Latest CyberSec News by @thecyberpicker

A CSA-Thales report shows AI can boost security only when data visibility and governance foundations are in place for unstructured data.

Qilin disables 300+ EDR drivers using BYOVD in 2025 attacks, delaying encryption six days, increasing breach impact.

BKA identified REvil leaders tied to 130 German attacks causing €35.4M damage, exposing key ransomware figures.

Posts about macOS malware, exploits, and tools

Threat actors abused trusted Trivy distribution channels to inject credential‑stealing malware into CI/CD pipelines worldwide. This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks.

Read the latest Microsoft Secure Access report for insights into why a unified identity and access strategy offers strong modern protection.

A list of topics we covered in the week of March 30 to April 5 of 2026

Posts about macOS malware, exploits, and tools

Fortinet issued emergency patches for a critical FortiClient EMS flaw (CVE-2026-35616) actively exploited in the wild.

An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and…

This week on the Lock and Code podcast, we speak with Peter Asaro about killer robots, how to stop them, and their obvious consequences.

Posts about macOS malware, exploits, and tools

Scammers are sending fake "Notice of Default" traffic violation text messages impersonating state courts across the U.S., pressuring recipients to scan a QR code that leads to a phishing site demanding a $6.99 payment while stealing personal and financial information.

Posts about macOS malware, exploits, and tools

$285M stolen after six-month DPRK social engineering campaign began fall 2025, exposing Drift’s contributors and cloud assets.

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.

Une immersion de quatre ans dans le darknet révèle la façon dont les vendeurs de drogue et les administrateurs de marchés noirs parlent de leur activité, à travers des témoignages exclusifs. Loin de la représentation chaotique qui est habituellement faite de cette partie invisible d’Internet, ils se décrivent comme

Hackers are running a large-scale campaign to steal credentials in an automated way after exploiting React2Shell (CVE-2025-55182) in vulnerable Next.js apps.

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs.

A malicious email delivered a .cmd malware that escalates privileges, bypasses antivirus, downloads payloads, and self-deletes

Dans le jargon de la cybersécurité, le dwell time (ou temps de présence) est une statistique scrutée à la loupe. Elle représente le temps qui s'écoule lors d'une intrusion informatique. Mais contrairement à ce que l'on pourrait penser de prime abord, la façon dont ce délai est calculé cache une subtilité importante.

On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages for version updates (1.14.1 and 0.30.4) to download from command and control (C2) that Microsoft Threat Intelligence has attributed to the North Korean state actor Sapphire Sleet. Although the malicious versions are no longer available for download, since Axios is one of the most widely used HTTP clients in the JavaScript ecosystem, this compromise exposed hundreds to potentially millions of users.

CVE-2026-35616 (CVSS 9.1) exploited since March 31, 2026, affects FortiClient EMS 7.4.5–7.4.6, enabling privilege escalation.

36 npm packages disguised as Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.

The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign believed to have been conducted by North Korean threat actors.

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

Qilin ransomware claims it stole data from Germany’s Die Linke and threatens to leak it; the party confirmed the incident, but not a breach.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in TrueConf Client to its Known Exploited Vulnerabilities catalog

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data.