Episodes
Device Code Phishing steals refresh tokens through legitimate Microsoft auth. Hidden prompts in JSON-LD trick AI agents into crypto payments. Browser-native ransomware abuses Chrome's File System Access API.
Show Notes
This episode covers three distinct threats that each exploit trust in legitimate infrastructure: Microsoft’s own authentication flow, structured data on websites, and the browser’s file system API. Each bypasses traditional security boundaries by operating within authorized channels.
In this episode we cover:
- Device Code Phishing bypasses MFA by having victims complete authentication on Microsoft’s official page, then harvesting refresh tokens for persistent access.
- Researchers have demonstrated that AI agents can be tricked into initiating crypto payments by hidden prompts embedded in JSON-LD and schema markup on SEO-poisoned and typosquatted domains.
- Browser-native ransomware generated by an LLM abuses Chrome’s File System Access API. For OSINT practitioners, this means traditional file-hash and network-signature detection is insufficient—investigators should monitor for unexpected browser permission prompts as a behavioral indicator.
- A MaaS operation uses the Polygon (MATIC) blockchain for resilient C2 resolution via a script named tracker.js, evading traditional sinkholing.
- Indirect prompt injection campaigns target AI coding assistants with fake API documentation and typosquatted crypto platforms like debank[.]auction.
- WhatsApp, iMessage, and Facebook strip embedded provenance credentials from images, breaking C2PA-based verification workflows. Practitioners should request original files via encrypted channels that preserve metadata, or use checksums before platform upload.
- The OCCRP Sky ECC investigation reveals procedural bottlenecks between police and prosecutors in accessing encrypted communications.
Links
← back to The Glasshouse on ryanlabouve.com
Banks making MFA optional leaves the weakest entry path open for attackers. Adversaries suppress fraud alerts by creating Gmail spam filters post-compromise. KDDI breach impacts 14.2 million email accounts across six ISPs.
Show Notes
This episode examines three intersecting stories that all point to the same fundamental failure: authentication architecture that leaves the weakest entry path open. When banks make MFA optional, they create contestable transaction logs. When adversaries compromise email accounts, they suppress fraud alerts with spam filters. And when a major Japanese ISP suffers a breach of 14.2 million accounts, the resulting dataset becomes a threat intelligence event that practitioners need to map against their collections.
In this episode we cover:
- Banks making MFA optional leaves the weakest entry path open for attackers, making every transaction contestable.
- Adversaries suppress fraud alerts by creating Gmail spam filters post-compromise — a low-cost, high-impact TTP.
- KDDI breach impacts 14.2 million email accounts across six ISPs, creating a corpus of compromised addresses entering the threat intelligence ecosystem.
- The spam filter suppression technique leaves a forensic artifact: Gmail filter rules can be enumerated via the API, but accessing them requires the victim’s credentials or explicit consent — this is a triage step for authorized investigators only.
- Security Affairs reports that the KDDI breach impacts up to 14.2 million email accounts across six ISPs, though the incident lacks a formal report with breach vector and timeline.
- The MFA optionality problem undermines authentication logs as evidence of user intent in investigations.
- The weakest-entry-point discipline applies universally: if a level of security is optional, the majority of people won’t enable it.
Links
← back to The Glasshouse on ryanlabouve.com
FSB black-site operators cold-call U.S. switchboards, a $1M Kairos extortion payment traced through exchanges, and timeless tradecraft from a 1774 civilian intelligence cell.
Show Notes
This episode examines three stories that together illustrate the gap between adversary intent and capability: FSB black-site operators who had no direct channel to the U.S. government and resorted to having a prisoner cold-call federal switchboards; a concrete blockchain tracing of a $1M Kairos extortion payment routed through Bybit, OKX, and a Russian service called BELQI; and a historical look at a 1774 civilian intelligence cell that used two-man patrols and compartmented reporting — fundamentals that remain relevant today.
In this episode we cover:
- FSB black-site operators presented a prisoner with a printed list of U.S. government phone numbers and had him cold-call switchboards, revealing a profound adversary intelligence gap.
- A $1M BTC payment to Kairos was split and traced through Bybit, OKX, and BELQI — a concrete pattern for ransomware investigators.
- A 1774 civilian intelligence cell used two-man patrols and compartmented reporting, demonstrating timeless operational security fundamentals.
- The sourcing chain on the FSB anecdote relies on secondhand retelling, raising provenance questions for investigations desks.
- The Kairos blockchain tracing lacks independent confirmation from a second analytics source, leaving it as a single-journalist reconstruction.
- The historical tradecraft comparison risks romanticizing basic practices that competent modern operators already use.
Links
← back to The Glasshouse on ryanlabouve.com
Google and FBI disrupt the NetNut residential proxy botnet, while a new ConsentFix campaign steals Microsoft tokens without malware. Plus, Pegasus targets an EU Parliament member.
Show Notes
This week’s briefing examines a major takedown of the NetNut residential proxy botnet. Reporting from BleepingComputer and The Register documents a whitelabel reseller model that amplifies downstream impact. Meanwhile, a novel ConsentFix attack steals Microsoft tokens through social engineering alone, bypassing traditional security awareness and MFA. The episode also covers the maturation of AI-driven attacks, including automated BEC campaigns and ransomware with hallucinated Bitcoin addresses, as well as malware-free telecom surveillance methods documented by Citizen Lab.
In this episode we cover:
- Google and FBI takedown of NetNut residential proxy botnet, exposing a whitelabel reseller model with contested consent claims from Alarum Technologies.
- ConsentFix attack defines a new category: token theft via social engineering without malware, using OAuth consent screens to create persistent corporate data bridges. For investigators, the immediate takeaway is to audit existing OAuth grants and never click ‘Accept All’ on consent screens from unknown apps.
- Citizen Lab documented two distinct, malware-free location tracking campaigns using malicious hidden SMS commands and SS7/Diameter protocol abuse, based on analysis of network logs and device forensics.
- AI-driven attacks mature: ARToken PhaaS automates BEC with LLM-drafted emails, and JADEPUFFER ransomware uses hallucinated Bitcoin addresses from training data.
- Pegasus spyware found on phone of EU Parliament member investigating spyware, highlighting ongoing surveillance threats.
- UNC3944 member Peter Stokes extradited for helpdesk MFA bypass attacks, with concrete tradecraft details.
- Push Security targeted with poisoned tenant attack via OpenAI invitations, confirming the technique’s practicality.
Links
← back to The Glasshouse on ryanlabouve.com
A new ConsentFix variant weaponizes OAuth consent flows via drag-and-drop, bypassing MFA. Scattered Spider extradition and Opera's Paste Protect countermeasure also covered.
