Explorez tous les épisodes du podcast Smashing Security

Microsoft's Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto coin, and a corporate apology that wasn't from Microsoft either.

Meanwhile, UK losses from hacked email and social media accounts have rocketed by 417%, as scammers pose as your friends to flog you tickets to gigs that don't exist.

Plus, Hack The Box's Christine Bartlett joins us for a featured interview to ask what happens when AI agents join your security team, and whether anyone has thought to give them a performance review.

All this and more in episode 487 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• South Korean officials believe AI agents were used to hack several banks - The Record.
• Asos warns customer data may be compromised after ‘unauthorised’ app access - The Guardian.
• PixelLeak AI exposure of private developer data - Glow.
• Crypto Scammers Hijack Microsoft's Official X Account - SecurityWeek.
• Is everything ok Microsoft? - The Verge.
• Switch to passkeys: Report Fraud warning as email and social media account hacking sums stolen rise by more than 400 per cent - City of London police.
• Swiss railway clock - Wikipedia.
• The Witcher 3: Wild Hunt Remastered Trailer - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Hack The Box - Develop, exercise and measure the capabilities of your human operators and AI agents.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A store in Auckland vibe-coded itself a new website. Within hours, its inventory had somehow expanded to include a pair of crusty socks, an $850 banana, and all of New Zealand's national parks. What could possibly have gone wrong?

Meanwhile, a hacker collective backed a truck into one of the license-plate-reading Flock safety cameras popping up on American street corners, and took a very close look inside.

All this and more in episode 486 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Dave Bittner.

EPISODE LINKS:

• Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws - The Hacker News.
• Odido hackers mock police, threaten another Netherlands hack - Cybernews.
• North Korea's fake job interviews infected 30,000 devices - The Register.
• Ridiculous deals as store leaves website open for the public to edit - Stuff.
• Critical Vulnerability in AI Vibe Coding platform Base44 - Wiz.
• Beautiful People: The dating site that FAKED getting hacked by a virus called Shrek - Graham Cluley on YouTube.
• Flock Camera Locations - Live Map of 150,000+ Flock Safety Cameras & ALPRs.
• Flock cameras are riddled with security vulnerabilities and hard-coded credentials - Micah Flee.
• Creve Coeur police in 'state of chaos' as former chief investigated for misconduct - WCBU Peoria.
• La La Land Filming Locations - Seeing Stars.
• Mrs Mills - Wikipedia.
• Let's Have a Party - The Piano Genius of Mrs. Mills - YouTube.
• Introducing the Originals Mrs Mills Piano from Abbey Road Studios & Spitfire Audio - Abbey Road.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.
• ThreatLocker - Book a demo today and start securing your organisation.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Researchers wanted to test if LG's smart TVs come with any security risks - but their lawyers noticed a snag: the terms and conditions would forbid it. So they came up with a solution. They got plastered before setting up the TV, on the reasoning that you can't be legally bound to a contract you agreed to while drunk. What they discovered will make you look at your TV rather differently...

Meanwhile, awful Android malware with the audacious name "Awesome" (in Indonesian) is doing the rounds, stealing your data, demanding a ransom, and then giving you a "jump scare"...

Plus, in our featured interview, Andy Hornegold of Intruder explains why the mid-market is where cybercriminals are having the most fun right now - and how AI is helping attackers get from "first foot in the door" to "full ransomware disaster" in less than a working day.

All this and more in episode 485 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

EPISODE LINKS:

• Revolut handed customer data to fraudsters using government email account - The Record.
• HBO Max Reddit account compromised to serve ClickFix attacks - The Register.
• U.S. and UK Launch First-of-Its-Kind Joint Alliance to Dismantle Global Scam Centers - US Dept of Justice.
• 216,000,000 Spy TVs - The LG Smart TV Problem - YouTube.
• LG TVs Are Capable of Listening to More Than Your Screen, Report Claims - Gizmodo.
• New Android malware encrypts files, steals data, and harasses victims - Bleeping Computer.
• Search flags based on colors and attributes - FlagLookup.
• Killer In The Code podcast.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

When a chap called Matt noticed his Bluetooth headphones wouldn't switch to his phone, he was surprised to realise the reason was a single AliExpress webpage sitting open in his browser - playing nothing at all, at zero volume. And yet somehow his hardware could hear it. Audio fingerprinting is one of the sneakiest tracking tricks on the web.

