Welcome back to the Awareness Angle.
This week we're exploring what happens when AI gets powerful
enough to find and exploit vulnerabilities on its own.
Thanks to Anthropics project Glass Wing, we've also got
serious Grafana floor that turns AI systems into data
exfiltration paths and a leaked Window Zero Day which is
handling attackers system level control.
On the human side, attackers are using fake missile alerts and QR
codes to steal Microsoft credentials at scale.
Then there's big, big policy questions bubbling under the
surface with major proposed cuts to CSA.
All of that and the Fish of the week, and a whole lot more on
this week's The Awareness Angle. And with me, as always on this
week's awareness angle is my partner in cyber crime
prevention, it's Mr Luke Pettigrew.
How you doing, Luke? I'm doing well.
Thank you, Ann. How are you?
I'm good. Yeah, Let's get straight into it
then, with this week's breaches of the week.
OK, I'll kick us off this week. And the first one, hackers steel
and leak sensitive LAPD police documents.
This one's coming from TechCrunch.
Cyber group Cyber criminal group World Leaks has allegedly stolen
and leaked a massive data set linked to the Los Angeles Police
Department via a third party storage system tied to Los
Angeles City Attorney's Office. This includes Office of
Personnel files, Internal Affairs investigations and
sensitive legal discovery material and unredacted personal
data such as witness identities and 7.7 terabytes of data.
337,000 files were reportedly taken.
That's that's hefty. The LAPD say their own.
Systems were not breached, but they are investigating the
situation. That's quite a scary one That's
it's a lot of data and especially unredacted witness
statements and stuff like that that's.
Frightening everything. You don't want to go public,
right? World Leaks, I hadn't, I don't
remember I was talking about much before, but apparently
they're a rebranded group that were previously known as Hunters
International and that name does ring a bell, but they've been
all over the place. They've healthcare,
manufacturing technology. So yeah, they're all they're,
they're not fussy. Who they who they attack?
Which, yeah, yeah, and again, the third party tool being the
supposed culprit. Yeah, there's not much that I
don't think there's much detail on this.
I mean, the data's hosted again by Distributed Denial of
Secrets, which we spoke about a few episodes ago.
Some of the leaked data was there and then it was deleted on
the Gang Leaks Gangs leak website and they don't know why
the date is no longer listed. Maybe, maybe something's
happening behind closed doors. Who knows?
But yeah, yes. Third parties got to keep a
watch on your third parties. It's helpful to emphasise why
you have third party vendors, like why there's an approval
process. And you can't just use anyone
this. Is worthwhile.
Did you want to jump on to the next one?
Yeah, quickly, I'm covering this bit.
So the next breach we've got is Wynn Resorts say 21,000
employees were affected by Shiny Hunters pack.
They have breached 21,000 / 21,000 employees hitting their
HR systems back in October 2025. But yeah, this one is been taken
by Shiny Hunters and it's been shared on their website, but I
think that was a little while ago actually, on this one.
But yeah, it says that on this one they removed the data that
I'm suggesting that they Win Resort had paid the ransom, but
they've declined to comment on that.
There's a few bits of more information, but it says they
were off to $1.5 million. It's probably one of those
things we'll never know if they paid it.
It's $1.5 million to get all that data back and to make it go
away to a big organisation. It's probably not a lot of
money, is it? So it's yeah.
Yeah, there's a, there's an image image on the report that.
Claims over 800,000 records containing PII and employee data
have been compromised. This is the final warning to
reach out before we leak, along with several annoying digital
problems that will come your way.
Don't be make the right decision.
Don't be the next headline. There you go.
I know what a board would say if they were faced with that
option. They ought to be the headline.
Pay the money. They're just looking into I
didn't know what Ryan Resorts were but they're high end casino
and hotel operator and a quick Google says that their 2025
revenue was 7 billion so 1.5 million is nothing.
It's a drop in the ocean. Yeah.
Yeah, right. I'll jump on to the next breach.
And this was one that was first reported on Reddit and hit the
news a couple of days later. So I think the impact was felt
before it was actually confirmed.
This comes via the register and it's Dutch healthcare software
vendor Chipsoft. They've gone dark after a
ransomware attack and their website was taken offline and
disrupted hospital systems across the Netherlands and their
firms. Patient record software is used
by most Dutch hospitals and several hospitals have been
forced to partially shut systems down while a national cyber
emergency teams are looking at the impact.
