This week, AUS General gets drunk in Kiev, falls over three
times and then has a meeting with the Secretary of State.
Classified maps go missing on a train. 8 million anonymous crime
tips turn out to be not that anonymous.
The FBI seizes A hackers group's website, but the hackers were
already building new ones. And a Chrome extension you
probably use this week I did has been quietly stealing money from
you for months. Not me, I don't think.
Maybe I don't know, and company's house here in the UK
left the front door open for five months.
You could get in just by pressing back a few times.
It's been a week. Let's get into that and a whole
bunch more on this week's The Awareness angle.
With me, as always, is my partner in cybercrime
prevention. It is of course, Mr Luke
Pettigrew. How you doing, Luke?
Hey, I'm, yeah, I'm Tim off. Thank you.
How are you? I'm good.
Yeah. It's, it's been a week.
Lots of planning and scheduling and conversations.
It's great. Things are growing, but not
ready to announce any of it yet. So yeah, what about you?
Just all good. Yeah, I've been pretty, pretty
quiet one for me, thankfully. Nice, right?
Should we get into it? Should we get on with it?
Yeah, let's go for. It OK, Don't forget all views
and opinions expressed by me or Luke on the show.
I own it and do not represent those of our employers.
So let's get into this week's breach of the week.
And this week's breach of the week is the former US general
who got drunk in Kiev, suffered concussion.
And then they've classified maps on a train.
A watchdog finds. This is a story.
I saw this posted on Reddit and it's one of those that, like, it
sounds made-up, but it's too unbelievable to be made-up.
So a Department of Defence Inspector General report has
found that Major General Antonio Aguto junior, who led U.S.
military assistant efforts in Ukraine from Germany, committed
2 serious security breaches in 2024.
In March, he left classified maps on Auk Ukraine train after
bypassing required career protocols.
The documents were only recovered the following day.
And then two months later, he consumed up to a litre of
alcohol at a Kiev dinner, suffered A concussion from
subsequent falls and appeared visibly impaired at a meeting
with Secretary of State Blinken the next morning.
We don't really care about the drinking.
He's allowed to. Where's the, you know, this
isn't the alcohol awareness angle, although, you know,
drinking moderation, folks. This is the awareness angle
focusing on cybersecurity. It's that one leaving the maps,
leaving stuff on a train. That's like, wow.
Skipping the official process, the official protocol.
That's the scary 1, isn't it? Yeah.
And no, I was going to say it's, that's the reason I brought it
because it's just, it's unique. It's you know, that's the,
that's the angle on this. You know, it's not, again, not a
massive breach. You could have had serious
implications, but it's not a massive breach.
But it's just another, it's, it's different.
This is another case of someone not following process, not
following procedure. And then data has been leaked.
And I remember in the news all the time there used to be the UK
government have left CDs on trains and floppy discs on
trains. This isn't the first time
something like this has happened at all.
No, but yeah, it's just going to say it's quite unusual these
days to really hear about stuff like that.
Physical. Media, yeah, the focus is
obviously always online and breach is happening that way,
but maybe remember of the story many episodes ago about the
sensitive military documents found on the streets of the UK?
It's very similar. That was the one where the bin
bags where someone had put them out in the trash and they were
just blowing in the street, Yeah.
I think that's for for people like us, and I guess maybe more
so like the privacy kind of side of things is we don't really
talk about documents and hard paperwork, what to do with them
and best practises and stuff is sort of everything's digital
these days, isn't it? But yeah, makes you think it's
about similar sort of thing where you used to see in the
news about like new iPhones or new games consoles or whatever
being left somewhere and like, yeah, just left in the pub or
something. Like one of the new phones
that's someone's prototype. Yeah, yeah, yeah.
I think, I'm sure that happened to one of the iPhones.
There was a one of the iPhones. I'm sure someone left it in the
pub or something and it was a proper prototype, like brand new
design. It was one of those where they
changed the physical design of it.
I'm sure this this story comes from the Kiev Independent.
The websites just asked me to allow notifications, which you
can do if you want, but I probably wouldn't recommend it.
There's a 50 page report on this saying he violated policy and
his handling of classified maps while on State department chart
trains. I'm just looking.
The report, which was compiled after receiving three anonymous
complaints, notes that Aguto improperly assigned control of
the maps while on route to Kiev, leaving the materials in the
hands of staff instead of a diplomatic career as required
upon the group's return to Germany.
The maps, which were classified as secret, was subsequently
misplaced and left on the train. They were deemed improperly
stored in an unsecured cylindrical tube and were
returned one day after having been found missing.
So it sounds like these were physical maps, not even
software. They were in an unsecured
cylindrical tube. the US Embassy in Ukraine recovered the
unattended classified documents from the train when it returned
to Ukraine one day and later. So they were still on the train
a day later when the US embassy went to get them back.
So. That's surprising, yeah.
Yeah, and then the drink. I mean, we don't need to really
talk about the drinking, but during a six hour dinner he
drunk from 2 bottles of alcohol. Yeah, and it's.
Yeah, very responsible, but does say they've retired now.