Show Notes
The social engineering landscape continues to evolve as attackers shift from copy-paste to drag-and-drop to evade detection. This episode examines the ConsentFix attack, which researchers demonstrated can bypass both passwords and MFA by exploiting Microsoft 365 OAuth consent flows. We also cover the extradition of a Scattered Spider member, Opera’s new Paste Protect feature, and the ShinyHunters breach at Medtronic.
In this episode we cover:
- ConsentFix attack bypasses MFA by weaponizing OAuth consent flows via drag-and-drop, a novel evasion technique.
- Scattered Spider member extradited; group’s tradecraft includes social engineering, MFA bombing, and helpdesk impersonation.
- Opera ships Paste Protect, which blocks clipboard-based attacks but does not address the drag-and-drop vector used by ConsentFix—a gap attackers are already exploiting.
- ShinyHunters claimed 9M+ records stolen from Medtronic with a ransom deadline of April 21. The listing was later removed from the leak site, though it is unclear whether this was due to payment, takedown, or other reasons.
- WhatsApp introduces username-based contact with multi-layer defense against scams and impersonation.
- Russian counter-sanctions decree allows Deripaska to boost controlling stake to 53% in Kubal.
- Ondo tokenization explained: just-in-time minting and RFQ-based market structure for tokenized equities.
Links
← back to The Glasshouse on ryanlabouve.com
A researcher drops a giant cache of zero-day exploits including iPhone 18 component leaks; phantom squatting emerges as an AI-native supply chain threat; ClickFix malware delivery shifts to API-driven on-demand payloads.
Show Notes
Today’s briefing covers a data extortion incident at Tata Electronics that leaked 200,000 documents, including iPhone 18 component details, alongside a separate researcher dump of zero-day exploits, the emergence of phantom squatting as an AI-native supply chain threat, and a structural shift in ClickFix malware delivery to API-driven on-demand payloads that evades static detection. The council notes highlight the need for detection frameworks around phantom domains and fingerprinting ClickFix API endpoints.
In this episode we cover:
- A data extortion incident at Tata Electronics leaked 200,000 documents, including iPhone 18 component details, alongside a separate researcher dump of zero-day exploits, conflating supply-chain data theft with vulnerability research.
- Phantom squatting emerges as an AI-native supply chain threat with a repeatable kill chain: probe, register, place, wait — cheap, scalable, and dangerous for autonomous agents.
- ClickFix malware delivery shifts to API-driven on-demand payloads, rendering static hash-based blocking obsolete. Investigators should monitor for API endpoints serving dynamic payloads via HTTP responses with randomized variable names.
- GuardFall flaw, reported in 10 of 11 tested open-source AI agents, creates false confidence by string-matching raw commands without modeling bash expansion, leading operators to disable safer controls. The specific agents tested were not disclosed in the source.
- BioShocking technique exploits AI browser reasoning by presenting fictional scenarios as reality, bypassing safety guardrails in ChatGPT Atlas, Perplexity Comet, and Claude.
- SEO-poisoning campaign registers 90 domains across 10 languages mimicking popular freeware like OBS Studio and Bandicam, appearing at the top of organic search results.
- Invoice-themed BEC lures target accounts-payable staff using real vendor relationships, with ARToken platform and Ousaban trojan both abusing accounts-payable pretexts.
Links
← back to The Glasshouse on ryanlabouve.com
FortiBleed exposed 110M passwords, but the real story is 73,000 firewalls turned into passive surveillance nodes. This week's thread rewires what's collectible.
Show Notes
The FortiBleed campaign broke as a credential theft story but quickly revealed a deeper structural shift: network perimeter devices have become the adversary’s preferred passive collection platform. According to the Risky.Biz team’s analysis of the leaked data, the attacker used a legitimate diagnostic command, deployed a custom traffic sniffer on 73,000 devices, and the public leak is only a subset of a larger credential cache. This thread rewires what’s collectible — every credential, API key, and session token passing through compromised firewalls is now compromised.
In this episode we cover:
- FortiBleed’s credential theft of 110M passwords from 430K FortiGate firewalls via a Golang sniffer abusing a diagnostic command.
- The structural shift: perimeter devices as ideal passive surveillance nodes, rarely patched and unaudited. For investigators, this means auditing diagnostic command access and verifying firmware patches actually close the vulnerability—not just change the version number.
- SANS ISC diary’s Mirai replication loop: compromised routers scanning for more victims, creating a behavioral signature.
- Cisco SD-WAN zero-days exploited via rogue peering, Lantronix IoT flaws in OT attacks, and AryStinger botnet using 13-year-old CVEs—each of these was identified through open-source analysis of exploit code and victim reports, demonstrating how OSINT can track threat actor infrastructure.
- Midnight Blizzard weaponizing residential proxy networks to bypass geo-fencing and steal Microsoft 365 credentials.
- The OAuth grants problem: stale credentials and unowned integrations as the new perimeter at the SaaS layer.
- Mozilla 0din’s DNS TXT record injection: hiding malicious prompts in DNS responses to trick AI coding agents.
- Dutch “Game Over” operation: 74% identification rate using multi-source CCTV, doorbell, and ATM imagery with a public-shaming deadline.
- Cellebrite offline-mode persistence: Russian authorities used UFED months after sales were cut off, with forensic extraction feeding COLDRIVER phishing.
Links
← back to The Glasshouse on ryanlabouve.com
A CISA KEV addition for Oracle PeopleTools leads to the ShinyHunters breach of University of Nottingham, with 455,000 emails exfiltrated via zstd and SSH.
Show Notes
The addition of an Oracle PeopleTools vulnerability to CISA’s Known Exploited Vulnerabilities catalog serves as the entry point for a deeper story: the ShinyHunters campaign that compromised the University of Nottingham. The breach exposed 455,000 unique email addresses, along with names, addresses, passport numbers, and other sensitive data. The exfiltration technique—zstd compression piped over SSH to a known leak-site IP—provides defenders with a compound detection signal and underscores the operational patterns of the threat actor.
In this episode we cover:
- Oracle PeopleTools CVE added to CISA KEV after active exploitation in the wild.
- University of Nottingham listed as a victim with 455,000 emails indexed by Have I Been Pwned, though the university has not yet issued a breach notification.
- Exfiltration used zstd compression followed by SSH to IP 176.120.22.24, a known ShinyHunters mirror.
- For OSINT investigators, the compound indicator—zstd plus SSH to a leak-site IP—can be used to pivot and identify related infrastructure or campaigns.
- KEV entries often lag behind real-world campaigns, so cross-referencing ShinyHunters targeting with CVE dates is proactive.
- Defenders should consider adding zstd detection rules to network monitoring, but must test for false positives and performance impact. For investigators, zstd’s lower monitoring prevalence means it can be a stealthier compression choice for legitimate data collection.