So only 11 hospitals have pulled their software offline, nine of
which are among the institutions that use the software more
extensively, according to local news outlet Nos.
Yeah. So Zedser received a
notification that Chipsoft had fallen victim to a ransomware
tack. The group behind the attack is
not yet known, but and despite disruptions, Chipsoft Chipsoft,
not chip shop Chipsoft public facing services, the majority of
hospitals the company serves are still able to use their patient
portals. So some impact, but again, you
know. Healthcare, it's just they don't
care who they target. They will target anyone and
everyone, yeah. Next one, moving on from that,
we've got one more breach to talk about quickly.
It's James Dave confirmed that a limited breach happened after a
phishing attack by silent ransom group.
Just. They're a law firm in America
and they've, yeah, basically confirmed the data breach after
the silent ransom group leaked limited client files for around
10 clients on its website. The group's also known as Luna
Moff, and they've reportedly demanded a $13 million ransom
during the negotiations. And friend, wider exposure of
sensitive, sensitive legal data and reputational harm.
And yes, this one, there's quite a lot of information on it in
their blog posts that we've got here.
But it basically says, yeah, that this silent ransom group
and known as Luna Moth, Chatty Spider and UNC 3753 and they've
been targeting law firms since 2023.
It was obviously lots of sensitive data within there and
a lot of money involved with it. There's also a conversation like
an e-mail, Fred, it looks like talking about the negotiation,
which is something you don't really see too often, but you
can't really read it. It's very small.
But yeah, says that there's don't think there's any
resolution. So a quick look trying to find
out, don't reason to say if they've what sort of happened
with this one. But I think they basically
warned that they would leak the day if the ransom wasn't paid,
but I'm not sure where. Let's go on to.
You can zoom in though if you open that image in a new tab,
you can just about make it out if you read between the pixels
says. We will begin contacting your
staff and publishing your files on our website if we do not
receive a response by today. And then could you please
provide the following some file names Rhode.
Islanddoc1.pdflowesbrief.pdf Here are the files that you
requested. We believe this is enough
evidence reviewed everything and has come up with a price of 13
million U.S. dollars. We're expecting your response on
a daily basis in order to meet a mutual path and peaceful and
ignorance will be considered as no willingness to meet a mutual.
Yeah, so. It's all very, it's all very
polite, but it closes. As we said, in case of
ignorance, we will make you face severe consequences.
This is the last warning. Before your data gets published,
so. Yeah, quick Google seems to say
that it has been posted, but there's not a lot of information
out there. Jones Day have been hit before
as well, back in 2021 and through a third party file
transfer. Service yeah, so they have
experience with this, but there we.
Go Yeah, Those are this week's breaches of the week.
Should we go on with some news? Yeah.
Let's go for it, OK? Let's do the news right this
week. Opening up, I'm going to go 1st
and you, if you're in cybersecurity, you've probably
been living under a rock if this is the first you've heard of it.
Anthropics, Claude Mythos finds thousands of 0 day flaws across
major systems and big thank you. I was sent I might play actually
because it's quite good. Anthropic obviously behind
Claude, They developed a brand new LLM called Mythos and it was
too powerful. Let me let me play the video.
Let me play the video yes I got sent in this video by Simeon
quarry at the Vida hi Simeon, but I got sent this and I
thought it's actually really useful so let me just.
Share it here. You don't need to see it.
You can hear it as well. So if you are listening and
you're not watching, that's fine.
If you're if you want to watch, go over to YouTube, search for
the awareness angle or risky creative.
The links are on there as well. So let me just press play on
this quickly. Finally here, but it's so
powerful that they're not releasing it to the public out
of fear over the damage it will cause.
Instead, Anthropic announced project last week, an urgent
initiative that gives access to Mythos only to AWS, Apple,
Google, Microsoft, NVIDIA, and a few others so they can fix their
code First, Because over the past few weeks, Mythos has found
thousands of critical vulnerabilities, including every
major OS and web browser. One Anthropic engineer asked it
to find bugs overnight and woke up to a complete working
exploit. It discovered a 27 year old
vulnerability in open BSD and OS.
Literally famous for being secure, it even found some
vulnerabilities on Linux that can allow a user with no
permission to suddenly control the entire machine.