So Oh yes, two years ago, yes. I was hoping they'd be gold in
the comments on Reddit, but they all focused on the alcohol and
not really on the data, so as typical security took a back
seat for the more interesting topics.
So there's something in that as well.
Yeah, right. That is this week's breach of
the week. So now let's get on with some
news. And the first news story this
week comes from cyber news. And this is it's also a leak.
But this is not the breach of the week.
A hacktivist group has breached P3 Global Intel, which is a
Texas based company behind Crime Stoppers.
They're tip platforms which are used by thousands of U.S. law
enforcement agencies, federal bodies and over 30,000 schools.
So the 91.5 very specific there. The 91.5 GB data set, which has
been dubbed Blue Leaks 2 Point O, contains more than 8.3
million submissions spanning nearly 4 decades, including
names, addresses, Social Security numbers, phone numbers,
criminal histories of both the tipsters and those they reported
on. Despite P3's promise that
tipster identities are protected at all times, personal
information from those who shared it appeared throughout
the leak. P3's parent company, Navigate
360, has not responded publicly at the time of the article being
written. So that's an interesting 1 isn't
it? It's blue leaks 2 point O.
Love data again. 9191.53 I've I've got an extra decimal in a
different article 91.53 that's eight point. 3,000,000
submissions. Crazy, it's.
Crazy, isn't it? Yeah.
Do you know what Blue leaks one point O was?
Do you know what the original Blue Leaks was?
I didn't know. For a bit of cyber history this
Blue leaks sometimes referred to by the Twitter hashtag Hashtag
Blue leaks refers to the 269.21 gigabytes of U.S. law
enforcement data that was released by Anonymous in June
2020 and that was by activist group Distributed Denial of
Secrets. It called it the largest public
app on American law enforcement agencies and included
intelligence bulletins, emails, reports from 1996 to 2020.
So very similar like big time frame, lots of data.
That's the original blue leaks. So yeah, it's if you tell people
that they're reporting data and it's anonymous, surely it should
be anonymous. The website reads, I'm just
looking is this the actual so distributed denial of secrets
have got a release website which I've just landed on Cybernews
here. Claim that your anonymity, your
anonymity is protected at all times.
In many cases, your information may be eligible for a reward
offered by a local programme. Clearly not, because they've all
been leaked so. Yeah.
Yeah, it said and yeah, it says that on the P3 Intel website.
If your information relates to students or campus safety,
please visit p3campus.com. So yeah, I think we really need
to be careful. It it does, it's the same group
DD DOS secrets, DDO Secrets, they were provided with the
data. They attribute the breach to a
group calling itself the Internet if Machine, but that
that threat has got no prior public record apparently, so
could be someone new or someone dragging up something.
So yeah, be careful. You should be able to Crime
Stoppers. You should be able to report a
crime anonymously. Surely that should be a thing
you should be able to trust. If you're coming forward, you're
putting yourself on the line there.
You should be able to trust those that you're reporting to.
Now and move to the next one. Yeah, I'm just looking actually
I think there I said there was no, no statement from 360 And
then I've just read at the bottom article, OK, there is a
statement. It's been added.
We're currently working to determine whether we have
experienced an incident involving our computer network
and if so, the extensiveness of the incident and the information
involved. We've hired an independent third
party to conduct a full forensic investigation to determine what
happened, said JP Gilbolt, CEO of Navigate 360.
To this point, we've not confirmed that any sensitive
information has been accessed or misused.
We're determined to learn what happened here, and depending on
what we find, we'll take appropriate action.
So there you go. Yeah, they, they're kind of
saying we're investigating. Someone else is saying the data
is out there. I'm wondering why this data has
been kept for 40 years. That's yeah, yeah.
That's a great one. Right, move on to the next one.
Cool. So this one is new Android
malware. It's hiding in streaming apps to
spy on users. Personal notes.
This one is a researchers Fabric have identified a new Android
malware called Perseus, and it's hiding inside apps that appear
to offer IPTV streaming services, which quite often
stream television content over the Internet.
But they're obviously often for privatised content and you often
get them outside of official marketplaces like Google Play,
so sort of side loading or destroy a different App Store.
And obviously then they're a lot more vulnerable to being
malicious. And they, yeah, they're not
particularly, I guess they're not really reviewed, although
maybe the OS potentially monitors these days.
So yeah, this one as obviously, yeah, Android, once you
installed a malicious application, it captures your
credentials using fake login screens and also does key
logging. But this one targets your note
taking apps like Google Keep and Evernote is 2 that I mentioned.
And ever see extracts the content within those.
And they're commonly used for storing passwords and sensitive
information, financial information and various other
things. So yeah, let's want to be wary
of this one talks about. I've seen credit card details
stored on the Notes app and, you know, banking details and
accounts and sort codes and all sorts.
You know, I don't use passwords. People do though I would imagine
have passwords on note apps. Yeah, it says here that.
So it's primarily, it was actively distributed in the
wild, but it says here that it's primarily targeting users in
Turkey and Italy, according to a report, which was by Fret
Fabric. And it says that Perseus bills
on the leaked code of an older Android banking Trojan,
including Cerberus, which is a prolific malware family.