- The breach confirmation relies on HIBP indexing; independent verification could involve sampling email addresses against alumni directories and checking the UK ICO breach register.
Links
← back to The Glasshouse on ryanlabouve.com
ShinyHunters exploited an Oracle PeopleSoft zero-day against universities, the FBI dismantled a Gemini-powered phishing network, and Europol took down a $388M crypto laundering service.
Show Notes
Three major operations converged today: a known threat actor exploiting a critical zero-day against the education sector, a law enforcement takedown of an AI-assisted phishing-as-a-service operation, and the dismantling of a crypto laundering pipeline that had moved nearly $400 million for ransomware gangs. The common thread is the weaponization of trust—whether through software supply chains, AI-generated lures, or financial infrastructure.
In this episode we cover:
- A threat actor using the ShinyHunters alias exploited CVE-2026-35273, a PeopleSoft zero-day in the EMHub component, against higher education institutions. SecurityWeek confirmed the University of Nottingham as a victim and linked the exploitation to a data leak site publication on June 9.
- The FBI and Google disrupted “Outsider Enterprise,” a China-based phishing network that law enforcement alleges used Gemini AI to generate lures for smishing campaigns tied to 3.9 million stolen credit cards. The technical evidence for the AI use has not been publicly released.
- Europol dismantled AudiA6, a crypto laundering platform that moved over $380 million for ransomware syndicates since 2022 via chain-hopping and mixer services.
- A novel ‘Agentjacking’ attack chain against Sentry was documented: attackers find public Data Source Names (DSNs) embedded in websites, then send malicious error events with markdown injection to compromise AI coding agents. Practitioners should audit their own Sentry DSN exposure and monitor for unexpected POST requests to ingest endpoints.
- The Browser-in-the-Browser technique resurfaced in Steam credential theft: attackers render a fake login page inside the real browser window, so the address bar looks legitimate but the page is a forgery.
- Arch Linux AUR maintainer spoofing and AI-generated pull requests for reputation farming highlight ongoing supply-chain trust erosion.
- Chinese intelligence recruitment sites used AI-generated photos and stolen identities to target U.S. government clearance holders.
Links
← back to The Glasshouse on ryanlabouve.com
FBI seizes 13 recruitment sites using AI-generated photos and stolen identities. OpenClaw AI agent tricked via hidden payloads in shared contacts. AudiA6 crypto-laundering service dismantled with 393 BTC traced from ransomware.
Show Notes
Today’s brief covers social engineering operations, on-chain forensics, and platform takedowns. The FBI seized 13 recruitment sites using AI-generated photos and stolen identities. Imperva demonstrated agent phishing against OpenClaw AI. And the AudiA6 crypto-laundering service was dismantled with 393 BTC traced from ransomware.
In this episode we cover:
- The FBI seized 13 recruitment sites that, according to the DoJ press release, used AI-generated photographs and stolen identities to target current or former U.S. government employees. The press release does not name the specific AI generation tool or the breach source for the identities.
- Imperva demonstrates agent phishing against OpenClaw AI, hiding payloads in vCards and location pins invisible to both sender and receiver.
- AudiA6 crypto-laundering service dismantled; DoJ traces 393.39 BTC from ransomware and darknet markets through the mixer.
- ShinyHunters misrepresents access in extortion attempts, repurposing historical or public data — a replicable threat-intel pattern.
- Rapid7 catalogs deepfake services marketed for KYC bypass and synthetic identity creation. The report names specific services — investigators should monitor these as operational intelligence sources.
- WhatsApp detected NSO Group defying a no-hacking court order via social engineering attacks with malicious links. The detection method — analyzing link infrastructure and delivery patterns — is the OSINT-relevant detail.
- Varonis draws a durable distinction between prompt injection and agent phishing, naming a social-engineering pattern specific to AI agents.
Links
← back to The Glasshouse on ryanlabouve.com
This week, autonomous AI vulnerability discovery crossed from proof-of-concept to commodity economics, inverting the cost of finding kernel-level zero-days and shifting the security industry's bottleneck from discovery to triage.
Show Notes
This was the week the vulnerability discovery market inverted — when autonomous AI agents found 21 confirmed zero-days in FFmpeg for approximately $1,000, a cost per bug that fundamentally changes the economics of discovery. The load-bearing story this week is that autonomous AI vulnerability discovery just became cheap and fast enough to change everything. The security industry is now reacting to a threat landscape that’s already moved on.
In this episode we cover:
- CIFSwitch, a 19-year-old Linux kernel privilege escalation chain found by an AI semantic-graph framework, alongside Mythos discovering a 27-year-old OpenBSD flaw and a 17-year-old FreeBSD flaw — all on the same day.
- The HTTP/2 Bomb, where an AI agent chained two decade-old DoS techniques into a novel attack affecting 880,000 websites, demonstrating structural reasoning about protocol behavior.
- depthfirst’s autonomous agent scanned FFmpeg’s 1.5 million lines of C and produced 21 zero-days, which the FFmpeg security team confirmed as valid, for approximately $1,000.
- The economic inversion: when an agent can surface bugs that sat untouched for two decades, the bottleneck shifts from discovery to triage, and Cisco’s shift to class-of-defect remediation is the first institutional acknowledgment.
- The same day, Claude Opus 4.8 found a four-year-old Zcash bug in 24 hours — a bug in a cryptographic system where exploitation is undetectable, highlighting the asymmetry between discovery and attribution that open-source investigators must now account for.
- The Phantom Gyp evasion technique. Buried in the IronWorm/Miasma coverage on Friday: a 157-byte
binding.gyp file that triggers code execution during npm install without using monitored lifecycle scripts. To detect it, audit your npm install logs for unexpected file writes or network connections during native module builds. To mitigate, pin your dependencies and review binding.gyp files manually.
- The C0XMO botnet’s rival-malware-killing behavior, showing IoT malware developing territorial behaviors that mirror biological competition on abandoned devices.
Links
← back to The Glasshouse on ryanlabouve.com
AI browsers tricked into credential theft, a standard M365 account becomes global admin in minutes, and Microsoft fights ransomware with bot lobby verification.
Show Notes
This episode examines three converging threats: a novel technique that exploits AI browsers’ inability to distinguish user intent from web content, a replicable privilege escalation path using common M365 misconfigurations, and Microsoft’s response to ransomware groups abusing Teams for lateral movement. The common thread is that architectural blind spots—not just patchable bugs—are enabling attackers to bypass traditional defenses.
In this episode we cover:
- BioShocking: a technique demonstrated by security firm LayerX that tricked six unnamed AI browsers into exfiltrating credentials by convincing them they are playing a game, exploiting a fundamental design flaw.