But here's the widest of all. During testing, Claude Mitos
preview broke out of a sandbox environment, built a moderately
sophisticated multi step exploit to gain Internet access, and
emailed a researcher while they were eating a sandwich in the
park. On top of it, the benchmarks are
insane on every single. I'll pause it there.
I'll put a link to the video in the newsletter, but as you can
see, Project Glass Wing hugely powerful, shut away.
That video is really nice, really nicely made as well.
What starts as a talking head with some really simple
animation, which is nice, yeah. But yes, so it goes away.
It autonomously discovers, exploits and exploits them and
has found some really scary stuff in a very short period of
time. You know, this is like pens AI
pen tester extreme. I was speaking to someone the
earlier this week about how AI pen testing is kind of a mixed
bag. I think this probably changes.
Yeah, it seems so, judging by the response this has had.
Right, It's everywhere at the moment.
We all knew it would come though we, you know, with AI doing what
it does, you know, we all knew that it could.
The thing is if if they've done this for good, then someone can
maybe do it for bad, you know what I mean?
Yeah, sure. It might be long before for that
happens. People will start using these
tools once once they breach into like a Amazon or Google for
example. You could essentially use this
once you're in. Let's let's not forget as well,
this is what Anthropic have created and Anthropic are doing
the right thing with this, right?
They're putting it, they're locking it down, they're
restricting access. There are other AI companies out
there that may not lock it down and may not restrict access.
Or is this a little peek behind the curtain at what nation state
actors will have? You know, what does America have
that they're not telling us about?
What does China have that they're not that kind of thing?
Do you know what I mean? It's.
Yeah, Anything is now possible. Yeah.
It's a good story to talk about. You know, careful if you have
developers in your workforce, This is why it's important to
keep security and keep coding securely because there's now
things that are going to find stuff that they thought they.
Could get away with SO. Yeah, yeah.
Right, move on to the next one if you want.
Cool, James. The next story we got is Grafana
ghost formability which is allowing data theft, fire AI
injection. So this is adopt just Grafana
ghost impacting the popular tour Grafana which businesses use to
monitor various things like financial metrics,
infrastructure, health, private customer information, lots of
sensitive data, which obviously is makes it sort of quite
concerning for those businesses that use it.
There's a whole lot of information here, but it's some
of that the name of threat research team have sort of found
and looked into allows as hackers have bypassed secure
protections and secretly moved data from the company's
environment to external server. And this happens without users
knowing and unlike traditional scams, doesn't require any way
to click on anything. It just operates autonomously in
the background. And it says here that from
Numa's investigation, the tech use utilises indirect prompt
injection, hides instructions in the data that the software's AI
components process, and it tricks the system into ignoring
its own safety rules by using specific keywords like error and
various other messages to confuse the AI model.
Yeah, this, this goes into a whole lot more information.
But yeah, it's quite a, it's quite sort of a potentially not
new, but it's kind of a unique way of sort of compromising a
system, I guess with this built in AI features and, and
obviously tricking the AI into into thinking it's genuine.
So associated that Grafana, that's a push back on the
characterization of the reported issue, stating that whilst the
floor in the markdown image renderer was identified and
property patched, it did not amount to a zero click or
autonomous exploit. And then it goes on to say,
according to Grafana's CSO, any successful abuse would have
required a substantial user involvement, including
repeatedly directing the AI system to act on malicious
instructions even after being warned about them.
Says as well that the companies have emphasised that there's no
evidence of this vulnerability being exploited in the wild and
confirms that no data was exposed from cloud.
So it's, yeah, it's interesting that the secure researchers sort
of said this and then the company themselves come out and
say otherwise. So who knows what's there, what
the truth is here, But hey, I just want to look out for I
guess for Grafana customers. Grafana covering their buds
obviously, as you would expect, you know, because they don't
want to find themselves exposed. I mean Grafana has been used.
For years and years and years by lots of different teams, lots of
smaller instances as well. I think with that, you know, I
think back to when we were together, there was numerous
people running different versions and did their own
thing, so. If you're an awareness
professional, this is a great even if, even if like Grafana
say, this isn't actually an issue, it's a good opportunity
for you to build some bridges and relationships with different
people that might own it. Get an understanding of what the
land looks like and then just have those conversations because
it's just another opportunity to talk about security to people
that wouldn't normally talk about security.
You know if you if. You've got a Windows
administration team or a Linux server team that are running
Crafana or the dev team or something like that.
Have a chat with them about this, find out how they use it,
understand their world a little bit more.