And the source code of that was exposed in 2020.
But yeah, fun to be wary of, I guess and educate people on the
risks of downloading these kind of apps even just not on
Android, but really on any platform trying to pirate
content you're opening. So you serve up to a lot of
risks there. But to start on this one, it
says that earlier in October, there was a research has
identified another and Contragion Herodotus capable of
mimicking human behaviour to avoid detection during remote
device control. And another malware known as
crocodiles can manipulate victims contacts, allowing you
to allow allowing attackers to impersonate trusted entities
such as banks. So yeah, lots of Andrew and
Malward to be wary of and yeah, that.
Crocodilus one's a really interesting one because last
week we spoke about SMS Blasters because you've received the fake
e-mail from Google, the fake SMS from Google and something like
that, Matt, that Croc dealers malware would also enable that.
I'm not suggesting you've got like one of the latest Android
phones. It's probably patched tightly.
You know, it's not suspecting that you're infected.
I mean, you could be, but I'm not, I'm not suggesting that.
But it's, you know, there's more than more than one way to skin a
rabbit or whatever the saying is.
Do you know what I mean? Like there's multiple threats
that can cause many different things.
Yeah, this was that crocodile. This one was distributed through
malicious adverts primarily on Facebook.
There's, there's guys there. Good old Met.
I saw him as a complete aside, Metro paying influencers
through, I think they're offering them $3000 to come back
to Facebook. They want to like because
Facebook's dying like the average age of a Facebook user
is quite old. So they're paying influencers
from other platforms to come back to Facebook to encourage
the younger generation to come back to Facebook.
The IPTV thing, just to touch on that quickly, there's a reason
IPTV is typically blocked by solutions like Cloudflare,
because illegal streaming. The last two organisations I've
worked at, illegal streaming has been called out specifically in
policies and, you know, is not being allowed.
And it's been something that's actively been pursued should
anyone do it. And it's sports, it's films,
it's TV series, you know, and it's, it's, it's a dangerous
space. There's so many rogue websites
full of adverts. Lots of, you know, you, you are
really taking a real risk when you go and stream a football
match or a boxing match or the latest movie from a site that
might look really professional, but it's illegal content, which
means they're making money somehow, and they'll be making
money from your credit card details that they're taking
secretly. Yeah, it's, it's it's not worth
the risk. It's definitely not worth the
risk. No.
Yeah, right. I'll move on to the next one.
And this is an update on the Stryker incident we spoke about
last week. It was reported today at the
time time we're recording this and that the FBI has seized the
Handala data leak site after the Striker cyber attack.
So 2 websites that belong to Handala which was the Iranian
linked hacktivist group have been seized and this is
following the attack on medical device giant Striker.
Obviously Striker was compromised the attackers.
Some details came out on this this week and someone commented
on a TikTok video I recorded actually to confirm that all of
my information was completely true.
I work for striker they said and everything you've said is
completely true. I think it's reported that they
found old credentials in data breaches of admin accounts that
then gave them access to the Microsoft estate.
And then they used Microsoft Intune, which they had admin
access to, which obviously is a legitimate device management
tool owned by Microsoft. And they pushed factory reset
commands to 80,000 devices. A lot of the devices from
Striker, a lot of the medical devices weren't affected.
We did report last week about there wasn't.
Some weren't communicating back. So I think some are impacted,
but I think the ones that actually save lives, keep people
alive, help people remain alive, I think they're still working
fundamentally. Yeah.
So actually just on the back of that, there's a follow on,
follow up to that. CISA has since issued guidance.
Obviously, CISA is, jeez, what does CISA stand for?
Completely forgotten. An infrastructure Security
Agency. That's the one.
You can tell I'm not an American because otherwise I'll probably
know that they are. America's cyber defence agency
cease to have issued guidance urging all US organisations to
harden their Microsoft Intune environments in response to the
Stryker attack. I think essentially this, this
attack could have been avoided. This is an administrative, it's
an, it's a they, they've left the door open somewhat.
So it wasn't as sophisticated. As that malware involves.
No, no, this is a human. That's why we're talking about
it. It's a human.
There's, there's been some human decisions which have led to this
attack. So, and this is a great one for
us. This is really important.
Why patching and installing your updates and keeping everything
up to date is really important, but also access control.
Microsoft has published hardening advice this week as
well. So if you use Intune to manage
devices. Speak to your tech teams,
they're probably aware of this. But if you're a CSO or you're an
awareness person, just have a word with those that manage your
windows and stay and go. Have you seen this?
And because they might, they don't want to be remediating
this. You don't want to be on the
fixing side of this problem. You want to be on the prevention
side of this problem. Yeah.
So there's there's an update on Handala right next.
So the next one we have is Marquee Texas based fintech
company says over 672,000 people had personal and financial data
stolen in a ransomware attack. So this was something that
happened back in August 2025. And you mentioned to be earlier
that we previously spoke about this one quite a while ago.
Yeah. Yeah, we did.
We covered this on an episode a while ago.
So this one is, yeah, a bit of an update I guess on this one,
basically notified 680,000 people and the hackers stole
their information during the cyber attack.