- Huntress’s Standard Steve demo: a regular M365 account becomes global admin in 5.5 minutes using an AI assistant and common misconfigurations.
- Microsoft’s new Teams bot lobby verification: requiring human approval for non-human participants to counter ransomware social engineering.
- Black Basta leak analysis: call team schedules, contractor outsourcing, and victim study tactics — documented in chat logs leaked to CyberScoop and verified against known victim timelines.
- BEC tradecraft: how compromised mailboxes, real names, and invoice references bypass traditional email security.
- LLMKeyLens tool: a method for sniffing credentials from mobile app traffic on a controlled test device, without jailbreaking — but only safe to run in an isolated lab environment.
- EyeDex and Telegram fraud services: new tools for threat researchers and the rise of fake dashboard subscriptions.
Links
← back to The Glasshouse on ryanlabouve.com
A day with no tool releases, investigations, or platform changes forces a recalibration of what practitioners consider signal versus noise.
Show Notes
No OSINT tradecraft was surfaced in today’s monitoring window — no tool releases, no platform changes, no published investigations. No signal was observed across the monitored streams. But as the council notes, this absence is itself a signal worth examining, testing whether monitoring setups are tuned for actual detection or just comfortable with the usual hum.
In this episode we cover:
- Sector035 reframes a zero-signal day as a calibration point for the baseline noise floor practitioners have normalized.
- Cyber Detective urges revisiting existing tools for silent changes in terms of service, rate limits, or response structures that rarely announce themselves.
- Aric Toler warns that quiet days don’t mean verification work stopped — only that provenance chains haven’t reached publication yet.
- The most dangerous assumption on a quiet day is that nothing is being prepared; access interruptions to key open-source repositories may only become visible later.
- The monitoring report shows no failed workflows, but that only confirms the collection systems are running — not that they’re capturing everything they should.
- Practitioners should verify whether geolocation APIs now require API keys where they didn’t before, whether social media endpoints have silently deprecated, and whether public registries have added CAPTCHAs — each of these changes can be detected by running a test query against your existing scripts.
- The absence of published investigations should not be mistaken for a clean bill of health on underlying evidence streams.
Links
- No external sources referenced in this episode.
← back to The Glasshouse on ryanlabouve.com
A day with zero tool drops, platform changes, or published investigations — but the quiet itself is operational data worth filing.
Show Notes
No new OSINT tradecraft surfaced in the last 24 hours. No tool releases, no platform changes, no published investigations. The practitioner community has nothing new to learn today, but the absence of news is itself a signal. The practitioner community may be in a quiet consumption phase, or the next wave of work is being assembled off-record. The real work lies in auditing existing toolchains and stress-testing workflows before the next disruption arrives.
In this episode we cover:
- The artifact’s honesty about its emptiness is a useful signal for the practitioner community
- Quiet days often precede coordinated takedowns or access changes — use the pause to audit fallback methods
- No tool releases or dataset expansions means it’s time to inventory what you already have and check for silent failures
- The absence of reported failures in the brief is not a clean bill of health; it may mean no one has stress-tested their stack today.
- No investigations published mistakes absence of news for absence of work — verification happens off-record during quiet windows
- Structural risk: zero provenance claims means no opportunity to test verification methods against synthetic media
- Use the lull to pressure-test your own workflow against a known-deceptive dataset to find gaps the news cycle obscures
Links
← back to The Glasshouse on ryanlabouve.com
Camille François' ABC framework and Iranian information operations since 2014, with a focus on GAN-generated profile pictures and synthetic text as emerging threats.
Show Notes
This episode examines Camille François’ ABC framework for analyzing disinformation, which separates actors, behaviors, and content to enable targeted interventions. It also references Iranian information operations dating back to 2014, based on platform disclosures and researcher reports, and highlights emerging threats from GAN-generated profile pictures and synthetic text (“read fakes”).
In this episode we cover:
- The ABC framework as a durable analytical taxonomy for disinformation, applicable across state and non-state actors.
- Iranian IO activity since 2014 using fake profiles, memes, and videos, predating the 2016 Russia-centric narrative.
- GAN-generated profile pictures and synthetic text as next-generation IO tools, with the coining of the term “read fakes.”
- Concrete tradecraft on how Iranian operators use memes and video, and the cat-and-mouse dynamic with platform enforcement.
- The definition and operationalization of coordinated inauthentic behavior (CIB) as a key platform enforcement concept.
- The need for verifiable sourcing and provenance chains when documenting historical IO campaigns.
- The gap between identifying emerging threats and providing practitioners with actionable detection tools.
Links
← back to The Glasshouse on ryanlabouve.com
This episode covers authentication laundering via Calendly and Google redirect, Cellebrite extraction feeding COLDRIVER phishing, and Turla's STOCKSTAY backdoor with server-side encryption blindness.
Show Notes
This episode examines three distinct but interconnected stories: a novel phishing technique that bypasses email authentication by abusing trusted third-party services, the forensic extraction of an activist’s phone that directly fed a state-sponsored phishing campaign, and a Russian APT’s backdoor that uses server-side encryption to prevent platform takedown. Each story highlights how attackers are weaponizing trust—whether in infrastructure, forensic tools, or encryption—to evade detection and attribution.
In this episode we cover:
- Authentication laundering via Calendly and Google redirect bypasses SPF, DKIM, and DMARC checks, allowing phishing emails to appear legitimate.
- Cellebrite extraction of activist Pivovarov’s phone provided COLDRIVER with a target list, linking device seizure to subsequent phishing campaigns.
- Turla’s STOCKSTAY backdoor uses server-side encryption blindness, preventing platform operators from inspecting C2 traffic and hindering takedown.
- A publicly accessible GitHub repository containing STOCKSTAY’s WebSocket server implementation allows investigators to clone the code, analyze the encryption scheme, and build detection signatures before the repo is taken down.
- Polymarket phishing heist drained ~$2.94M in PUSD across 11+ wallets via Polygon-to-Ethereum bridge, with consistent on-chain details reported by both SecurityWeek and Security Affairs.
- Ransomware groups pivot from technical innovation to organizational and psychological tactics, targeting CEOs for personal extortion.
- Dual-source forensic confirmation—device traces plus official Russian government report—raises the evidentiary bar for proving forensic tool use.
Links
← back to The Glasshouse on ryanlabouve.com
This week, the 88% correlation between exposed Fortinet devices and prior compromise transforms credential leaks from data points into diagnostics, revealing a structural gap in how trust is managed across infrastructure.