Meanwhile, the intelligence agencies of the "Five Eyes" (not Five Guys) have got together and published advice on how companies should communicate after a cyber attack. The summary? For the love of God, stop calling every breach "sophisticated."

All this and more in episode 484 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• Hackers demand $2.3M in ransom after breaching Berlin government network - Anadolu.
• Deux suspects interpellés dans le cadre des enquêtes ouvertes après le piratage du fisc - France Info.
• Hackers are stealing Claude tokens from subscribers - TechCrunch.
• AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones - The Register.
• AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting - Matt Callaghan’s blog.
• Audio Fingerprinting: What It Is + How It Works with Web API - Fingerprint.
• Communicating Under Pressure: Best Practices for Service Providers - CISA.
• World Stone Skimming Championships.
• Mind games and a ‘toss master’: world stone skimming contest returns to Scotland after cheating scandal - The Guardian.
• World Stone Skimming Championships - Every Toss 2025 - YouTube.
• ”The Pirates’ Code: Laws and Life Aboard Ship”  by Rebecca Simon - Waterstones.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone.

Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open?

All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

• Hacker leaks GTA VI footage to push a crypto token before pulling off a $270,000 cash-out - Coindesk.
• ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - The Hacker News.
• FulcrumSec claims Manchester Airports hack, theft of 86 GB of data - Bleeping Computer.
• Mugged for my phone, then locked out of my life - The Times.
• Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain - SOCRadar.
• AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - Bleeping Computer.
• Investigating three real-world incidents in our cybersecurity evaluations - Anthropic.
• The Hugging Face incident and the road ahead - OpenAI.
• Irregular says ‘human oversight’ responsible for AI sandbox escape incidents - CyberScoop.
• Control. Ownership. Perspective - Ciaran Martin.
• Steno: Highly-Secure AI Notetaker for Government & Defence - Steno.
• Inside the Factory - BBC.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A hacker calling themselves "CYBERLEEK" has been leaking gameplay footage from GTA 6 ahead of its official reveal this week - but they're not asking Rockstar Games for a ransom. Instead, they've launched their own cryptocurrency, promising to release ever more juicy clips from a virtual strip club...

Meanwhile, your smart TV might be doing more than binge-watching Netflix while you sleep. We explore the shadowy world of "residential proxies" - how they end up inside home routers, smart TVs, and IoT devices, and why an entire criminal economy is quietly running through your internet connection.

All this and more in episode 482 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

• Iranian hackers shut down UK power plant - The Telegraph.
• Ransomware crook poses as recovery firm to steal payments from fellow extortionists - The Register.
• The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile - Zimperium.
• Technical forensic research and provenance breakdown of the latest August 2026 GTA 6 gameplay leaks and map files. - GitHub.
• Everything we know about Cyberleek and his GTA VI build - Reddit.
• Who needs a laptop to hack when you have a Firestick? - Smashing Security.
• Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals - FBI.
• Busted! Rogue VPN provider who co-opted millions into cybercrime - Paul Ducklin.
• Disrupting the World's Largest Residential Proxy Network - Google Cloud Blog.
• Google’s Continued Disruption of Malicious Residential Proxy Networks - Google Cloud Blog.
• TimeGuessr.
• Scientific Curiosity by Cyril Aydon - Waterstones.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

At Black Hat this month, a group of security researchers took a $9,000 robot dog, plugged Google's AI into its brain, and jailbroke it by telling it - with a completely straight face - that it was a Pokemon. What followed involved a wall, a blue ice chest, and anyone in the room wearing white shoes. Oh, and did we mention you can buy a flamethrower attachment?

