Latest CyberSec News by @thecyberpicker

Developers using the axios package from npm may have downloaded a malicous version that drops a Remote Access Trojan

AI agent risk isn't equal, it scales with access to systems and level of autonomy. Token Security explains how CISOs should categorize agents and prioritize what to secure first.

Coup dur pour Anthropic. L'entreprise derrière le très performant modèle Claude a accidentellement rendu public le code source de son outil pour développeurs, Claude Code. Des internautes ont fouillé dans les dossiers et ont découvert plusieurs projets de l'entreprise. Y compris un curieux concept de Tamagotchi. Ce

Lloyds Banking Group data incident exposed transactions of ~450,000 mobile banking users due to a faulty update.

Unit 42 found excessive P4SA permissions in Vertex AI, enabling credential theft and cloud data exposure, increasing breach risk.

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems.

AI weaponizes the kill chain across hours or days, forcing continuous exposure and agentic defense to reduce exploitation risk.

AtlasCross RAT spreads via 11 fake domains registered October 27, 2025, enabling encrypted C2 control and persistence.

The Trump administration’s decision to not attend the world’s biggest cybersecurity conference sent the wrong message to partners, experts said.

​Microsoft has resolved a known issue that rendered the classic Outlook email client unusable for users who enabled the Microsoft Teams Meeting Add-in.

This week in cybersecurity from the editors at Cybercrime Magazine

We had 5% buy-in and 95% resistance. A year later, AI-augmented auditors are finding 200 bugs a week on the right engagements. Here's the six-part operating system we built, open sourced, and are giving away.

The Dutch Ministry of Finance took treasury banking portal offline after a cyberattack; core tax systems were not affected.

Charles Bennett and Gilles Brassard have won the 2026 Turing Award for inventing quantum cryptography. I am incredibly pleased to see them get this recognition. I have always thought the technology to be fantastic, even though I think it’s largely unnecessary. I wrote up my thoughts back in 2008, in an essay titled “Quantum Cryptography: As Awesome As It Is Pointless.” Back then, I wrote: While I like the science of quantum cryptography—my undergraduate degree was in physics—I don’t see any commercial value in it. I don’t believe it solves any security problem that needs solving. I don’t believe that it’s worth paying for, and I can’t imagine anyone but a few technophiles buying and deploying it. Systems that use it don’t magically become unbreakable, because the quantum part doesn’t address the weak points of the system...

A summary of the top ransomware trends from the Talos 2025 Year in Review, with a focus on identity, attacker tactics, and practical defenses.

The U.S. CISA adds a vulnerability in Citrix NetScaler to its Known Exploited Vulnerabilities catalog......

Dans la nuit du 30 au 31 mars 2026, deux versions piégées d'Axios ont été publiées sur npm, la plateforme de distribution de code la plus utilisée au monde par les développeurs. Derrière l'attaque, un compte développeur volé, un logiciel espion capable d'infecter Windows, macOS et Linux, et un mécanisme conçu pour

U.S. prosecutors have charged a Maryland man with stealing more than $53 million after hacking the Uranium Finance crypto exchange twice and laundering the proceeds through a cryptocurrency mixer.

Qilin ransomware claims a breach of Dow Inc., listing it on its Tor leak site, but no proof of the hack has been released yet.

The Dutch Ministry of Finance took some of its systems offline, including the digital portal for treasury banking, while investigating a cyberattack detected two weeks ago.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.

Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying cross-platform RAT malware.

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

Healthcare IT firm CareCloud has disclosed a data breach incident that exposed sensitive data and caused a network disruption lasting approximately eight hours.

A newly identified malicious implant named RoadK1ll is enabling threat actors to quietly move from a compromised host to other systems on the network.

DeepLoad logs keystrokes, buries details behind reams of AI-generated code, and re-infect hosts days after being blocked, according to ReliaQuest.

ChatGPT and Codex flaws patched Feb 2026 exposed DNS exfiltration and GitHub tokens, raising enterprise AI security risks.