Latest CyberSec News by @thecyberpicker

A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensitive codes from mobile devices.

A phishing campaign hit 35,000 users in 26 countries, stealing login tokens via fake code-of-conduct emails and legit services.

A Latvian national extradited to the United States was sentenced to 8.5 years in prison for his "cold case" negotiator role in the Russian Karakurt ransomware group.

ScarCruft spreads BirdCall via sqgame.net since late 2024, targeting Android users, enabling surveillance and data theft.

The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform.

Microsoft disclosed a credential theft campaign targeting 35,000+ users at 13,000+ organizations across 26 countries.

CVE-2026-22679 exploited via debug endpoint in Weaver E-cology before 20260312, enabling RCE and system compromise.

Instructure, maker of the Canvas learning platform, is investigating a cyber incident that exposed users’ personal data.

The actively exploited defect could affect every mainstream Linux distribution built since 2017, but some researchers found Theori’s AI-generated disclosure unhelpful and lacking.

Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands.

Progress fixes critical MOVEit Automation flaws, including an auth bypass bug that could let attackers gain unauthorized access to systems.

Attackers exploit a critical cPanel flaw to target government and MSP networks across Southeast Asia and several countries.

The Amazon Simple Email Service (SES) is being increasingly abused to send convincing phishing emails that can bypass standard security filters and render reputation-based blocks ineffective.

VENOMOUS#HELPER phishing campaign active since April 2025 has impacted 80+ organizations, mainly in the U.S., using SSA-themed lures.

A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a credential-stealing payload targeting browsers, environment files, and cloud services.

MOVEit Automation flaws (CVE-2026-4670, CVE-2026-5174) enable bypass and escalation, risking enterprise data exposure.

A 19-year-old influencer is suing the dating app Meete, alleging the company misappropriated her TikTok videos and used geofencing to target "friends with benefits" ads to men in her own college dormitory.

Cybersecurity firm Trellix disclosed a data breach after attackers gained access to "a portion" of its source code repository.

Researchers warn that threat activity continues to surge, including brute force attacks and ransomware.

Fin avril 2026, les autorités américaines ont levé le voile sur une industrie structurée de l’arnaque aux cryptomonnaies, organisée depuis l’Asie du Sud-Est. Derrière des centaines de sites d’investissement, une opération d’ampleur révèle un système mêlant fraude financière, blanchiment et traite d’êtres humains.

This week on the Lock and Code podcast, we speak with Eva Velasquez about small business cyberattacks and the "cyber tax" coming for us all.

Weekly cybersecurity news: Critical cPanel flaw under attack, Copy Fail Linux privilege escalation, TeamPCP supply chain campaign, GitHub RCE & major

Progress Software warned customers to immediately upgrade to versions of the file-transfer tool that fix the serious flaws.

Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation. CVE-2025-40271 . local exploit for Linux platform

Linux nf_tables 6.19.3 - Local Privilege Escalation. CVE-2026-23231 . local exploit for Linux platform

Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE). CVE-2025-60690 . hardware exploit for Multiple platform

MindsDB 25.9.1.1 - Path Traversal. CVE-2026-27483 . webapps exploit for Multiple platform