I think that's that's probably a good thing in some ways.
Guess as well I'll just quickly on like AI features.
I don't know if it's a standard feature, right, with this
platform, but often, yeah, people are using Ferris Air
tools and this sort of shows you how easily, I mean, according to
what the research team said that you can sort of trick the AI
into doing various things and yeah, goes into the obviously
prompting that prompt injection or indirect prompt injection.
Like I said, there's there's lots of topics to educate people
on, I guess. And yeah as well, like tools
being approved and having AI features and making sure they're
obviously assessed and some of these features might become a
thing later on, yeah, after it's been assessed as well.
So some interesting takes on this one.
Yeah, yeah, right. I'll move on to the next one.
And the next one is from Hack Reed missile alert, fishing
exploits, Iran, US, Israel conflict for Microsoft logins.
And this is another example of just like They Don't care, a
phishing campaign is exploiting real world tensions involving
Iran, Israel and the US by sending fake missile alert
emails that impersonate government civil defence
warnings. So the scam uses urgent language
and QR codes to bypass e-mail philtres, getting you off of
your device and onto your mobile device where you don't have the
same security controls. Like we often say with QR codes,
it redirects victims to a fake Microsoft login page, which is
obviously designed to steal your credentials.
But the unique thing here, I mean, there is a picture.
This isn't even fish of the week, but let me show it
quickly. It's slightly terrifying.
I think it's it's not the nicest of things to receive.
Yeah. We can see here in this.
Let me just zoom in a little bit.
Public safety advisory action recommended.
That's the subject line. And if we look at the e-mail
address, it's from ministryofinterior-civildefencenetwork@qualitycollection.com,
dot AU. Yeah, so dot AU, which is
Australia Air raid, emergency alert, alert classification,
severe active public safety notice warning, take cover
immediately. Due to ongoing conflict in Iran,
there is an elevated risk of missile attacks.
Civilians must be prepared. Authorities warn that conflict
may expand beyond the region and could extend into parts of Asia.
So this e-mail, this e-mail must have let me just read the
article a little bit more, because this must have been
received by people outside of that area then.
But anyway, it goes to a fake Microsoft login page, which
looks like a real Microsoft login page if you don't look at
the URL. So if you look at the URL, you
can see it goes to like.ru/somethingelse.
So it's not on microsoft.com, but it looks like a legitimate
Microsoft sign in Page. So yeah, that was reported by
Covence and featured on Hack Read this week.
So I just thought that was that was interesting because it's
another example of QR code phishing that we.
Featured as a Fish of the Week in the episode or two ago.
Yeah, so and this one doesn't. This takes you off.
There's no security controls. Maybe you don't notice the URL
so easily on a mobile device. Maybe you're not used to what
the Microsoft screen looks like on a mobile device.
So you're more likely to log into something that looks a bit
funky. Yeah.
So be careful. Interesting 1, like it kind of
feels like one that'd be more for personal recipients rather
than lack of business potentially.
Yeah. So I guess you know, kind of for
awareness people, it's always good to like educate people and
obviously phishing emails and then they can benefit from from
in the personal e-mail inbox. But also, yeah, this interesting
to have a Microsoft login as the landing page when not
everybody's going to be using Microsoft.
So there's lots of red flags I guess on this one.
Yeah. Yeah, I wonder how specific it
was, but I guess as well like using the QR code, it's probably
not too implausible, right? It's like there's potentially a
lot of information and it's just like a quick way to get to it,
but especially on your phone, right, if you're you're going to
go away from your computer sort of thing.
It does say here it's going. To make sense in a way.
It says scan for instructions, access official emergency
procedures, shelter guidance and evacuation instructions,
recipient action scan immediately using a mobile
device and review updated instructions for all household
members. Why would they put that behind a
login screen? Why would you need to log into
Microsoft to view the emergency procedures and shelter guidance?
Ask you you don't pause in a state of an emergency this.
Is designed to heighten your senses.
You just do and you don't stop. That's the problem.
But yeah, why would you sign into Microsoft to access that?
Right, move on to the next one. OK, next one we've got
disgruntled researcher leaks Blue Hammer Windows Day, Windows
0 day exploit. So this one says here that yeah,
researcher publicly leaked what's called Blue Hammer.