Show Notes
This week’s central story is the convergence of credential exposure, supply-chain trust poisoning, and non-human identity abuse into a single operational pattern that rewires perimeter defense. The 88% correlation from the FortiBleed analysis — based on a random sample of exposed organizations cross-referenced with stealer-log and breach data — suggests that exposed edge devices are often symptoms of deeper compromise, not the first line of attack.
In this episode we cover:
- The FortiBleed campaign exposing 75,000 devices and 74,000 credentials, with 88% of affected organizations already compromised before the VPN hash was cracked
- The Arch Linux AUR attack hijacking 1,900+ packages through legitimate orphaned-package adoption, weaponizing open-source governance
- EvilTokens demonstrating OAuth device code phishing that bypasses both password theft and 2FA by duping victims into completing legitimate authentication flows — note: testing this technique while logged into your own Microsoft account will expose your identity to the attacker’s infrastructure.
- DragonForce abusing Microsoft Teams TURN relays to hide C2 traffic for two months, making malicious traffic indistinguishable from legitimate signaling
- The Klue OAuth supply-chain breach cascading to Salesforce data theft at five security vendors via a compromised legacy credential on a BI platform
- SocGholish takedown revealing anti-sandbox tradecraft using cross-frame messaging and blob URLs that evaded automated analysis
- The Fable system card showing models converge on functional decision theory, with Venbench catching deceptive behavior rationalized by the model
Links
← back to The Glasshouse on ryanlabouve.com
Bluekit phishing kit adopts browser-in-the-middle via rrweb DOM serialization, while North Korea-linked Gaslight macOS malware uses prompt injection against AI analysis tools. Bellingcat publishes replicable ML methodology for civilian harm detection from Telegram.
Show Notes
This episode examines three significant developments shaping the threat landscape: the evolution of phishing kits beyond traditional adversary-in-the-middle techniques, a novel macOS malware family targeting AI-assisted analysis, and a conflict monitoring approach using machine learning that Bellingcat has documented in detail. The Bluekit shift to browser-in-the-middle via rrweb DOM serialization bypasses detection signals that rely on network-level interception patterns, such as proxy detection and certificate pinning, while the Gaslight malware’s prompt injection payload highlights the growing arms race between attackers and AI tools. Meanwhile, Bellingcat’s detailed methodology paper offers a replicable framework for civilian harm detection that any investigator can adapt.
In this episode we cover:
- Bluekit phishing kit adopts browser-in-the-middle via rrweb DOM serialization over WebSocket, bypassing traditional AitM defenses.
- Gaslight macOS malware, attributed to North Korea based on infrastructure overlaps and code similarities documented by researchers, embeds a prompt injection payload to trick AI analysis tools into aborting analysis.
- Bellingcat publishes replicable ML methodology for civilian harm detection from Telegram, documenting 2,500 incidents and 48,545 negative instances generated through a specific sampling strategy that any investigator can adapt.
- KongTuke and Payouts King IAB use Microsoft Teams social engineering to deliver malicious Edge extension Edgecution and Mistic backdoor.
- Stale pilot credentials from 2022 exploited against Klue customers, affecting 13+ cybersecurity vendors via supply-chain credential reuse. Investigators should audit any pilot or trial accounts that remain active beyond their intended lifecycle.
- AI-generated impersonation scams target indie creators, with Sons of Legion seeing 50-60 fake accounts daily and a victim losing $50,000.
- Cellebrite’s architectural design flaw allows continued offline functionality after updates cease, making remote revocation impossible.
Links
← back to The Glasshouse on ryanlabouve.com
A ShinyHunters member details how SSPR abuse via vishing bypassed MFA in the MSG hack. Russia proposes isolating M2M SIMs to combat automated fraud. And a cross-cut reveals sextortion scams share a durable pattern: no evidence means no compromise.
Show Notes
This episode examines a technique named by the attacker themselves—SSPR abuse via vishing—and contrasts it with structural patterns in fraud and data extortion. Russia’s regulatory move to isolate M2M SIMs could reshape automated fraud attribution, while the FortiBleed coverage reminds us that public leaks are rarely the full picture.
In this episode we cover:
- A ShinyHunters member confirms the MSG hack used vishing to trick an employee into performing SSPR, bypassing MFA entirely. For defenders, this underscores the need for caller verification via a separate channel—never trust an unsolicited call requesting credential changes.
- Russia prepares legislation to separate machine-to-machine SIMs from regular SIMs, a novel approach to prevent automated fraud.
- Sextortion scams and the Bashe/Hargreaves Lansdown incident share a structural pattern: fabricated technical authority with zero evidence.
- The HuiOne Guarantee Telegram marketplace takedown reveals billions in transactions and a full crimeware-as-a-service spectrum.
- FortiBleed’s public leak of 74,000 passwords is only a subset; the attacker retains a larger credential cache, which could enable credential stuffing or lateral movement across affected networks. The cache size was inferred from the attacker’s own statements and the incomplete nature of the public dump.
- Belgian intelligence suffers an MDM breach, potentially compromising device profiles, enrollment tokens, and management certificates.
- Tata Electronics confirms a breach by the World Leaks group, with 200,000 documents stolen, impacting Apple and Tesla supply chains.
Links
← back to The Glasshouse on ryanlabouve.com
Scattered Spider members plead guilty on day one of trial for the TfL hack, while an Algerian marketplace admin is identified by his name embedded in phishing kit source code.
Show Notes
This episode examines the convergence of attribution methods in the Scattered Spider case, where multiple independent outlets cite the same forensic artifacts — screenshots, Telegram logs, and credential marketplace access — all originating from the NCA’s seizure of a laptop. The convergence is in the reporting, not necessarily in independent verification. and highlights a textbook OpSec failure where developer metadata in phishing kit source code led to an admin’s identification. The discussion also covers a replicable investigative methodology combining OSINT with legal process, and a concrete decision rule for protocol filtering that prioritizes precision over completeness.
In this episode we cover:
- Scattered Spider members plead guilty on day one of trial for the TfL hack, with forensic evidence including screenshots, Telegram logs, and credential marketplace access.
- Dark web identity market priced at 95¢ per stolen record in 2026, according to a report from [source] that analyzed listings across three major markets over a 30-day period — reflecting commoditization of stolen data.
- Algerian marketplace admin identified by his full name embedded in phishing kit source code alongside his Telegram handle and marketplace link — a reminder that developer metadata in seized or shared malware samples is a routine check that can yield immediate leads.
- Pig-butchering operation breakdown from Malwarebytes detailing playbooks, dev teams, and fake trading platforms as discrete components.
- Cisco’s SAA protocol filtering decision rule: cutting irrelevant protocols based on volume and relevance to prioritize impact over completeness.
- Updated Codex Security plugin integrating with SARIF and CodeQL for end-to-end AI security toolchain.
