Latest CyberSec News by @thecyberpicker

US, UK and Canada ran Operation Atlantic, uncovering $45M in crypto theft and freezing $12M to return to victims.

A look at 2025 state-sponsored threats, exploring how actors linked to China, Russia, North Korea, and Iran use vulnerabilities, identity, and trusted access paths to achieve their goals.

Google adds a Rust-based DNS parser to Pixel 10 modem firmware, reducing memory vulnerabilities and strengthening defenses against baseband exploits.

Dans un article de blog publié le 13 avril 2026, les équipes de recherche de Socket révèlent que, pendant plusieurs mois, 108 extensions Chrome apparemment anodines ont secrètement œuvré pour le compte d’un même opérateur, exfiltrant des sessions, des identifiants Google et des données de navigation vers

Stolen credentials remain a top breach vector, often leading to unchecked privilege escalation. Specops explains how identity-first Zero Trust limits access, enforces device trust, and blocks lateral movement.

Learn how to turn CCM/CAIQ work into reusable, citeable evidence pages that buyers can trust, boosting credibility without spammy marketing.

This week in cybersecurity from the editors at Cybercrime Magazine

Posts about macOS malware, exploits, and tools

A critical RCE flaw, tracked as CVE-2025-0520, in ShowDoc is being actively exploited, putting unpatched servers at serious risk.

This malware is coming for your password managers, saved logins, cloud storage, crypto wallets, and just about anything else it can reach.

Mirax Android RAT spreads via Meta ads reaching 220,000 accounts, enabling proxy abuse and fraud operations.

For years, quantum risk was easy for most institutions to treat as premature: real in theory, urgent someday, but not yet an operational problem. That is no longer tenable. Related: AI spawns semantic attacks Two developments this month brought the shift into focus. Google Quantum AI published research suggesting the computing resources needed to break

Interesting paper: “What hackers talk about when they talk about AI: Early-stage diffusion of a cybercrime innovation.” Abstract: The rapid expansion of artificial intelligence (AI) is raising concerns about its potential to transform cybercrime. Beyond empowering novice offenders, AI stands to intensify the scale and sophistication of attacks by seasoned cybercriminals. This paper examines the evolving relationship between cybercriminals and AI using a unique dataset from a cyber threat intelligence platform. Analyzing more than 160 cybercrime forum conversations collected over seven months, our research reveals how cybercriminals understand AI and discuss how they can exploit its capabilities. Their exchanges reflect growing curiosity about AI’s criminal applications through legal tools and dedicated criminal tools, but also doubts and anxieties about AI’s effectiveness and its effects on their business models and operational security. The study documents attempts to misuse legitimate AI tools and develop bespoke models tailored for illicit purposes. Combining the diffusion of innovation framework with thematic analysis, the paper provides an in-depth view of emerging AI-enabled cybercrime and offers practical insights for law enforcement and policymakers...

Sansec found over 200 live PrestaShop stores with their install directory publicly accessible. An attacker can overwrite the database configuration, gain adm...

Leak of 8.1GB data tied to Rockstar Games includes anti-cheat code, game data, analytics and more, reportedly exposed by ShinyHunters.

With Secretary Markwayne Mullin now confirmed at DHS, the Senate must prioritize Sean Plankey as CISA Director to protect U.S. critical infrastructure from rising Iranian and Chinese cyber threats.

Critical risk surged nearly 400% as AI-driven development increased vulnerabilities across 250 organizations.

New cases and research suggest AI chatbots don’t always shut down dangerous conversations.

Dans une note publiée le 13 avril 2026, l'agence américaine de cybersécurité (CISA) lance l'alerte : des cybercriminels s'appuient encore aujourd'hui sur des failles dans des logiciels Microsoft, dont certaines ont pourtant été corrigées il y a plus d'une décennie. KEV, pour Known Exploited Vulnerabilities, voilà le

108 Chrome extensions routed stolen Google and Telegram data to shared C2 infrastructure, impacting 20,000 users.

U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog.

CISA adds six exploited vulnerabilities, including Fortinet and Exchange flaws, requiring FCEB patching by April 27, 2026.

ShowDoc CVE-2025-0520 exploited due to unpatched versions before 2.8.7, enabling remote code execution on 2,000+ instances.

Two reports from former high-level U.S. cyber officials and the UK government’s top AI research institution reveal how top defenders think about the tool’s hacking capabilities.

Dutch fitness giant Basic-Fit announced that hackers breached its systems and gained access to information belonging to a million of its customers.

The company said a developer tool automatically retrieved a malicious version of the popular open-source library, but insists the integrity of its systems and software were not impacted.

Hackers accessed some Booking.com user data, including names, emails, phone numbers, and booking details. The issue is now contained.

A critical vulnerability in the wolfSSL SSL/TLS library can weaken security via improper verification of the hash algorithm or its size when checking Elliptic Curve Digital Signature Algorithm (ECDSA) signatures.

Rockstar Games has suffered a data breach linked to a recent security incident at Anodot, with the ShinyHunters extortion gang now leaking the stolen data on its data leak site.