And yet more than half of those lived in Texas.
Yeah, basically said the most, most information that this sort
of story had so far on the number which was previously not
reported. I mean, this breach allowed
attackers to still banking names, dates of birth, postal
addresses, financial information, their bank
accounts, credit card numbers and also took Social Security
numbers as well. Everything you need for a good
fishing pack campaign, Yeah. And yeah, one of the interesting
points on this one is that Marquee themselves sued its
firewall provider Sonic Wall, in February because they accused
the company of security failings that allowed the hackers to
steal critical information about its firewalls and which then the
hackers used to compromise Marquis network and steal data
and deploy ransomware to it. So in the lawsuit, they said
that Marquis said that Sonic will create a vulnerability that
allowed hackers to steal the configuration backup files,
including their own. Obviously Marquis, but yeah,
that's quite a wild story in itself.
I don't know if he spoke about that one last minute when it
happened in February. I don't remember hearing about
that. No, that's news to me.
It's interesting. Then there's two things that
interest me on this. It's number one, they've
obviously done enough analysis to work out where the
information came from, therefore pointing the finger at Sonic
Wall to the case, to the amount that they're confident they've
got a legal claim against Sonic Wall.
So they've obviously got a good track record, but also this
happened in August and they've only just notified users.
I mean, surely in a breach you assume the worst and then it's
weird that this is where there's different approaches and I'm not
see so and I'm not PR. So then maybe they sorry, maybe
they I think they did notify them in February.
Yeah, I'm not really sure why this It says here that date of
breach occurred August right now if they the reading that the
American dates is month first isn't.
It. So it's December 2nd was when
they notified consumers, right? OK.
So it did take four months for that.
And I think even then they just maybe didn't specify publicly
what was never involved. It's quite interesting, that
article that we, we've got this story in on TechCrunch.
They've listed, there's a link on that that goes to a data
breach notice filed in Texas. So yeah, on oag.my.site.com,
which is an awful, awful domain. Office of the
attorneygeneral.my.site.com. Yeah.
Ken Paxton, Attorney general of Texas data security breach
reports and there's a list of all data breach reports so I can
see at the time of recording yesterday, Kaplan North America,
Open Loop Health, William Hart and Bound US LLP.
You know, there's and capital store oil and gas.
There's three that happened just yet that were reported just
yesterday and then there's four more from the day before.
So this is obviously, you know, Texas is big, the UK is smaller
than Texas and Texas is just one state in the whole of America.
So I think it's really good that you get that kind of visibility
really good. And then I can't remember, we
spoke about this. I'm just, it tells you what type
of information is it affected as well?
It's a conduent business services.
I can't remember if we spoke about this, but we must have 2nd
of February, 15,000,000 records, number of Texans affected,
15,000,000 Social Security number, medical information,
health insurance. We must have spoken about that.
But it's really good that that's, I mean, it's probably
published publicly elsewhere. I'm probably being really naive
pretending that it isn't. Yeah, that's you can't find any
more information out just the address, the zip code, type of
information, number affected, notice provided to consumers.
Yes or no? That's an interesting one,
Marquee. So here we go.
Marquee Software solutions number affected this 12th of
February. This was filed 12th of February
2025. Yeah.
Marquee Software solutions 354,000 Texans affected.
Notice provided to consumers. No, Right.
Yeah. There you go.
Yeah, have they got there's a search functionality here?
Yeah, that's the only one here. 12th of February or is that the
2nd? 2nd of December, isn't it?
I've just done the same thing. 2nd of December 2020, five, 354.
So that's less than the figure we've just spoken about.
It's half of the figure we've just spoken about.
And it says notice provided to consumers, No, So yeah, yeah.
OK. So third party vendors suing
Sonicwall is an interesting one. Be interesting to see how that
lands. Yeah, I don't know if there's
any news on that one, but maybe we'll talk about it in a future
episode. Yeah, yeah, right.
I'll move on to the next one. I nearly brought this as a
topic, but it made the news so I don't need to.
I received an e-mail related to this this week.
Company's house. In the UK, when you have a
business or a limited company or something, you haven't
registered with Companies House. Companies House is the house
that manages all the companies. It's a government entity.
Company's house suspends filing service after five months.
Security glitch exposed directors details?
So I got an e-mail telling me about this and my immediate
thought was it was a security incident.
It wasn't. It's a bug glitch that they
claim hasn't led to any data breaches, but a routine IT
update in October 2025 left a vulnerability in Companies House
web filing service that was undetected until now.
So since October, any logged in user could access another
company's private dashboard, including directors, home
addresses, e-mail addresses and dates of birth.
And that information is not publicly available on Companies
House. And all you had to do was press
the browser back button a few times, Back, back, back, back,
back. I mean, it's like a seat.
It's like a cheat code. It's like up, down, it's like
the Capcom code, up, down, left, right, yeah, press the back
button a few times. The floor was accidentally
discovered by business services provider, who then alerted a tax
campaigner, Dan Needle, who in turn then contacted Company's
House. So the service was suspended on
the 13th of March and restored on the 16th of March.