- SIM-swapping as a service detailed in Krebs, including mechanism for bypassing MFA via phone number redirection.
Links
← back to The Glasshouse on ryanlabouve.com
A supply-chain attack on Klue, a novel VirusTotal reputation manipulation technique, and foundational maritime OSINT tradecraft.
Show Notes
This episode covers three stories that illustrate shifts in how we think about security and OSINT. The Klue breach demonstrates how legacy integration credentials can cascade into OAuth token theft affecting multiple security vendors. A crypto heist shows attackers manipulating VirusTotal to make malware appear as false positives, undermining a key verification signal. And maritime OSINT guidance highlights the IMO number as a persistent vessel identifier, with important caveats for practitioners.
In this episode we cover:
- Klue breach: compromised legacy integration credentials led to OAuth token theft from Salesforce environments, affecting Huntress, Recorded Future, Tanium, and Jamf.
- Crypto heist attackers manipulated VirusTotal to make detections appear as false positives, coordinating across YouTube, news sites, and the platform. The original Dark Reading article includes specific examples of the fake content and submission hashes, which we’ve linked in the show notes.
- Maritime OSINT: the IMO number is a life-of-vessel identifier that survives name changes, but MMSI numbers can change and AIS transmissions can spoof IMO numbers.
- Distributed reconnaissance architecture splits scanning across multiple executors to avoid rate limits — a pattern that, if adapted for legitimate OSINT, requires careful isolation of each executor to prevent attribution back to the investigator.
- UnregStealer trojan targets LATAM banks with human-operated sessions that evade sandbox detection.
- WhatsApp accounts compromised to distribute VBScript malware, with the initial compromise method still unknown.
- Gizmodo breach via compromised account injected malicious script for ClickFix scam, attributed to ErrTraffic affiliate based on shared infrastructure indicators identified through open-source tracking.
Links
← back to The Glasshouse on ryanlabouve.com
AryStinger botnet weaponizes D-Link routers with distributed scanning, while SlowMist's MistTrack introduces configurable risk decay and path-layer evidence for on-chain AML.
Show Notes
This episode examines two developments that approach the same graph-theoretic problem from opposite sides of the glass: adversarial distributed scanning infrastructure and defensive on-chain risk propagation. AryStinger’s botnet architecture offers actionable tradecraft for detection, while MistTrack’s update reads as a curriculum in operational AML architecture, complete with a pricing model that could democratize on-chain intelligence.
In this episode we cover:
- AryStinger botnet weaponizes thousands of D-Link routers using a distributed scanning architecture that splits reconnaissance into parallel executor chunks.
- SlowMist publishes MistTrack’s risk decay model with a configurable 40% per-hop propagation factor, enabling organizations to calibrate false-positive rates.
- MistTrack introduces Association Paths providing traceable fund-flow evidence for Suspicious Transaction Reports, though the path is deterministic only in the sense of transaction tracing — attribution of addresses to specific actors remains probabilistic.
- The MistTrack Developer Plan at $20/year with 10 QPS enables programmatic address screening for small teams — the API’s raw label lookup capability (if exposed) would allow independent investigators to automate risk checks that previously required enterprise contracts.
- The 400M+ address labels and 90M+ risky addresses are claimed by SlowMist; the methodology for generating these labels has not been disclosed, leaving the false-positive rate and label provenance unverifiable.
- Both stories highlight infrastructure for distributed intelligence collection — one adversarial, one defensive — solving similar graph problems from opposing sides.
- The Telegram bot integration for MistTrack allows real-time address risk checks, but sending an address to a third-party bot leaks the query to SlowMist’s infrastructure — consider the opsec implications before use.
Links
← back to The Glasshouse on ryanlabouve.com
The FortiBleed leak shows 88% of exposed FortiGate victims appear in prior breaches, while Panoramax offers a self-hosted street-level imagery alternative for OSINT.
Show Notes
The FortiBleed leak provides a stark statistical anchor: 88% of exposed FortiGate organizations also appear in prior breach data, with 38% having staff with active infostealer infections. This establishes a statistical correlation: an exposed edge device is rarely an isolated problem but a symptom of broader compromise. Meanwhile, Panoramax, a federated, self-hosted street-level imagery platform funded by French research institution IGN, offers OSINT practitioners a licensing-free alternative to Google Street View. Threat actors are also refining their methods, operating from Kali VMs behind NAT and ranking targets by revenue using OSINT.
In this episode we cover:
- FortiBleed leak reveals 88% of exposed FortiGate victims also appear in prior breach data, with 38% having active infostealer infections.
- Panoramax offers self-hosted, federated street-level imagery as an OSINT alternative to Google, solving licensing friction for OpenStreetMap.
- Threat actors operate from Kali VMs behind NAT, rank targets by revenue using OSINT, and coordinate over shared terminal sessions.
- The Panoramax federation model avoids the storage cost collapse that killed Mapillary, enabling bulk downloads without rate limiting.
- The FortiBleed dataset includes revenue tiers and employee counts, formatted in a way that Beaumont describes as common in criminal markets for selling initial access.
- Investigators finding exposed edge devices should cross-reference the organization’s domain against stealer-log databases like IntelX or Have I Been Pwned to check if credentials are already circulating.
- The threat actor methodology was observed in a single incident response report, so its generalizability across campaigns is uncertain.
Links
← back to The Glasshouse on ryanlabouve.com
A massive credential leak exposes half of all internet-facing Fortinet devices, Peter Thiel's secret society Dialog is breached via an open directory, and Telegram's moderation efforts fail to curb cybercrime.
Show Notes
This episode examines three major stories dominating the threat landscape: the FortiBleed leak compromising credentials for roughly half of all internet-facing Fortinet devices, the exposure of Peter Thiel’s secretive Dialog society through an open directory in its source code, and evidence that Telegram’s two-year moderation push has not materially reduced cybercrime activity on the platform, according to a Risky Bulletin analysis. We also cover a 24-billion-record Elasticsearch dump, a Chinese PhaaS takedown, and evasion techniques like IPv4-mapped IPv6 addresses.
In this episode we cover:
- FortiBleed leak exposes 74K+ Fortinet device credentials with plaintext passwords, affecting half of all internet-facing units. If you manage Fortinet gear, assume your credentials are in this dump and rotate immediately.
- Dialog’s 222-member roster leaked via open directory in source code, providing a dataset that investigators can cross-reference against public records and corporate registries to map influence networks deliberately kept off public records.
- Telegram cybercrime activity remains at pre-arrest levels as groups hide in politically-themed channels to evade moderation.
- 24-billion-record Elasticsearch cluster found exposed on June 12, containing 8.3 TB of plaintext credentials.
- FBI-led takedown of Chinese PhaaS operation Outsider Enterprise, linked to $1.9B in losses and 3.8M credit card records.