So unpatched Windows local privileges escalation 0 day
affecting Microsoft Windows after a dispute disclosure
process with Microsoft. So it says here the security
research, we found it, I tried to report it and was not happy
with how Microsoft's response team handled the disclosure
process. And as well, it says here that
the issue has no official patch and there's no update to address
it. So it's considered a zero day.
So this is a Bleeping computer article and it says it's unclear
what triggered the public release for the exploit exploit
code. But there's a blog post of the
person that disclosed it how the aliases chaotic Eclipse and
they've they in quote said I was not bluffing Microsoft and I'm
doing it again. Unlike previous times, I'm not
explaining how this works. The all geniuses can figure it
out. Also huge thanks to the MSRC.
They were the Microsoft Security response Response Centre
leadership for making this possible.
They've added in their blog posts.
So, yeah, they've published on GitHub with this blue hammer
exploit. And yeah, it's quite unheard of,
I think, isn't it? For, I mean, obviously scary
researchers aren't always the good guys.
There's you could always have a someone who's not a bit more
neutral. And obviously they got upset
with whatever happened about it. But yeah, it goes in to explain
that this exploit, yeah, local privilege escalation.
This post goes into all information about it, but it
does say, and there's further down as well, that testing of
the exploit was not successful on Windows Server.
And there's also a screenshot of it being blocked or detected by
Microsoft Defender, which is interesting.
Yeah, I don't think there's a whole lot more.
They do have a statement, Bleeping Computer from
Microsoft, which has said Microsoft have a customer
commitment to investigate reported scary issues and update
impacted devices to protect customers as soon as possible.
We also support coordinated vulnerability disclosure, a
widely adopted industry practise that helps ensure issues are
carefully investigated and addressed before public
disclosure, supporting both customer protection and the
security research community. Yeah, so I think that it's
potentially still vulnerable. I don't think it says it's been
patched yet. Microsoft are big enough and
ugly enough that they can get away with stuff like this, but I
know that businesses will quite often.
All businesses of a certain size will quite often get approached
by someone that says, I found the exploit, I found something.
It used to happen when we worked together, and it happened at the
last place I worked as well. I think from time to time
someone would reach out and say, I found this.
Who do I speak to? Do you have a reward?
Do you do a bug bounty? Take these people seriously.
And sometimes it will be like the smallest, lowest priority
thing. And it's like, oh, yeah, we
know. It's like we know that exists
because this, you know, it's a known thing that's going to be
really complicated to patch. But sometimes there is gold in
those and you. Don't want them going.
Public with it and then you being taken down.
That's that's the problem. Yeah, especially with this one,
it says yeah, that it allows them to escalate the system
level control and fully compromise the machines with
tail control. So it's quite a potential big
one for I think it got attached with it.
I think it said on this one that they need, they do need local
access to the device, but that's easily achieved with click fix
or social engineering or things like that, you know, just that's
not a protection anymore. It's really easy to get a user
to do something on a device. Or for them to give you the
access to do something on a device.
Yeah, yeah. Next one, right, the next one.
The White House is seeking to slash CISA funding by $707
million. So the administration, the Trump
administration has said that they've 2027 budget refocuses
CISA on its core mission to protect federal, federal
agencies and critical infrastructure.
So they're proposing a $707 million cut to their budget.
They can eliminate programmes seen as redundant or politically
driven. They also are seeking to remove
several initiatives, including misinformation and international
engagement efforts, continuing a broader trend of restarturing.
We spoke about this before because the whole CVE system run
by MITRE, It was reported that MITRE funding might be stopping
like almost overnight. And the whole CVCVECVES are
basically the records for all the exploits.
Every single vulnerability pretty much gets ACV assigned to
it. And that is a central database
that globally is used by multiple systems to do that.
And as a result of CV ES possibly going, the EU quickly
set up their own equivalent. But it looks like that problem's
not going away. So we'll see what the budget
looks like. This is just a proposal.
It has to go through Congress and stuff like that, but that's
all LED there. By the Republican.
Party so they pretty much can do what they want at the moment.
Doesn't it bode well? Does it really?
No, it's interesting. The article says it would bring
their budget down to 2 billion if they did cut that.
And in 2025 proposal nearly 500 million cut, but Congress pushed
back and it was 135 million. So yeah, interesting one.
Yeah, I mean, 1/3 a third of staff left CISA about a year
ago, in the first months of Trump's second term, which was
probably. Dog or someone like that so.
You took the other one to invest a lot into that given the
current climate. But do you know what?