Company's House says it does not believe data was extracted
systematically, but has reported itself to the ICO and in the
NCSC and has asked all UK companies to check their
details. So if you are a director of AUK
business, you need to go and check your company's house
records. Or if you have minions that do
that stuff for you, tell them to go and check your company's
house records. I'll be checking my own.
I, I think it's amazing. It's yeah.
Back, back, back, back, back, back, back.
Oh, I mean, that's amazing. That's about coding bug or
something there, isn't it? Yeah, it's one of those things.
Not browser buggers it is. Tommy has something in their
website that's, yeah, pretty poor, but I wonder how someone
found that out. I don't know.
No, it's mad, isn't it? It's really, really funny.
Yeah. It's how would you even?
Yeah. I mean, it's really.
Accidental, right, But. I guess it is accidental.
Yeah, I guess it is. It's, I just find it funny that
that's that's done that. Worrying.
So the vulnerability was discovered on the 12th of March
by John Hewitt at Ghost Mail, who's a corporate services
provider. He tried to contact Companies
House, we didn't get response. Well that's even worse.
And there's a video here, obviously amazing.
So Tax Policy Associates is Dan's website.
There's a video here trying. To explain.
Once the company number is, yeah, So what he's doing, he's
in company's house and he's basically got got the companies
in front of him. And then very, very familiar.
One of the options is he goes to file for a different company,
which is an option. And then it's asking him to put
in a company number, these 8 characters long, and there it
looks like he's typing in a company number. 2296.
He's pressed continue and it's showing a company, Yeah, OK,
which is all. This is all public record.
He's pressed confirm and continue, and now it's asked for
company authentication code. So the authentication code is
what you need to access the actual specific data that's like
private to you. Now he's going and he's pressing
back and back again and back again, and it's taken him back
through the pages he's been, but rather than taking him back to
the company that he would have was originally at, it's taken
him back to the company he's tried to access.
So it's bypassed that hidden access code.
That's incredible. Yeah, that's a.
That's a bug and a half, isn't it?
Yeah, that's terrible. Yeah.
So yes, there we go. If you have a limited company in
the UK or you've got a company registered company's house, you
should go and check your company's house records now that
problem has been fixed, apparently.
That's an interesting one. Yeah.
Do you? Want to move on to the next one?
Yeah, yeah. So this one is popular crime
extension Save images type has been removed after hijacking
affiliate links for months. So this one looks like from a
Reddit post. Yeah, I couldn't find any news
on this. Yeah.
But I found a couple of Reddit posts.
So yeah, Google removed the Chrome extension save images
type which had over 1,000,000 users and a featured badge from
Google which has been no means. It's all safe and good to go.
That's got to be good. Google have featured it.
Yeah and yeah, after it was found to be silently hijacking
affiliate links since November 2025, the extension change
ownership and was updated with malicious code that injected
hidden iframes into pages to redirect shopping shopping
commissions from retailers like Amazon, Adidas, Sheehan to the
no owners. Malicious behaviour was designed
to evade detection, only activating after a user had
saved at least 10 images. Microsoft Edge also removed the
same extension, but they did it a year earlier, which is
interesting. I wonder if that was same
reasons or not. But.
And yeah, I think as we know it's been removed, but it still
could be in your in your browser.
So. Is that sort of thing?
No, Google have removed it now. So I used to, I had this, I had
this installed. I used to use it quite
frequently. I may have used it more than 10
times since November. And the reason I used it is
because when you're trying to get images, I recently built a
slide deck and I needed some like logos.
So Google image search, you download images from Google
image search and they're web P files, webp files and Canva and
stuff don't support webp files. So you use this save image as
type, right click on the image, save images, type PNG and it
saves it as a PNG. So I opened up Chrome and I can
share my screen quickly to explain the experience.
Here I'm going to show you what extensions I've got installed.
So here we can see review one extension that may be unsafe.
Chrome recommends that you use it.
Save image as type. This extension contains malware.
So I can keep the extension or I can remove it.
Chrome recommends review this extension.
So it's great that they put the remove it underneath.
See more details. Yeah, not just like you can keep
it. That's the easy option.
Yeah, I mean it is off and I can't turn it back on.
But you could. But you could keep it.
But I can keep it but it's. It's but it work.
Maybe, maybe it won't. No, it won't because it's off
and I can't turn it on. Which, yeah.
So yeah, that's gone just. Remove it just just.
Take it away and notify users? That's crazy.
Yeah, it's quite, it's quite. Yeah.
I've had, this was like one of the, this is like one of the
three extensions that I've had for years.
You know, it used to be there's like four that I've always had
for years. There's this, there's you block
origin that obviously got retired when Google Chrome
decided they hated app blockers. Go full page, which takes full
page screenshots and a colour dropper.
They're typically the four. Like they're my holy quadrantity
of things. There is, so I'm going to remove
that. Now it's asking me remove images
type by. So yeah, that's gone.
Yeah, on the Reddit post. Yeah, as a success.
Yeah, I see on the Reddit there's a few people talking
about they've like forked the GitHub prepository for that old
extension and cleaned it up and stuff.
