Latest CyberSec News by @thecyberpicker

Apple has now made it possible for more iPhones still running iOS 18 to receive security updates that protect against the actively exploited DarkSword exploit kit.

SAN FRANCISCO — A new exposure is emerging in mobile security as AI begins to act on behalf of users — and attackers move to exploit that shift. Related: RSAC wrap-up—no easy fixes for AI exposures In a Fireside Chat at RSAC 2026, Approov CEO Ted Miracco described how mobile apps are starting to hand

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks.

The major U.S. toymaker and entertainment company is still working to assess if company data was stolen in the attack.

A new Android malware named NoVoice was found on Google Play, hidden in more than 50 apps that were downloaded at least 2.3 million times.

CERT-UA impersonation on March 26–27, 2026 spread AGEWHEEZE malware, infecting few devices despite 1M phishing emails.

Chrome patches 21 flaws including exploited CVE-2026-5281 in Dawn, marking fourth zero-day fixed in 2026, reducing active attack risk.

The 2026 US “Cyber Strategy for America” document is mostly the same thing we’ve seen out of the White House for over a decade, but with a more aggressive tone. But one sentence stood out: “We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.” This sounds like a call for hackback: giving private companies permission to conduct offensive cyber operations. The Economist noticed (alternate link) this, too. I think this is an incredibly dumb idea: In warfare, the notion of counterattack is extremely powerful. Going after the enemy­—its positions, its supply lines, its factories, its infrastructure—­is an age-old military tactic. But in peacetime, we call it revenge, and consider it dangerous. Anyone accused of a crime deserves a fair trial. The accused has the right to defend himself, to face his accuser, to an attorney, and to be presumed innocent until proven guilty...

The password-spraying campaign is the latest evidence that Iran is hitting back in cyberspace.

Researchers link the compromise to a North Korean adversary and warn the impacts could be wide ranging.

Proofpoint researchers say the group behind the surge, TA416, had turned away from Europe for a few years.

Microsoft warns WhatsApp on Windows users about an ongoing campaign that tries to gain permanent access to your machine

Modern intrusions increasingly start with valid credentials and routine access, not exploits. Blackpoint Cyber's upcoming threat report shows how VPN abuse, RMM tools, and social engineering drive most incidents.

WhatsApp VBS campaign began February 2026, abusing AWS and UAC bypass to gain persistent remote access.

Google links the Axios npm supply chain attack to North Korean threat group UNC1069, targeting financial gain.

IAM becomes safety infrastructure for AI agents controlling physical systems, with just-in-time credentials, least privilege, and human oversight.

Scams are so convincing that two in three people can't tell them from the real thing. It's why we're not adding to the noise for April Fools.

Augmented Marauder targets Latin America and Europe since 2020, using dynamic PDF phishing to spread Casbaneiro via Horabot.

70% installed AI extensions after DeepSeek block at U.S. law firm, routing traffic to China servers, exposing compliance risk.

This week in cybersecurity from the editors at Cybercrime Magazine

The U.S. Federal Bureau of Investigation (FBI) warned Americans against using foreign-developed mobile applications, particularly those created by Chinese developers.

84% of attacks abuse legitimate tools across 700,000 incidents, expanding internal attack surfaces and evading detection defenses.

Last week, I listened to a fascinating talk by K. Melton on cognitive security, cognitive hacking, and reality pentesting. The slides from the talk are here, but—even better—Menton has a long essay laying out the basic concepts and ideas. The whole thing is important and well worth reading, and I hesitate to excerpt. Here’s a taste: The NeuroCompiler is where raw sensory data gets interpreted before you’re consciously aware of it. It decides what things mean, and it does this fast, automatic, and mostly invisible. It’s also where the majority of cognitive exploits actually land, right in this sweet spot between perception and conscious thought...

Google has fixed the fourth Chrome vulnerability exploited in zero-day attacks since the start of the year.

Une erreur humaine lors d'une mise à jour vient peut-être de révéler le plus grand secret d'Anthropic : le fonctionnement de Claude Code. Anthropic a publié un fichier de 60 Mo contenant l'intégralité du code source de son produit le plus populaire et le plus lucratif. Conséquence : des copies du système émergent

SentinelOne AI stopped a LiteLLM supply chain attack in seconds, blocking malicious code automatically without human intervention.

Google links Axios npm supply chain attack to UNC1069 after trojanized versions 1.14.1 and 0.30.4 spread WAVESHAPER.V2, impacting multiple OS.