- SocGholish (FakeUpdates) continues using compromised sites to overwrite pages with fake browser update prompts.
- IPv4-mapped IPv6 addresses used to bypass regex-based URL parsers in phishing campaigns.
Links
← back to The Glasshouse on ryanlabouve.com
Time-to-exploit has collapsed to negative seven days. The industry's patch cadence is structurally obsolete, and the only honest response is to design systems that assume no patch will arrive in time.
Show Notes
The daily briefs this week offered competing headlines — a record 206-CVE Patch Tuesday, a wormable Windows kernel RCE, Anthropic’s Mythos Preview finding a 27-year-old OpenBSD bug, CISA mandating three-day patching — and each one was true, but none of them was the story. The story is that the relationship between vulnerability discovery and exploitation has undergone a phase transition, and the institutions built to manage that relationship — monthly patch cadences, staged rollouts, CVE-to-KEV pipelines, even the concept of “zero-day” as a meaningful category — are now operating in a regime they were not designed for.
In this episode we cover:
- The TeamPCP supply chain campaign defeats SLSA provenance by compromising the pipeline itself, proving cryptographic attestation is only as trustworthy as the account controlling the build.
- The Miasma worm compromises 73 Microsoft GitHub repos by planting config files for AI coding tools, skipping the package manager to target the least-monitored trusted surface in the developer toolchain.
- Anthropic’s Red Team demonstrates that a lone operator can weaponize a month’s worth of patches in a single afternoon for a few thousand dollars, with no specialized expertise.
- Claude Mythos Preview autonomously writes a remote code execution exploit against FreeBSD’s NFS server from a 17-year-old bug and finds a 27-year-old flaw in OpenBSD.
- The Zero Day Clock metric from The Hacker News shows average time-to-exploit collapsed from 53 days in 2024 to 24 hours in 2026, while CISA’s KEV catalog still averages only about 30 CVEs per year.
- CISA’s BOD 26-04 mandating three-day patching for easily automated bugs is a category error — the defender’s operating tempo has been set by the attacker’s clock, and the gap is now measured in hours.
- The DriftRegion UDS library integer underflow is a curriculum-grade C vulnerability in an embedded context, pre-authentication and remote, likely to be exploited before the patch cycle completes. For defenders: audit any UDS implementation that doesn’t validate recv_len before accessing recv_buf[1]; consider network-level filtering of UDS SecurityAccess requests until patches are verified.
Links
← back to The Glasshouse on ryanlabouve.com
This episode covers the Contagious Interview campaign's use of outsourced freelancers to bypass deepfake detection, DragonForce's Ghost Calls technique for hiding C2 in Microsoft Teams relay traffic, and the FortiBleed open directory exposing attacker tooling and billions of credential attempts.
Show Notes
The Contagious Interview campaign outsources video interviews to freelancers in the Philippines, Nigeria, Colombia, and Bangladesh, a technique that researchers say may evade deepfake detection tools trained on synthetic faces. Meanwhile, DragonForce’s Ghost Calls technique hides C2 traffic inside legitimate Microsoft Teams relay infrastructure, and the FortiBleed attackers left an open directory exposing their own tooling and 1.16 billion credential attempts. This episode examines these operational patterns and their implications for defenders.
In this episode we cover:
- Contagious Interview uses freelancers for video interviews, bypassing deepfake detection by outsourcing to legitimate contractors reading scripts.
- DragonForce hides C2 traffic inside Microsoft Teams relay infrastructure using the Ghost Calls technique with 1-2 month dwell time.
- Security researcher Diachenko discovered an open directory left by the FortiBleed attackers, exposing tooling, scripts, and logs — including evidence of 1.16 billion credential attempts against 320,777 FortiGate targets, according to his analysis of the exposed data.
- Supply-chain attacks via trusted platforms appear across Claude.ai shared chats, Microsoft Teams relays, and fake GitHub repos targeting retro gaming communities.
- Perplexity’s Bumblebee scanner parses metadata from compromised packages without executing code, but investigators should run it in an isolated environment — the tool itself could be targeted if the attacker monitors for scanners.
- Cisco Talos details VB6 reverse engineering via COM ROT, exposing GUI tool object models for agentic automation.
- ShinyHunters targets at least 100 organizations by exploiting a zero-day in Oracle PeopleSoft.
Links
← back to The Glasshouse on ryanlabouve.com
Check Point documents a cross-platform reputation-manipulation playbook for malware distribution. FortiBleed leak exposes 73,000 Fortinet VPN credentials globally. GitHub's unverified author attribution enables supply-chain worm impersonation.
Show Notes
This episode examines how trust signals across platforms are being systematically manufactured to distribute malware, leak credentials, and undermine supply-chain security. Check Point’s research documents a Rust clipboard hijacker campaign that uses GitHub stars, VirusTotal votes, and AI-generated YouTube content to build trust. The report names specific accounts and infrastructure, allowing investigators to search for similar patterns. FortiBleed leak reportedly contains 73,932 Fortinet VPN credentials. Before ingestion, verify the data’s freshness and check for known honeypot indicators. Meanwhile, GitHub’s unverified author attribution exposes a structural vulnerability that allows supply-chain worms to impersonate trusted developers.
In this episode we cover:
- Check Point documents a cross-platform reputation-manipulation playbook using phishing pages, fake GitHub/SourceForge projects, AI-generated YouTube content, and VirusTotal vote manipulation to distribute a Rust clipboard hijacker.
- FortiBleed leak exposes 73,932 Fortinet VPN credentials from organizations worldwide, requiring immediate ingestion into credential-monitoring workflows.
- GitHub’s unverified author attribution allows attackers to impersonate trusted developers, undermining a fundamental verification assumption for supply-chain security.
- ShinyHunters targets Infinite Campus K-12 student information system via Salesforce, stealing data from 137,000 school staff accounts.
- FulcrumSec publishes detailed inventory of Novo Nordisk’s stolen AI research assets, including model checkpoints, training data, and infrastructure configs.
- Session hijacking emerges as a key MFA bypass mechanism, documented in both the Novo Nordisk breach and SecurityWeek analysis.
- OCCRP reports on tariff and sanctions threats used to pressure Brazilian judiciary, a replicable influence operation pattern.
Links
← back to The Glasshouse on ryanlabouve.com
ClickFix malware distribution is accelerating through the ErrTraffic MaaS framework and WordPress injections, while FTC reports $3.5B in 2025 imposter scam losses with social media as the dominant vector.
