Latest CyberSec News by @thecyberpicker

This week in cybersecurity from the editors at Cybercrime Magazine

Not content with attacking retailers, this aggressive group is fighting a turf war with other ransomware operators

The head of the cybercrime unit at the National Crime Agency says the investigation into cyberattacks on British retail companies is not focused on a specific group, for now.

A quiet but consequential shift is underway in enterprise workspace security. The browser has effectively become the new operating system of business. Related: Gartner's enterprise browser review It didn’t happen all at once. But as SaaS took over, remote work went mainstream, and generative AI entered the picture, the browser quietly assumed a central role.

Wazuh detects container vulnerabilities, monitors CI/CD workflows, and automates incident response to prevent breaches.

Fake Facebook ads impersonating Kling AI deploy PureHVNC RAT via spoofed sites, stealing credentials and crypto data.

Experts tell CyberScoop that the U.S. telecom system is just too technologically fragmented to gather a clear picture of threats, and too big to ever fully eject all espionage efforts.

British retailer M&S reported that a recent cyberattack will have a £300 million impact on its operating profit “before cost mitigation, insurance and trading actions.”

Kettering Health, a healthcare network that operates 14 medical centers in Ohio, was forced to cancel inpatient and outpatient procedures following a cyberattack that caused a system-wide technology outage.

Model Context Protocol is a one-size-fits-all connector that bridges LLMs & the real-world. Learn how next-gen AI assistants are being wired to get things done.

interos.ai investigates the latest risk of technology supply chain manipulation

I already knew about the declining response rate for polls and surveys. The percentage of AI bots that respond to surveys is also increasing. Solutions are hard: 1. Make surveys less boring. We need to move past bland, grid-filled surveys and start designing experiences people actually want to complete. That means mobile-first layouts, shorter runtimes, and maybe even a dash of storytelling. TikTok or dating app style surveys wouldn’t be a bad idea or is that just me being too much Gen Z? 2. Bot detection. There’s a growing toolkit of ways to spot AI-generated responses—using things like response entropy, writing style patterns or even metadata like keystroke timing. Platforms should start integrating these detection tools more widely. Ideally, you introduce an element that only humans can do, e.g., you have to pick up your price somewhere in-person. Btw, note that these bots can easily be designed to find ways around the most common detection tactics such as Captcha’s, timed responses and postcode and IP recognition. Believe me, way less code than you suspect is needed to do this...

The 19-year-old and his accomplices obtained key data for the extortion scheme in a 2022 breach of a US telco

CISA adds Ivanti, MDaemon Email Server, Srimax Output Messenger, Zimbra, ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog

Tycoon2FA phishing threat bypasses filters; ANY.RUN sandbox detects full attack chain in 40 seconds.

An M&S trading update estimates the ongoing cyber-incident will cost £300m, largely from lost sales due to the suspension of online orders

ITRC report finds that 39% of American consumers believe biometric use should be banned

British retailer giant Marks & Spencer (M&S) is bracing for a potential profit hit of up to £300 million £300 million ($402 million) following a recent cyberattack that led to widespread operational and sales disruptions.

A new NCSC guide offers useful information on how to safely and securely dispose of end-of-life assets

Coinbase, a cryptocurrency exchange with over 100 million customers, revealed that a recent data breach in which cybercriminals stole customer and corporate data affected 69,461 individuals

AI is transforming Application Security, and PortSwigger is leading the charge. In a must-watch interview, Clint Gibler - one of the leading voices in the AppSec industry - sat down with PortSwigger F

Google has launched a new Chrome feature that automatically updates compromised passwords using its built-in Password Manager.

Directeur numérique du groupe SNCF depuis 2021, Julien Nicolas a pris du galon en mars dernier, se voyant confier le pilotage de la stratégie...-IA générative

Rapid advances in artificial intelligence (AI), along with public releases of AI products, have prompted governments, businesses and criminals to accelerate efforts to incorporate this new technology into their operations. This advice provides definitions for some of the most commonly encountered AI terms in cybersecurity and a brief typology of cyberthreats that will arise from AI.

A 19-year-old college student from Worcester, Massachusetts, has agreed to plead guilty to a massive cyberattack on PowerSchool that extorted millions of dollars in exchange for not leaking the personal data of millions of students and teachers.

CSA’s Enterprise Authority to Operate (EATO) framework and auditing guidelines are specifically designed to fulfill stringent regulatory compliance.

It’s the first public break in the case that might be the largest breach of American schoolchildren's data.

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been…