Meanwhile, in Salzburg, 280 gold statuettes of Mozart have vanished from the streets. This has happened to the same artist before. Organised crime, or a publicity stunt? Jenny has thoughts - and some parallels for the world of cybersecurity.

All this and more in episode 481 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

• Burnham exchanged messages with person posing as Trump's chief of staff - BBC News.
• New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges - Bleeping Computer.
• SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers - The Hacker News.
• macOS ‘Screen Sharing’ flaw exploited for crypto-mining - Hot for Security.
• Kinetic Prompt Injection: Agent Compromise With a Physical Blast - Greptalks.
• Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius - YouTube.
• More Than 200 Golden Mozart Statuettes Stolen From Salzburg Months After Famed Composer’s 270th Birthday - Smithsonian Magazine.
• An Art Installation of More Than 100 Wagner Figurines Outside a German Theater Has Mysteriously Disappeared - Artnet News.
• Ray Alan - Wikipedia.
• Ray Alan with "Lord Charles" - World's Greatest Ventriloquist - YouTube.
• Educating Archie - YouTube.
• Peter Brough - Wikipedia.
• No. 10: Full Confidence - A Game of Political Survival.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Would you like access to Anthropic's Claude at 90% off the normal price? All you have to do is redirect your traffic to a mysterious service called "Poison Claude". Only problem is that it's run by fraudsters...

Meanwhile, a phishing-as-a-service platform called "Greatness" has come up with something rather nasty: a phishing attack that doesn't need a fake website, a suspicious URL, or your password. Just a real Microsoft login page and a moment of misplaced trust - and the attackers walk off with full access to your emails, your files, and your entire organisation.

All this and more in episode 480 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

EPISODE LINKS:

• US cloud 'kill switch' is as dangerous as ransomware, European businesses fear - IT Pro.
• Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M - Decrypt.
• Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison - US Department of Justice.
• Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt - The Hacker News.
• Free tokens for sale: How fake signups drive AI fraud - Okta.
• Post by Rory Cellan-Jones - Bluesky.
• Inside Greatness: Telegram-Distributed M365 AiTM PhaaS - ZeroBEC.
• Tailscale.
• RustDesk.
• League of the Lexicon - Two Brothers Games.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Graham gets a phone call from the police. Well, someone who sounds convincingly like the police. There's just one small problem: what they really want is the 24-word seed key to Graham's cryptocurrency wallet.

Meanwhile, if you've stayed in a hotel recently, the free Wi-Fi you connected to might have come with an unexpected extra: an all-you-can-eat buffet of "Captive Crunch" for a Russian intelligence-linked hacking group.

And a group calling itself the "ExFilSquad" has walked off with 600,000 records of the UK's teachers and head teachers from the Department for Education - sending an unusually polite ransom demand.

All this and more in episode 479 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• Cryptocurrency mailing list compromised - Tweet by Trezor.
• Users’ seemingly private conversations with Anthropic’s Claude showed up in Google search results - Fortune.
• Sweeping cyberattack on water systems in multiple states has US officials on edge  - CNN.
• Minnesota not Iran to blame for state's water issues, says Trump - BBC News.
• Google pauses AI satellite images, after fears of deepfakes in the sky - NPR.
• CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft - Microsoft Security Blog.
• DNS Poisoning Tactics Expand to Hospitality Wi-Fi - ReliaQuest.
• Hackers steal sensitive data from UK Department for Education and police - The Guardian.
• University of Arts London on Securing Creativity Against Cyber Threats - Infosecurity Magazine.
• 7 Things About Doctor Who I Learned From “When I Say Run, Run” - The Doctor Who Companion.
• What Stanley didn't say - The Guardian.
• Adrian Rigelsford - Wikipedia.
• Black Mesa: Re-visit the world that started the Half-Life continuum - Crowbar Collective.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

You've been headhunted for a great job in cryptocurrency. All you have to do is complete a short online assessment - with your webcam on, of course, so they can verify who you really are. Which is ironic, because the person recruiting you doesn't exist. And North Korean hackers using this trick have already made off with $643 million in crypto this year alone.

