Latest CyberSec News by @thecyberpicker

Dans un article publié fin août, la hackeuse éthique BobdaHacker décrit sa dernière opération de piratage. Elle vise une nouvelle fois le secteur de la restauration, moins de deux semaines après avoir révélé les failles de sécurité chez McDonald's. « Alléger la tâche des collaborateurs tout en suscitant l’intérêt et

Researchers used AI image scaling attacks to hide malicious prompts in images, which would be visible to the model after image downscaling.

Researchers have disrupted an operation attributed to Russian state-sponsored threat group Midnight Blizzard, who sought access to Microsoft 365 accounts and data.

Silver Fox APT abuses Microsoft-signed drivers to kill antivirus and deploy ValleyRAT remote-access backdoor

A vulnerability in the WordPress Paid Memberships Subscription plugin could lead to unauthenticated SQL injection on affected sites

This guide gives step-by-step instructions how how to enable two-step verification for WhatsApp on Android, iPhone and iPad.

WhatsApp has patched a vulnerability that was used in conjunction with an Apple vulnerability in zero-click attacks.

If you use ChatGPT to learn new topics, you might want to try its new flashcard-based quiz feature, which can help you evaluate your progress.

Anthropic is planning to bring the famous Claude Code to the web, and it might be similar to ChatGPT Codex, but you'll need GitHub to get started.

OpenAI has announced a big update for Codex, which is the company's agentic coding tool.

Cybercriminals are abusing Meta's advertising platforms with fake offers of a free TradingView Premium app that spreads the Brokewell malware for Android.

Cybercriminals spread Brokewell via fake TradingView Premium ads on Meta, stealing crypto and data with remote control since July 2024.

Here’s this week’s cybersecurity recap in plain terms, built for leaders and practitioners who need the signal, not the noise.

Pennsylvania’s Attorney General confirmed the OAG had refused to pay a ransom demand to the attackers after files were encrypted

Over 80% of security incidents stem from browser-based apps, with Scattered Spider exploiting sessions and APIs.

ScarCruft (APT37) launches Operation HanKook Phantom, a phishing campaign using RokRAT to target academics, ex-officials, and researchers.

Some scammers are selling ETA documents at exaggerated prices, and others are after your personal and financial data.

Dans une étude parue le 27 août 2025, les chercheurs de Truesec décortiquent le mode opératoire d'une large campagne de vols de données. La porte d'entrée dans les infrastructures victimes ? Un éditeur de PDF promu sur Google Ads puis modifié après coup pour intégrer le logiciel malveillant Tampered Chef. Gratuit et

Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics. Related: 51 common SMB cyberattacks That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog during Black Hat USA 2025. His company has carved out a niche helping small and mid-sized businesses,

The campaign shows APT29’s intentions to “cast a wider net in their intelligence collection efforts,” said Amazon

Adversaries targeting the Salesloft Drift application integration with Salesforce have also compromised Google Workspace accounts

ScarCruft’s Operation HanKook Phantom uses RokRAT malware in spear-phishing campaigns, targeting South Korean academics for espionage.

WhatsApp has fixed a zero-day vulnerability linked to a sophisticated cyber-attack

A list of topics we covered in the week of August 25 to August 31 of 2025

Ils opèrent des campagnes d'espionnage et de sabotage ultra-sophistiquées et infiltrent en silence les organisations et entreprises stratégiques du monde entier. Pour mieux comprendre les grandes menaces qui entourent le monde cyber, Numerama dresse les portraits des groupes dits « APT ». Quels sont leurs modes

OpenAI is working on a new feature called the Thinking effort picker for ChatGPT.

Learn about the top external network risks and recommendations to harden configurations from the CIS Cyber Threat Intelligence team.

Un samedi pas comme les autres pour les clients de grandes banques françaises : Crédit Mutuel, CIC, mais aussi Crédit Agricole et Caisse d'Épargne n'assurent plus les retraits d'argent et les paiements en ligne. Des millions de clients sont potentiellement affectés. Si vous avez eu un refus de paiement cette

Threat actors have been using multiple websites promoted through Google ads to distribute a convincing PDF editing app that delivers an info-stealing malware called TamperedChef.

Threat actors abused Velociraptor via Cloudflare Workers in 2024, enabling C2 tunneling and ransomware precursors