They're making the biggest investments ever in their
military. And you would have thought that
this would kind of tie nicely along with it.
And I wonder if it's not being sold in the right way like the
impacts of this. But but it's that there's also
the line in there about the international collaboration is
that there is that, that maybe they feel they're doing too much
work for everyone else, which is what's been said in the Middle
East, isn't it, that, you know, no one's helping them.
Yeah. Now.
Maybe that's part of the problem international engagement efforts
anyway. Well then keep an eye on that,
because if all of a sudden the CVE database doesn't get updated
anymore, we're all going to need to know where to get our
vulnerability confirmation from. So it's one worth keeping your
eyes out for. I'm sure it'll be big news when
it happens, if it happens. Probably will happen, but there
we go. Right, that is this week's news.
So now let's go on to the fish. Of the week.
Right. And this week's fish of the
week, as always, comes from the threat intelligence team at
Hawks Hunt. And this week it's a bit of a
bit of an interesting one. WhatsApp Meta impersonation
leading to credential and verification code theft.
So we have what we can see here is essentially a WhatsApp
message. It says.
Dear partner, we hope this e-mail finds you well.
We're reaching out to notify you that based on your company's
performance metrics reviewed for 2025, you've not met the
requirements to maintain select level status in the Meta
Business Messaging Partners programme.
To assist you, please refer to this guide.
If you require support, submit a request through the partner
portal support firm. There's another couple of links.
You have until March the 12th to fulfil the outstanding
requirements and maintain your current selected status.
So deadline. If you have any questions,
please contact the support team via malicious link.
So yeah, it's that in itself is, you know, there's a little bit
of pressure there, a little bit of.
The sender address the, the red flags on this, the sender
address doesn't match doesn't match WhatsApp.
It's actually a Salesforce.com e-mail address.
It is imitating the WhatsApp branding.
So it does look like it's WhatsApp from Meta.
There's obviously the pressure of quick action.
Oh, do this quick or you're going to lose access and
there's. 4 I think. 3. 4 links in that partner portal support
forum. You can see the guide which is
accessible here click here and then there's a big green button
at the bottom. They'll go to the same place.
They all, they all go to the same destination.
And it's that destination that is interesting because what do
you get when you click through? You get.
A fake login page which asks you to log into your meta partner
partner portal and then ask you to verify your identity.
So that's obviously I'm assuming this was targeted and it's then.
Stealing your partner portal login page and it's going to
capture your verification. Codes for MFA as well.
So as you sign in, some secret system is probably signing in,
you know, ghost system signing in on your behalf.
It's probably just pasting those over so.
Yeah, it's it's important to remember as well that even the
the smaller systems that we use, you know, this isn't something
that I would probably receive because I don't have a partner
portal account you if you received.
That message you'd probably disregard it because I assume
you don't have a WhatsApp or Meta partner Paul account.
But if you do have one of those accounts and you do see that
message losing access to that account very.
Shortly would probably be quite scary and a bit disruptive, so
you're going to be encouraged to quickly do it and it all looks
very, very legitimate. Doesn't it?
Yeah, especially the landing page.
Yeah, it looked pretty genuine. I mean, it didn't show what URL
you'd see, but presumably it's some yeah, random sort of M
doing the same metro or anything in it, right?
So again, probably some red flags to look out for, but like
you said, in an urgent sort of scenario you might just blindly
start doing it. If you get one of those, if you
get something like that, it's often best to go directly to
source and and just go to. Google Facebook partner portal
and look for the first organic result.
You know, don't click on the paid foreheads because it might
be malicious, but you know, Google it or have it saved in
your bookmarks. Like this is a really good for
the stuff we do before I log into the platform we use to
record this. I've got it all bookmarked so I
don't need to find it on an e-mail or type in the address.
You know, bookmarks to your trusted sites is a maybe that's
maybe that's an awareness message that we should push out.
You know, like if there's a site you log into, bookmark it.
Do you know how to use the bookmarks bar?
Do you know how to organise your bookmark folders?
Bookmarks are like a forgotten thing, right?
Exactly. Potentially.
I mean, yeah, but we didn't really talk about it much.
Right. What a great site, What a great.
Angle for secure Internet usage. You know, this is the site.
It's it's but shortcuts. It saves you looking for it and
potentially falling foul. I I haven't even got into this
planning that, but I think that's that's a great piece.