Meanwhile, researchers at UC San Diego have discovered that 2.2 million cars across the United States can be unlocked or immobilised by anyone with a bit of Bluetooth kit - thanks to one aftermarket car alarm that made a truly spectacular cryptographic blunder. The bug has been sitting there since 2017. Nobody noticed.

All this and more in episode 478 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

• OpenAI's AI "goes rogue" and hacks Hugging Face: what you need to know - Hot for Security.
• Post by Graeme Bell - Linkedin.
• HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels - Group-IB.
• Ransom gang targets Dutch ice arena Thialf in cyberattack - Cybernews.
• No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE - Tokay0.
• DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews - SOCRadar.
• H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion - TRM Labs.
• 2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft - UC San Diego Today.
• 2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft - YouTube.
• Karr Security.
• Ann Droid - BBC iPlayer.
• North Leigh Roman Villa - English Heritage.
• Uffington White Horse - Wikipedia.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A Russian intelligence-linked hacker is arrested in Thailand while enjoying a beach holiday - and the trail of evidence that nailed him to the Russian government includes 14 separate orders of chicken McNuggets.

Meanwhile, AI music generator Suno has been hacked - and the stolen data appears to show exactly how much copyrighted music they hoovered up to train their models.

All this and more in episode 477 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

• Bengaluru triple murder: Accused allegedly used AI chatbot to plan killings, police say - The News Minute.
• Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days - Bleeping Computer.
• DO NOT BUY: LG’s Spyware TVs, Monitors, and Wiretapping Concerns - YouTube.
• New Russia-affiliated actor Void Blizzard targets critical sectors for espionage - Microsoft Security Blog.
• Russia Advises Citizens Wanted in U.S. Against Visiting Thailand - The Moscow Times.
• Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show - Reuters.
• Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links - Ctrl-Alt-Intel.
• Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius - 404 Media.
• "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack - Unit 42.
• Black Is The Color Of My Voice trailer - YouTube.
• Black Is The Color Of My Voice - Official Site - Black is the Colour of my Voice.
• Avatar: The Last Airbender (2007)  - Netflix.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

An app has appeared in India that lets anyone with a smartphone stop a passing e-rickshaw dead in its tracks - no login, no passwords, no permissions needed. 

Meanwhile, Geoff - swimming in money and Lamborghinis, as all published authors are - has been on the receiving end of a slew of AI-generated scam pitches from fake book marketing experts. Rather than ignore them, he's been playing them at their own game...

All this and more in episode 476 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.

EPISODE LINKS:

• The ransomware negotiator who was working for the other side - Hot for Security.
• LastPass, Bitwarden users targeted with fake security alerts - Bleeping Computer.
• German firm files for insolvency, blames cybercrims who shut down production for 6 weeks - The Register.
• BAT-BMS App: How A Chinese App Is Being Used To Hack E-Rickshaws All Over India; Viral Videos Show Drivers Crying Over Lost Earnings - Free Press Journal.
• Tirri control prank: Indians use China app to shut down e-rickshaws - The Print.
• Geoff describes his interactions with a book marketing scam - Linkedin.
• Smart Plugs - Tapo.
• Worst Patio Ever! Extreme ASMR Pressure Washing - YouTube.
• 20 Years of Cracked Mud Covered This Massive Rug - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A 15-year-old boy asked a chatbot for help - and cancelled nearly 47,000 anime streaming subscriptions in under four hours. Meanwhile, researchers have documented the first fully autonomous, agentic AI-driven ransomware attack, "JadePuffer". What does this tell us about the future of cybersecurity?

Also, Apple's "Hide My Email" feature turns out to hide rather less than it promises - despite Apple knowing it has a problem for over a year.

All this and more in this episode of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Zoë Rose.