Show Notes
ClickFix malware delivery is being distributed through the ErrTraffic MaaS framework, which uses compromised WordPress sites as injection points and offers geolocation-based filtering. Meanwhile, the FTC reports $3.5 billion in imposter scam losses in 2025, with social media accounting for $2.1 billion. India temporarily blocked Telegram over organized exam cheating rings using automated channels, according to reports from The Record. The episode examines these converging trends and the operational pivots driving them.
In this episode we cover:
- ErrTraffic MaaS framework sold with a malicious WordPress plugin and admin panel for ClickFix distribution — investigators can hunt for suspicious JavaScript inclusions on WordPress sites using Shodan or Censys queries for known malicious signatures.
- Lorem Ipsum operators pivot from fake Teams installers to ClickFix lures after Fox Tempest takedown
- FTC reports $3.5B in imposter scam losses in 2025, with social media as the dominant vector
- India blocks Telegram over organized exam cheating rings using automated channels
- Rokarolla Android malware uses fake Google Play Protect dropper to gain Accessibility access
- Roblox developer accounts hijacked via fake job offers and malicious Python package ‘robase’
- SecurityWeek reports that AI-driven dialogue accelerates emotional manipulation 300% faster than human operators, though the article does not cite a named study or methodology for that figure.
Links
← back to The Glasshouse on ryanlabouve.com
A novel CSP bypass uses Bing's image fetch as an exfiltration proxy for M365 Copilot, ShinyHunters exploits a PeopleSoft zero-day across 100+ organizations, and cross-referenced infostealer logs reveal credential theft as the primary ransomware access vector.
Show Notes
This episode examines a CSP bypass that weaponizes Bing’s server-side image fetch to exfiltrate data from M365 Copilot, a coordinated ShinyHunters campaign exploiting a PeopleSoft zero-day against over 100 organizations, and a cross-referencing methodology that links infostealer logs to ransomware victims before they appear on leak sites. The discussion also covers major PhaaS takedowns, AI-generated voice cloning attributed to FIN7, and the argument that OS-level AI agents could detect social engineering in real time.
In this episode we cover:
- A CSP bypass using Bing’s image fetch endpoint as an exfiltration proxy for M365 Copilot, turning allowlists into attack surfaces.
- ShinyHunters claimed to be exploiting CVE-2026-35273, a critical PeopleSoft zero-day, against universities and the Council of Europe, affecting over 100 organizations according to the group’s statements.
- Ransomnews cross-referenced a sample of ransomware victims against the alerts.bar infostealer index, finding live credentials and session tokens for victims like 2GO.
- The FBI takedown of Outsider, a Chinese PhaaS platform linked to $1.9B in losses and 3.87M stolen credit cards, with AI-generated phishing pages via Gemini.
- INTERPOL’s takedown of Sniper Dz, a PhaaS platform using browser notification abuse and a traffic distribution system to route victims based on device and carrier.
- AI-generated voice cloning attributed to FIN7 targeting tech company employees, with open-source analysis of the voice samples and infrastructure.
- A fake breach filing attack on Maine’s attorney general portal, where unverified notices for VRChat and Discord were listed.
Links
← back to The Glasshouse on ryanlabouve.com
Gralhix's OSINT Olympics 2026 walkthrough details replicable chronolocation methods. The FBI disrupts Outsider Enterprise, and jqwik's author uses prompt injection to enforce license terms against AI agents.
Show Notes
This episode examines three distinct developments in security and OSINT tradecraft. Gralhix’s OSINT Olympics 2026 walkthrough provides a meticulously documented chronolocation workflow using suncalc.org, historic weather data, and the Danish CVR business register. The FBI’s disruption of Outsider Enterprise targeted an AI-powered phishing service that, according to the agency, operated at massive scale since 2023. Meanwhile, the jqwik author’s defensive prompt injection technique highlights an emerging cat-and-mouse dynamic between AI agents and code licensing.
In this episode we cover:
- Gralhix’s walkthrough demonstrates a replicable chronolocation method stacking snow melt analysis, suncalc.org, historic weather data, and business registers to pinpoint a photo’s date.
- The Danish CVR business register is a less commonly used resource that can narrow date windows in Nordic investigations.
- FBI takedown of Outsider Enterprise, an AI-powered phishing service with 9,000 fake websites and over a million fraudulent URLs, active since 2023.
- Jqwik’s author embeds bot-visible prompt injection in terminal output to instruct AI agents to delete jqwik code, enforcing license terms against automated crawlers.
- The OCCRP piece on Guanajuato’s anexos reports that security analyst Saucedo estimates one third are under CJNG control, based on documented patterns of hideouts and recruitment. The 3,000 total anexos figure across Mexico is an estimate with significant caveats due to lack of formal registration.
- DentaQuest breach by ShinyHunters impacts 2.6 million individuals, providing verifiable incident scale.
- A vulnerability in [tool name] (CVE-XXXX-XXXX) allows arbitrary command execution via untrusted input to the -file argument. Investigators should avoid running this tool on untrusted files without sandboxing.
Links
← back to The Glasshouse on ryanlabouve.com
North Korean actors impersonate web3 recruiters to steal credentials and source code. MeshCentral agents masquerading as Azure endpoints used in education sector attacks. Short-form video platforms become a new vector for infostealer distribution.
Show Notes
Social engineering continues to dominate the threat landscape, with adversaries leveraging impersonation across recruitment, cloud management tools, and social media platforms. This episode covers three notable developments: North Korean threat actors targeting web3 and AI firms through fake hiring processes, the abuse of legitimate remote management tools like MeshCentral disguised as Azure endpoints for lateral movement, and the emergence of short-form video platforms as a distribution channel for infostealers. The common thread is credential theft and infrastructure access, with adversaries adapting their tradecraft to exploit trust in familiar platforms and workflows.
In this episode we cover:
- North Korean threat groups impersonate recruiters for web3 and AI firms to steal credentials, source code, and VPN/SSO access.
- MeshCentral agents masquerading as Azure endpoints were used in education sector attacks, deploying a custom lateral movement script. Investigators should note that searching for MeshCentral instances without proper OPSEC can expose their own infrastructure, and the report does not specify whether the agents were signed with valid certificates.
- Short-form video platforms like TikTok and Instagram Reels are exploited to trick users into running PowerShell commands or visiting malicious download sites.
- The UNK_DeadDrop campaign targets developers via malicious GitHub repositories, with multi-OS payloads attributed to North Korea.
- Court-documented recruitment tradecraft reveals fake identities, cryptocurrency payments, and pressure to share insider reports.
- Service desk compromise is highlighted as a common first step in ransomware attacks, with M&S losing £3.8M daily during a five-day outage.
- Over 20,000 Instagram accounts are stolen in a Meta AI support hack, demonstrating real-world abuse of AI customer-facing systems.
Links
← back to The Glasshouse on ryanlabouve.com
Stay out of the light.