Latest CyberSec News by @thecyberpicker

A $30,000 AI GPU doesn't outperform consumer GPUs at password cracking. Specops explains why attackers don't need exotic hardware to break weak passwords.

The FBI, NCSC, and Microsoft warn of an ongoing Russian campaign hijacking DNS settings on home and small office routers to spy on users.

Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.”

A practical checklist to secure AI agents within enterprise identity frameworks—authentication, authorization, token vaulting, and a unified control plane.

This week in cybersecurity from the editors at Cybercrime Magazine

Anthropic unveiled Claude Mythos, a powerful AI for cybersecurity that could also be misused to enhance cyberattacks.

46% of identity activity sits outside IAM visibility, enabling hidden risk and privilege gaps across enterprise systems.

Depuis la création de Bitcoin, la question de l’identité de Satoshi Nakamoto est devenue un mystère quasi mythologique pour la sphère crypto. Dans une longue enquête parue le 8 avril 2026, Le New York Times revient sur cette énigme, pointant cette fois directement du doigt un visage connu de la communauté : Adam

Anthropic's Mythos Preview and Glasswing spark a defense view on patching, inventory, segmentation, and Zero Trust—with practical steps to harden systems now.

This is news: A malicious supply chain compromise has been identified in the Python Package Index package litellm version 1.82.8. The published wheel contains a malicious .pth file (litellm_init.pth, 34,628 bytes) which is automatically executed by the Python interpreter on every startup, without requiring any explicit import of the litellm module. There are a lot of really boring things we need to do to help secure all of these critical libraries: SBOMs, SLSA, SigStore. But we have to do them.

Authorities warn that Mexican drug cartels are targeting timeshare owners with advance-fee fraud. Here’s what to watch for.

In this report, Kaspersky experts share their insights into the 2025 financial threat landscape, including regional statistics and trends in phishing, PC malware, and infostealers.

Claude Mythos finds thousands of zero-days as Anthropic launches Project Glasswing, enhancing defenses but exposing AI security risks.

CIS CTI has identified an ongoing Vimeo-themed phishing campaign impacting U.S. SLTTs. Read the team's analysis to learn how to stay safe.

Over 1,700 malicious packages since Jan 2025 fuel cross-ecosystem supply chain attacks, enabling espionage and financial theft.

U.S. agencies warn Iran-linked threat actors are targeting internet-exposed PLCs used in critical infrastructure networks.

Alors qu'Anthropic officialisait, le 7 avril 2026, le lancement de Claude Mythos Preview, son modèle le plus puissant à ce jour, c'est un incident documenté dans la fiche technique du modèle qui a capté l'attention : une version antérieure du modèle a réussi à s'échapper de son environnement de test et à contacter un

Microsoft has pushed a server-side fix for a known issue that broke the Windows Start Menu search feature on some Windows 11 23H2 devices.

Iran-linked actors target U.S. PLCs using Dropbear and SSH access, disrupting OT systems across sectors and escalating cyber conflict.

Forest Blizzard, a threat group attributed to Russia’s GRU, hijacked network traffic to steal credentials and tokens for Microsoft accounts and other services.

A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows uploading arbitrary files without authentication, which can lead to remote code execution.

Attackers are exploiting a critical Flowise flaw CVE-2025-59528 to run arbitrary code and access systems via unvalidated JavaScript.

Le 7 avril 2026, Anthropic a officiellement lancé Project Glasswing, une initiative de cybersécurité adossée à son nouveau modèle Claude Mythos Preview. Un modèle jugé si dangereux que l'entreprise refuse de le rendre public. L'erreur de configuration était donc vraie. Plus d'une semaine après qu'une fuite interne

U.S. victims lost nearly $21 billion to cyber-enabled crimes last year, driven primarily by investment scams, business email compromise, tech support fraud, and data breaches, the Federal Bureau of Investigation says.

Over a dozen companies have suffered data theft attacks after a SaaS integration provider was breached and authentication tokens stolen.

A malware campaign uses WhatsApp messages to deliver VBS scripts that initiate a multi-stage infection chain. The attack leverages renamed Windows tools and cloud-hosted payloads to install MSI backdoors and maintain persistent access to compromised systems.

U.S. agencies issued an urgent warning that Iran-linked hackers are disrupting PLC, HMI and SCADA systems at U.S. energy and water facilities, causing losses.

Anthropic unveils Project Glasswing with major tech partners, using an unreleased model to find and fix long-hidden software vulnerabilities.