But I guess be careful anyway with those.
You never know, yeah. There is a replacement called
Save Images PNG which will be useful.
It's this is a, this is a fundamental problem with
extensions and it's a problem that everybody in every business
has. Extensions live in what is
arguably one of the most privileged places on your
computer. They have the ability to see
everything you do. When we worked together a few
years ago, I tried arguing that, like we were talking about
computers and hardware and they were moaning about the amount
they were spending on laptops and you know, it's stuff.
And I went, all these users, why don't you shove them on
Chromebooks? Because all they need is a
browser. Like so many people, HR and now
even more so HR functions. You know, anyone that doesn't
use Microsoft Office or AutoCAD or Photoshop, any generic kind
of general user could probably just work with a Chromebook.
And then your hardware exposure is reduced, your hardware cost
is probably reduced, and they're more secure typically as well.
But because the browser, everything lives in the browser
now. And that's the problem and
that's why these extensions and it this is exactly what happened
with you block like years ago, the the app blocker God, it must
be years. It's years and years ago you
block trusted app blocker got sold, all of a sudden started
doing dirty stuff, which is why we ended up with you block
origin because the original developer was like, you're
ruining my reputation. I'll recreate it and call it you
block origin. So.
Yeah. You don't know.
You don't know when something changes hands and every update.
You're trusting so many third parties with every single
browser extension you have. Well, yeah, and as well, the
browser extensions update themselves, right?
You don't, Yeah, don't really have to manually do anything
there. And it's just silently do as
we've turned in this one and many other stories we've circled
touchy browser extensions. And I think it's quite funny.
Organisations are so tough about what software you can install on
a computer. You'll have an organisation
that's like, no, you can't install any third party
software, you can't do this, you can't do that.
But they'll have no controls over the extensions all of us
use all of the time. They won't be running a managed
Chrome environment. It's.
Yeah. And our users can use any
browser they want, which means every browser has their own
extensions. It's yeah.
Anyway, if you had save images type installed, you still do
have it installed, but it's permanently off.
You can't turn it back on, I think is the summary of that.
That is this week's news. Now it's time for this week's
fish of the week, which comes from the threat intelligence
team at Hawks Hunt. Let me share this with you.
This week is Emirates airline impersonation.
So this is a loyalty reward notification, and this one
looks, well, you tell me, you look at it and you tell me what
you see. Well, yeah, it's a typical typo
to look like an M and or it's female campaign eventbrite.com
that looks fairly legit. So let's just run through this
really quickly bit by bit. So Eventbrite is a legitimate,
is a legitimate platform and it's used to book events.
We see this all the time. We saw it last week with, I
mean, last week's wasn't the most convincing example, like
not everyone's going to fall for it, but people abuse the mail
capabilities and trust of other platforms to get in.
So I think on this one, someone's book, someone's
planned an event on Eventbrite. The logo for that would be
Emirates. The event name is probably
loyalty reward notification. But before we get to that,
you'll see the sender name is disguised like you said to look
like Emirates, but the R and the N together.
And we've seen that with Microsoft before.
So you know, some fonts, some I think Outlook, it looks quite
convincing as an M some mobile clients as well.
Brand logo. It's got an Emirates logo,
which, you know, automatically reinforces the fact it's from
Emirates. What if I'm really interested in
here is the disguised characters?
So I looked at this and I thought, oh, that's displaying
really weird. Is it like I thought the image
that had been shared with me was of a poor quality, which would
be unusual because I know the person that makes it, but we're
looking at it. No, it's they've disguised some
of the letters specifically to try and bypass security
philtres. So you can see here the value,
the D looks really small and customer, the C looks different
and the M looks different. So I think it's pulling from
different alphabets. Yeah, yeah.
It's quite unusual, that one. Yeah, it is.
And then right at the bottom the link.
If the link doesn't open when clicked, please copy and paste
it in your browser. It purposely doesn't click so it
doesn't look like a link and you're encouraged to copy and
paste it into your browser to try and bypass the security
controls. And when you when you do that
straight there, there's a fake login to Emirates page pretty.
So it's asking you. Convincing looking.
Yeah, and it's credential harvesting.
It's asking you to log in and enter your username and
password, these things. I mean, you can Vibe code that
in seconds. Now with Vibe coded something
this week with Claude and it took no time at all.
I was like, jeez, that's amazing.
But that kind of thing, you know, it's shove an Emirates
logo on Emirates font. That's probably not a font, it's
probably an image. And yeah, so I.
Wonder what got me really do with your Emirates account.
I guess you might have saved passport details and stuff in
there, but I guess they maybe could book a flight, change
these details and stuff. Don't know.
Yeah. It's quite a.
Specific thing, if you don't have a Emirates account before,
you're not going to maybe fall for it, but.
No, it does make you wonder if it's targeted.
Maybe there's a list out there of Emirates users?
Maybe in the current climate, Dubai and other areas, Emirates
as the fly there and that they're a Middle Eastern
airline, aren't they Dubai? Yeah, yeah.
That hadn't even dawned on me. Yeah, hadn't even dawned on me
on that. Yeah, That's that's interesting.
