Latest CyberSec News by @thecyberpicker

The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the weekend.

Microsoft fixed a critical Copilot Enterprise Search flaw that could expose emails, calendars, and indexed files through one trusted link.

Dozens of practitioners said the decision to place export controls on the foreign use of Fable are misguided, and recent jailbreak reports don’t show the model providing unique hacking capabilities.

See how Microsoft Defender performed in one year of real-world email security benchmarking against SEG and ICES vendors.

The U.S. Federal Bureau of Investigation (FBI) warned that criminals are using couriers to collect money from victims of cryptocurrency investment scams, also known as pig butchering or romance baiting.

A report links a sophisticated espionage effort targeting information about viruses, AI and military information.

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

This week’s recap covers exploited flaws, supply chain attacks, phishing kits, AI lures, macOS stealers, urgent CVEs, tools, and webinars.

This week on the Lock and Code podcast, we revisit an episode from 2024 with David Chiu that shows the progress made against deepfake porn.

Anthropic has been ordered by the US government to cut off its newest Claude Fable 5 and Mythos 5 models for fear of abuse

Posts about macOS malware, exploits, and tools

A China-linked espionage campaign targeted exposed REDCap servers to deploy the InfiniteRed malware and steal sensitive data from a medical institution in North America.

Employees are increasingly building automations, agents, and apps with AI tools outside traditional security oversight. Tines explores how CISOs are handling AI-driven code sprawl, shadow tooling, and governance challenges.

Aztec Connect, une plateforme de confidentialité sur Ethereum mise hors service en 2023, vient d'être vidée de ses fonds par un attaquant qui a exploité une faille dans sa logique de vérification cryptographique. Le dimanche 14 juin 2026, un hacker non identifié est parvenu à siphonner 2,19 millions de dollars des

Posts about macOS malware, exploits, and tools

A critical vulnerability chain dubbed SearchLeak in Microsoft 365 Copilot Enterprise could allow attackers to steal sensitive data from a target's mailbox, OneDrive, or SharePoint account through a specially crafted URL.

This week in cybersecurity from the editors at Cybercrime Magazine

Novo Nordisk suffered a cyberattack where clinical trial data was copied, but no threat actor has claimed responsibility

The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the widely used Infinite Campus K-12 student information system in March.

The information-sharing group, a vital resource for state and local governments, has cut staff and pinned its hopes on a membership surge.

Temporary onboarding passwords sent by email or SMS can expose corporate accounts when they are reused, intercepted, or never changed.

Modern phishing, BEC, and account takeover attacks increasingly bypass traditional email defenses and create operational strain for security teams. This webinar explores how behavioral AI can help automate detection, investigation, and remediation to reduce alert fatigue and accelerate response times.

Tampered JavaScript in three Awesome Motive plugins exposed WordPress sites to rogue admin accounts and hidden backdoors.

Researchers found 152 Chrome extensions with 105,000 installs tied to adware, data collection, and fake Google organic traffic.

Palo Alto Networks warns that attackers actively exploit CVE-2026-0257, a PAN-OS flaw that lets unauthorized users bypass authentication.

A proposed FCC rule would kill burner phones: phones whose accounts are not attached to a particular person. The FCC plans to do this by legally forcing the country’s telecoms to store a wealth of personal information about essentially all phone customers, including a government issued identification number and their physical address, alarming privacy advocates and civil rights activists who compare the measures to those from authoritarian countries where it can be difficult to buy a mobile phone plan without giving up your identity. The proposed change would drastically shake up how people obtain phone plans in the U.S., and have all sorts of privacy and cybersecurity knock-on effects. The FCC is proposing the data collection partly as a way to combat scammers, with telecoms being required to collect other information on business and foreign customers like the intended use case of their bulk phone plan purchase and their IP address. But the changes would mean telecoms collect data on all new and renewing customers, and the FCC provides a long list of other things that the collected data could help authorities with...

Attackers compromised Awesome Motive CDN files, backdooring WordPress sites running OptinMonster, TrustPulse, and PushEngage.

CVE-2026-0257 GlobalProtect authentication bypass hit active exploitation four days after disclosure. Two attack waves tracked, CISA KEV listed. Act now.

A list of topics we covered in the week of June 8 to June 14 of 2026