botnet used in ransomware attacks on U.S. firms.

Attacks leveraging the 'PolyShell' vulnerability in version 2 of Magento Open Source and Adobe Commerce installations are underway, targeting more than half of all vulnerable stores.

Posts about macOS malware, exploits, and tools

Threat actors are evading phishing detection in campaigns targeting Microsoft accounts by abusing the no-code app-building platform Bubble to generate and host malicious web apps.

Experts said companies rushing to buy AI services risked letting their existing, still-vital defensive measures deteriorate.

Posts about macOS malware, exploits, and tools

Read the latest Microsoft Secure Access report for insights into why a unified identity and access strategy offers strong modern protection.

A new info-stealing malware called Torg Grabber is stealing sensitive data from 850 browser extensions, more than 700 of them for cryptocurrency wallets.