EPISODE LINKS:

• Politician who investigated spyware abuses had his phone hacked with Pegasus spyware - TechCrunch.
• Hackers breached DHS information-sharing network, people familiar say - Nextgov.
• Hackers Use Fake FIFA World Cup 2026 T-Shirt Offers to Spread Voidrift Malware - Hackread.
• Japanese teen arrested for cyberattack that unsubscribed over 46,000 anime accounts - The Straits Times.
• Police arrest high school student over cyberattack on net cafe operator - The Japan Times.
• Japanese teens arrested for using AI to create illegal phone contracts - The Peninsula Qatar.
• JADEPUFFER: Agentic ransomware for automated database extortion - Sysdig.
• Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses - 404 Media.
• Two people arrested in apparent marriage proposal atop Empire State Building - The Guardian.
• Skywalkers: A Love Story - Netflix.
• Thermomix - Vorwerk.
• Operation Safe Escape.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
• NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer.

Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years.

All this and more in episode 474 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Quentyn Taylor.

EPISODE LINKS:

• Danish Police Raided Self-Described Privacy Activist. PM Lives at a Secret Address - State of Surveillance.
• Hospital probe after 40 staff access crocodile boy's medical records - Cybernews.
• Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website - US Dept of Justice.
• Someone allegedly used a hairdryer to rig Polymarket weather bets - Engadget.
• Tweet by Polymarket Traders - XCancel.
• Polymarket says hackers stole users' funds - TechCrunch.
• Operation Cloud Hopper: China-based Hackers Target Managed Service Providers - SecurityWeek.
• The Full Story of the Stunning RSA Hack Can Finally Be Told - WIRED.
• Polymarket points to third-party login tool after users report account breaches - Coindesk.
• Polymarket Admin Wallet Exploited on Polygon, Says ZachXBT - CryptoPotato.
• Polymarket reportedly paid creators to post deceptive videos about fake bets - TechCrunch.
• ‘Unbelievable how accurate’: How paid influencers hype Polymarket’s odds - POLITICO.
• Polymarket's $345 million Iran peace bet is stuck because nobody can agree on what "permanent" means - TNW.
• Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways - National Cyber Security Centre.
• Analysis of Reported Credential Compromise of FortiGate Devices - Fortinet Blog.
• FortiBleed - Free FortiGate Exposure Checker - SOCRadar.
• The Boys of Dungeon Lane - Paul McCartney.
• A closer listen to Paul McCartney's new album 'The Boys of Dungeon Lane' - YouTube.
• The Summer Portraits - Ludovico Einaudi.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A polite caller from your bank says there is a problem with your account. Don't worry - they'll send someone round to help. They'll even take your cards away to keep them safe. The scam has run rampant, until Dutch police plastered blurred photos of 100 suspects across billboards, supermarkets, and TikTok, with a two-week ultimatum to turn themselves in... or else.

Meanwhile, a security researcher called Bob DaHacker got her hands on the live broadcast controls for every match of the 2026 FIFA World Cup. She could have Rickrolled the entire planet, but actually spent days trying to find anyone at FIFA who would pick up the phone.

Plus! Don't miss our featured interview with Black Kite's Jeffrey Wheatman exploring ransomware and extortion attacks across Europe.

All this and more in episode 473 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• Suspected cyberattack triggers false emergency alerts across parts of Brazil - The Record.
• Gizmodo readers hit with ClickFix malware prompts after account compromise - The Register.
• Two men plead guilty over £39m Transport for London cyber attack - BBC News.
• Helpdesk scammers are making house calls to make their lies feel more real - The Register.
• Dutch cops’ shame games nets 74 wanted fraudsters - The Register.
• Omgebrachte vrouw (80) in Amsterdam vermoedelijk slachtoffer van nepagenten - NU.
• Mr Benn - Wikipedia.
• I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID - Bobdahacker.
• Bug in FIFA World Cup internal system gave anyone ability to modify TV stream - TechCrunch.
• Iceberger - Draw an iceberg and see how it will float.
• Fallout: London - GOG.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.
• Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

What if your AI coding assistant could be tricked into stealing your own company's secrets - by reading a single booby-trapped bug report? No phishing email. No malware. No password ever stolen. Just an AI doing exactly what it was told.