Yeah. So that is this week's Fish of
the Week. Thank you very much to the
threat intelligence team at Hawks Hunt for sharing that with
us. Thank you.
Just one bit of admin before we move on this week's awareness
Awareness. The call for presentations for
the SANS Security Awareness and Culture Summit 2026 is open.
If you've got something worth sharing, SANS wants to hear from
you. The call for presentations is
open and the deadline is coming up real soon.
February. Sorry, Friday, April the 3rd at
5:00 Eastern Time. So you've got a couple of weeks.
The summit runs on the 27th and the 28th of August in Las Vegas
and there is a virtual option. So if you can't get to Vegas,
you don't fancy flying at the moment.
You can present remotely and it's encouraged.
They're looking for talks on the human side of security
awareness, culture, behaviour, has change, leadership training,
AI risk, the mistakes you've made and what you've learnt.
So both in person and virtual speaker slots are available and
the formats range from 25 minute lightning talks all the way
through to like 90 minute hands on workshops.
So you might have made awesome AI deep fakes and you want to
show the world this is your chance.
You get a complimentary pass to attend the fall summit as well,
which is worth $125. Plus, you get promotion and you
get to be on stage in front of all your peers.
It's awesome. But you do have to, obviously,
if you want to go to Vegas, you do have to pay to get to Vegas
if you want to do it or you know someone that does.
Submissions are available. The link is in the show notes
and in the newsletter. Have I told you about our
newsletter, Risky creative.com or search for the awareness
angle on LinkedIn. Every Monday morning, along with
the release of every episode, we do release a newsletter that
features everything we talk about on the show, broken down
and links to all the stories and all the topics and all the fun
stuff. So get that in your inbox every
Monday morning to remind you a new show has been released.
You can sign up at riskycreative.com.
Right. Should we do some topics?
Yeah. What did I call these?
I called these. What did I?
I came up with a name for these. I can't remember what it was.
Insert. Yeah.
Now insert called Graphic here. The first thing I wanted to show
you was something I saw on Reddit.
Of course, that's my my weak spot.
So this is Idris Elba. Do we know?
We know Idris Elba, the English actor.
I saw something the other day. I think he's Sir Idris.
Now I don't know. That may have been AII think
he's Sir Idris. Idris Elba's got a wax model at
Madame Tussauds. Guess what his iPhone did
before? Have we covered this before?
Maybe we have here. It's it's great though, yeah.
Hold on, let's see if it I lost my phone.
I did. That's crazy.
Hold on. I've got to call my mum mate.
She's you know, how amazing is that?
I just just that little short bit.
It's like, oh, now either, I don't know, like what can you
do? We've speak about before with
like Sam, there's a Samsung, but looks of isn't it and it's not
as sophisticated was iphone's Face ID.
So, OK, Yeah, OK. Although Even so, like just the
cameras on an iPhone, check for a pulse or blood flowing under
the to check for body temperature.
Yeah, probably get forward by that.
Yeah, I guess you'll just be a celebrity to and you just have
their phone as well. Or Tom Cruise in Mission
Impossible, Right? I'll move on to the next thing.
It's just a little quick thing I saw on Instagram.
And this isn't, it's not a massive cyber story, but I just
thought this, this is like a little flashback.
I just thought this was interesting.
If you work in IT or with computers like we do.
This is Pete Tong on BBC Radio 1 being interviewed.
Just have a listen to this and, and watch this.
It's, it's audible, so you can hear it flustered because we're
getting a lot of people asking for the website address.
The website address from 1995 S that's Greg James, I think,
interviewing Pete Tong. Pete Tong's obviously been on
Radio One in the UK for many, many years.
And the website address from 1995, I don't know.
That timeline doesn't quite work out for me.
Maybe I'm wrong. That hurts my head.
I didn't think the web. Well, yeah, it was.
OK. Listen, anyway, listen.
Oh yeah, I can't, I can't remember that, no, But luckily
HTTP colon forward slash forward slash
www.bbcnc.org.uk/BBCTV/radioone/P/N/index full stop.
HTML just get told to say that by the way.
Yeah, you can tell now they've got everything really, like
short now at Radio One. It's like, you know, BBC Sounds,
that's all. Yeah, P slash pong.
How amazing was that? God.
So you can find us at HTTPS colon forward slash forward
slash www.riskycreative.com/index dot
HTML. That shows you how far times
have changed, right? Like it?
Does. Now you're just like you said,
you just Google BBC Sounds or BBC Radio 1.
Yeah, yeah. Whatever your search engine
isn't is there. Search engines weren't a thing
then. That's funny, yeah.
One last thing I wanted to mention and I nearly brought
this as news article, but it's kind of funny and terrifying and
we had lots of news articles. This was something I saw in four
O 4 Media, which is quickly becoming one of my favourite
kind of online news sites. Tinder plans to let AI scan your
camera roll. So Tinder is obviously the
dating app that's made famous The swipe right, swipe left.
The dating app says it's set to roll out in the US later this
spring. Tinder plans to access users
camera rolls to pick photos to determine what you're into.
A slightly, slightly terrifying isn't it?