Like do some promotion on bookmarks.
It it encourages safe browsing behaviour.
Yeah. Anyway, that's this week's fish
of the week. Big thank you to the threat
intelligence team at Hawks. Hunt for that.
Awesome, yeah. So let's get on with some
security socials. This week I had a few things to
share with you, and this one is from Reddit, obviously, because
that's where I spend. My spare time.
And this one is from a subreddit called Interesting as we'll keep
it PG, but you kind of get the picture.
This is North Korean state sponsored hacker got exposed
during a job interview. Have you seen this?
No, no. Let me turn, turn the volume on.
Listen to this. Hello, just to explain, this is
a zoom call. All we can see in the video is
just the gentleman with a headset on.
OK, you don't need to see any more.
It's not like last week's with three.
Fingers over the face. Just listen to this North Korean
state sponsored hacker got exposed during a join.
Hey, you're back. What happened?
Yeah, OK. I just.
Yeah, there's no issue. I just.
OK, no worries. Yeah.
I mean, I was, I was in the process of saying, like we did
like a lot of imposter candidates, you know,
particularly N Koreans, like posing as like people that
they're not. So one of the tests that we do
is trying to get them to say something like Kim Jong Un is a
fat, ugly pig. Would you, could you say that
for me? Sudha Sudha.
Sorry, no Kim Jong Un. You know, the leader of North
Korea. Yeah, I sorry, I just say I
should say like that, yeah. Yeah, if you could because,
because it's one test so that I know that you're not not North
Korean. Yeah.
Can you say that? What is it is that?
And they froze. And I think that damn.
He really don't want to say it. So there you go.
Yeah. And then they just dropped off
the call. So I thought that was that's
obviously like someone who claiming not to be from North
Korea, but it's actually from North Korea, you know, was it
no, was it night before that hired a North Korean?
Was it night before? Possibly.
Yeah, one of the security firms happens all over.
One of the security firms hired a North Korean operative and
then had to. Come out and say we discovered
it. Here's how we discovered it.
You know it's. It's a way to infiltrate.
So yeah, last week we had three fingers over the face to spot a
deep fake, and this week King John is a yeah, I should say it.
I'm not North Korea. He's a big, he's a big ugly pig.
There we go. I can say it.
I'm. Yeah, yes.
So that was the first one I thought was quite interesting.
The second one I have to share a picture of because the post
actually got deleted from Reddit, but I found it.
OK let me just share this instead.
This was from recruiting hell. OK and this is a great security
message here. Interview went great until they
accidentally sent what they said after my husband disconnected.
My husband had a virtual interview today.
He felt really good about it and they gave a lot of positive
feedback during the interview, at one point saying this is the
best interview we had. However, this evening he was
sent a transcript and audio file of the entire interview,
including the recruiter and interviewer discussing my
husband after he disconnected from the call.
I don't know if they know they did this.
In that recording they made comments about his appearance
including I hate this effing man.
Bun referred to other companies as Boujee, talked about stealing
business from competitors in a pretty aggressive way, said they
will put another business out of business and praised men who can
fight and go for a beer later, while saying others who are
bothered by that are little girls.
When the interviewer asked the recruiter what my husband's
desired salary was, he said oh it's on the low end and then
proceeded to say he would offer him less than what my husband is
asking asking. Clearly if he's offered the job
he won't take it, but I feel like this is really entitled,
unprofessional behaviour. I'd love to expose them, but I
also don't want to put my husband at risk.
Of not getting other jobs in the industry because of the drama.
What are the things we could do that wouldn't?
Necessarily be tied to us always to do something about this.
Maybe that's why it got deleted from Reddit, because they
didn't. Want it coming viral?
Because it did pretty much go quite viral.
So, yeah, like if you've got external third parties in a
meeting and then the third party, I've seen it happen loads
of times. Like, Oh yeah, I'm done, I'll
drop off. Oh, can you, can you just look,
can you just stay on? And then you stay on, you wrap
up. God, I'm glad he's gone.
You know, now we can like, oh God, did you see what he was
wearing? And then when the notes, when
the transcription is sent, it goes to all parties.
So this must happen loads. Loads and loads of loads, but
people won't think about it. This is a proper big data
leakage. Hell, I think if you're.
Yeah, that's terrible. If you're doing anything, it's
almost like if you're on a meeting with more than just two
and then someone drops off and you want to carry on, start a
new meeting. That's a really good there's a
great message to give out to you people.