Meanwhile, someone calling themselves Nightmare Eclipse has decided to teach Microsoft a lesson. The result? Three zero-days dropped on the internet, one of which lets a thief with a USB stick walk straight past BitLocker. Microsoft is furious.

Plus don't miss our featured interview with Son Nguyen Kim of Proton Pass, who explains why plugging AI agents into your email and calendar without thinking twice is rather like hiring a new employee with the keys to everything - and skipping the background check.

All this and more in episode 472 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

• ShinyHunters claims 61M Sysco records - Cybernews.
• Derbyshire police officer under investigation for using AI to create evidence - Derbyshire Times.
• Maine forced to take down data breach portal after fake notices filed with authorities - Hot for Security.
• A Fake Bug Report Hijacks Your AI Coding Agent - and Nothing Catches It. - Tenet Security.
• Agentjacking: a fake bug report hijacks AI coding agents - TNW.
• When anti-virus goes rogue - A trifecta of Defender zero-days - SolCyber.
• BitLocker in crisis? The "YellowKey" zero-day in plain English - SolCyber.
• Microsoft versus Full Disclosure: The ongoing Nightmare Eclipse saga - SolCyber.
• BitLocker, Defender, zero-days, and bragging rights: More MS nightmares - SolCyber.
• Inside the FBI’s Kinetic Cyber Range - FBI.
• Inside the FBI's Kinetic Cyber Range - YouTube.
• Computer worm strikes International Space Station - Graham Cluley.
• Raspberry Pi Zero W - Raspberry Pi.
• There’s still life in old technology.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Researchers at the University of Toronto have built a worm that thinks for itself. Using free off-the-shelf AI models it works out how to break into each new computer it encounters, and hijacks the powerful ones to host its own AI brain. And then the researchers discovered their creation had quietly removed the list of machines it wasn't supposed to attack.

Meanwhile, Meta's shiny new AI customer support agent has been cheerfully helping hackers help themselves to other people's Instagram accounts. Just keep asking, politely but firmly, to have a password reset sent to a different email address - and the AI will eventually agree.

All this and more in episode 471 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

• Emmys data leak: update exposes access to award submissions - Cybernews.
• A $1,000 AI agent found 21 zero-days in FFmpeg, some 23 years old - Martin Cid Magazine.
• Hackers steal $1.7M condom shipment​ - Cybernews.
• AI Agents Enable Adaptive Computer Worms - ArXiv.
• 21 Zero-Days in FFmpeg - Depthfirst.
• Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot - ~this week in security~.
• Hackers trick Meta AI support bot to infiltrate Obama White House Instagram account - The Guardian.
• Look-In Star Portrait Challenge - Monkeon.
• Final Fantasy VII Remake - Square Enix.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.
• OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A website called "UK visa portal" has been quietly collecting passport scans, selfies, and personal data from thousands of travellers who thought they were applying through official channels. They weren't. And when a journalist tried to warn the company, it was lawyers who responded.

Meanwhile, a paper from Cornell suggests that prompt injection - the technique malicious actors use to trick AI agents into doing things they really shouldn't - may be fundamentally unsolvable. Which is err... awkward, because everyone is rushing to plug AI agents into their email, files, and corporate networks.

Plus don't miss our featured interview with Andrea Sivieri of CoreView, who tells us how hackers can lock your entire organisation out of its Microsoft 365 environment... without having to trick you into running a single piece of malicious code or handing over a password.

All this and more in episode 470 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Tanya Janca.

EPISODE LINKS:

• Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked - 404 Media.
• Canon Printer Vulnerability Leaks Plaintext Credentials - Praetorian.
• Password manager Dashlane says hackers stole some customers' password vaults - TechCrunch.
• UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us - TechCrunch.
• AI Agents May Always Fall for Prompt Injections - ArXiv.
• MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure - Cloud Security Alliance.
• From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness - ArXiv.
• Design details that feel like magic - Design Spells.
• Singing lessons.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.
• ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

CISA, the US government agency whose entire job is keeping America's critical infrastructure safe from hackers, has had a contractor publish dozens of plain-text credentials to a public GitHub profile.