The AI is going to scan users locally stored photos,
everything from Jim's selfies to pictures of their family,
sensitive documents and intimate pics to help construct profiles
by determining what users interests and values are.
Wow. I'm just wondering, let's have a
look. Hang on, I'm not going to share
my photo Library, Dinosaurs, houses and stuff I'm selling on
eBay and some flooring. Have fun.
Tinder building a dating profile off all of that.
Yeah. Yeah.
I just thought that was AI doesn't need to be going through
people's photo libraries. Not for a dating app.
It's just going to. I mean, that's going to make
Tinder such a massive target as well.
Oh, we're not keeping any of that data.
We don't keep it. OK.
Yeah, right. That's me done with my whatever
they're called. What have you got?
Yeah, so I had an interesting story I saw just earlier today.
This one is about Japan and how they're going to allow proactive
cyber defence from Oktoberfest. And I thought it was interesting
because there's a few sort of, I guess, historical one, like law
reasons why that wasn't a thing. Active cyber defence.
So, yeah, so it has sort of a funny line of description in the
news story, which is in less polite places.
This is called hacking back or offensive cyber OPS, right?
So essentially they're permitting offensive cyber
operations. Under some new framework,
Japan's self Defence forces and the police will be able to
identify and disable infrastructure use to launch
cyber attacks, subject to approval from government cyber
crime management committee. And yes, it's quite an unusual
story here. So like, yes, as it reflects
growing concern about the scaling impacts of cyber threats
on national security, economic everyday life and marks a
significant evolution in Japan's long standing defensive posture
shaped by article nine of his post war constitution, which was
way back in I think I saw 1946 after World War 2.
They basically poised themselves of a defensive sort of military
and other sort of areas. And obviously the cyber crime
fell into this this clause. But now, yeah, they're looking
to change that so that they can disrupt the attackers.
It's up some things from happening and yeah, as far as
quite an unusual thing there. And I looked quickly for some
stats which I guess sort of chose maybe why they may want to
be doing that. As you can see.
I mean, this is just Japan. I've not compared it to the rest
of the world. I imagine it's very similar
trend across the world, right. But since like 2009, you're
looking at like just under 7000 annual crime arrests.
I mean, it's been going up. So I mean, obviously able to to
arrest people for cybercrime, but now they're going to
hopefully go to do a better job of it.
And yeah, another hope that didn't.
There's another image could bring up.
Let's talk, which is a number of daily cyberspace intrusions,
which in 2013 was under 500. And this is Jenny, because it's
2019, but it's almost reaching 4500 daily.
So I was face intrusion. And I imagine that numbers are a
lot bigger now. Yeah, if if you see.
Happen with that path, yeah. Yeah, you can see it's quite
aggressive linear line there going right up.
Yeah, it's quite interesting story really.
I wonder if there's any other countries that are in a similar
phase. I think I did see on the news
story, it talked about some other nations that had a similar
thing. But yeah.
I get the cultural and that's. Quite a big shift, isn't?
It, it is a cultural shift and I've, I've heard it said before
that like war is bad for business, which is why Japan
don't get involved, but also like don't forget Japan, Japan
have some pretty traumatic history.
So it's, you know, pieces pieces good for business and it's good
for Japan. So it's, yeah, I imagine that
Article 9 kind of talks probably about being the aggressor, which
this kind of kind of isn't. But is it's that hacking back.
It's, it's a blurred line, isn't it?
At what point becomes defence and what defence versus attack?
It's like the attack becomes part of the defence.
Yeah. But it's, yeah, that's really
interesting. It's a really different
approach. Yeah, well, it's obviously it's
a different. Approach for Japan.
Anyway, yeah, I mean, it's taken a long time to to get there,
right? Yeah, Yeah, 80 years.
That's the clause of nine has been there.
I mean, yeah. It just goes to show, doesn't
it, the state of the world at the moment.
You know, it's yeah. Well, yes, I mean, yes,
cybercrime that that that chart was 2019 for Japan.
And that's, I don't know if that's so in nineteen, 4500
daily intrusions and you imagine that numbers probably doubled by
now, if not more. And that's just Japan.
So yeah, be interesting to compare.
This must all be they've just had elections in Japan.
Haven't they? And I think there's a new,
there's new leadership, new government.
Yeah, yeah. Yeah, Excellent, brilliant.
What's up, Lovely? OK.
Well, I think that's us. Done for this week.
Get your submissions into the Sand Summit.
Subscribe to the newsletter at riskycreative.com Follow us on
all the socials Instagram, Tiktok, LinkedIn.
We're not on Facebook, although we might be soon.
If they pay us £3000 to to make the jump, they won't.
They won't pay us £3000. Do get in touch with this if
there's anything you'd like us to discuss.
Hello at riskycreative.com and follow us on LinkedIn to stay up
to date with everything that happens with the show.
Got some big announcements coming in the next couple of
weeks. So yeah, don't be going anywhere
and stay tuned. But from me, that's everything.
I think that's everything from you.
Yeah, me. Cool, right?
See you next week. Oh yeah.
Catch you later. See you later.
Bye.