You know, here's a great example of why I bet this happens.
All the time, all the time. Yeah, I think as well, like
sometimes you are ask someone to come back into a meeting as
well. So it could also happen I guess
in that way if you say something before then after they've left
and then come back. Yeah, yeah, that's pretty awful
if it's if it's true. Yeah, right.
Let me show you my next thing. I love this guy Matty Mctech.
His videos come up quite often. This one I saw on Facebook
because I'm of the generation that still uses Facebook
occasionally, and I was today years old when I found this out.
I'll show it to you and then we'll talk about it after.
I was today years old when I found this out.
Is there you can actually create QR codes in your Microsoft Word?
All I have to do is click somewhere on your Word document,
then press control and F9 on your keyboard and type in
display barcode and after a space you're going to open
quotation Marks and then type in where you want the QR code to
take you to or display and then close the quotations.
Then you're going to do space UR space back slash 3 and when you
hit F9 on your keyboard, it'll generate you a working QR code.
I can scan it with my phone and it'll take me to that link.
Easy. You don't need to use random
third party QR code creation tools, you can just use
Microsoft. Word to make a QR code.
Oh yeah, good for those that use it, but.
Yeah, I didn't know. Very well known, right?
No, I had no idea. But there's, you know, there's a
really good idea if you've got think about the teams in
business. Here maybe?
Well, it's a bit complicated, but you could save that, save
that as a, save it as a doc and then change it.
It's, there's probably it. Got it.
I'm only now just thinking there must be easier ways to make QR
codes than Googling it and going to a random website.
But the teams that will probably be running Microsoft Word, HR,
finance, people like that, you know, and they might be making
posters for bike sales or charity things or job vacancies,
that kind of thing. It's a.
It's it's not straightforward, but it's also not overly
difficult. This it could be a good thing to
to maybe communicate to to your business because it's a little
bit safer maybe. Yeah, that's.
Interesting. Let me show the last one I had
this week and this again was on Reddit.
And this was from mildly infuriating.
My phone had an update and automatically installed TikTok.
Well that's terrifying isn't it? So we look here, this is TikTok
Lite is installed after an update.
Someone else? The top comment on this then
says, Is that a giant ad on your screen?
And the original poster reply said no, it's a shortcut to it
Aliexpress game page. It's like but if you look at
some of the comments every time I get an update I get random ass
games installed. The last time it was easy words
number. Tiles and colour sort.
Someone says disable your carrier's.
App Manager, yeah, it's different things based on the
carrier it's. It's.
Mad isn't it? Like I don't see this because
I've got an iPhone. This is why I returned my 2000
Canadian dollars unlocked Samsung phone.
Either lower the price or remove ads.
You don't get both and someone says Google pixel phones are the
way to go. It's it's crazy isn't it?
Like WTF is Tiktok Lite tracking and ads only Probably it's yeah,
yeah, yeah. It's, I do wonder, like maybe
it's maybe it's malware, maybe it's some third party app that's
installed that's also doing this.
Like you wouldn't get a pixel doing it.
Maybe Samsung do do it a little bit.
I don't know. But you kind of expect to have
some privacy, don't you, on your own device, especially on a, if
you've got corporate accounts on there, like any random game or
unloaded, you don't know what the permissions are.
Imagine if like last week we spoke about the White House app.
Imagine if that just got deployed to every American,
every mobile phone, and now gets the White House app.
Is that the old iTunes and the U2 album it came free loaded
into? It and that was just free music.
That was just. 12 tracks for free and the world went mad
because it was sent to every single iPhone.
Can you imagine? It probably wouldn't even get
talked about now if the White House app just ended up on every
device with full permissions like.
Yeah, that's crazy. Yeah, anyway, that's everything
I had this week and you don't have anything this week.
No, I didn't. Didn't see much doing this.
So we're done. That's us done for another week.
So yes, if you see anything out there in the wild and you want
to let us know, please get in touch.
Hello at riskycreative.com. Big thank you to Simeon for
sending that video over. I think I had.
One sent by someone else and I can't remember.
It's fine, I do it next week. Next time maybe.
Next time, OK, sign up for the newsletter, follow us on
YouTube, Spotify and all the podcast platforms.
And Luke and I, we'll see you again next week.
Cool. Cheers, Christina.
See you later. Bye bye.