Meanwhile, your Oura ring is quietly transmitting some of its data unencrypted - and when one journalist asked the company how often it hands user data to law enforcement, the answer was quite telling.

Plus don't miss our featured interview with OPSWAT's Benny Czarny about his new book "Cybersecurity Upside Down."

All this and more in episode 469 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lesley Carhart.

EPISODE LINKS:

• Canadian man arrested by international authorities, charged with administrating KimWolf DDoS botnet - US Dept of Justice.
• 700+ education and tech websites hijacked in huge ClickFix malware campaign - Malwarebytes.
• Leaked Documents Reveal Russian ‘Cognitive Strikes’ Against the West - Including Islamophobic ‘Pig Head’ Attacks in Paris - OCCRP.
• Lawmakers Demand Answers as CISA Tries to Contain Data Leak - Krebs On Security.
• US cybersecurity agency CISA reportedly in dire shape amid Trump cuts and layoffs - TechCrunch.
• Oura says it gets government demands for user data. Will it share how many? - This Week In Security.
• Privacy and transparency of fitness tracking devices - Whyli.
• Upfest - Europe’s largest street-art festival.
• Magnets Are Bad For Hardware Again - Hackaday.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.
• OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A 23-year-old radio enthusiast spent £300 on a piece of kit from the internet, and used it to bring four packed high-speed trains to a screeching halt. His defence in court? Possibly the most creative excuse we've heard all year.

Meanwhile, owners of $4,000 robot lawnmowers are discovering that their gadget can be hijacked over the internet, redirected at journalists who foolishly lie down in front of it, and used to harvest Wi-Fi passwords, email addresses, and GPS coordinates. Change the default password? Sure - until the next firmware update silently resets it back.

Plus - don't miss our featured interview with XBOW's Brendan Dolan-Gavitt about how AI is transforming penetration testing.

All this and more in episode 468 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.

EPISODE LINKS:

• Open source tool maker Grafana Labs says hackers stole its code, refuses to pay ransom - TechCrunch.
• Man accused of stealing Beyoncé’s unreleased music takes guilty plea - ABC News.
• Shai-Hulud code drop: Open season for supply chain attacks- ReversingLabs.
• Student hacked Taiwan high-speed rail to trigger emergency brakes - BleepingComputer.
• Polish teen derails tram after hacking train network - The Register.
• The Cheap Radio Hack That Disrupted Poland's Railway System - WIRED.
• The man with an army of Yarbo robot lawn mowers - The Verge.
• Ever been run over by a robot? I have - for science! - TikTok.
• RD280UA 28” WQXGA BenQ Programming Monitor with Backlight and Flexible Arm - BenQ.
• Kai Shun DM-0708 combination sharpening stone, grain 300/1000 - Knives and Tools.
• AI-Assisted ICS Attack on a Water Utility - Dragos.
• Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access - Google Cloud Blog.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.
• OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Welcome to the largest educational data breach in history - affecting nearly 9,000 institutions, every Ivy League university, and 30 million students mid-finals. When Canvas's parent company refused to pay and announced they had deployed "security patches" instead, the hackers were less than impressed. So they came back through the cat flap.

Meanwhile, a famous finance expert's face has been showing up on Facebook adverts promising hot stock tips and exclusive WhatsApp investment groups. Spoiler: it isn't him, the tips aren't real, and you're about to be scammed.

Plus we chat to Mike Nichols of Elastic, about how the SOC isn't dying, attackers and defenders are both deploying AI agents, and how the real security crisis is no longer human users - it's the bots acting on their behalf.

All this and more in episode 467 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• ICO fines South Staffordshire £963K over 2022 breach - The Register.
• US bank reports itself after AI customer data mishap - The Register.
• Hackers abuse Google ads, Claude.ai chats to push Mac malware - Bleeping Computer.
• Canvas hack: What we know about apparent cyberattack that impacted thousands of schools - CNN.
• Canvas hack: Company pays criminals to delete students' stolen data - BBC News.
• Post by @amosmagliocco.bsky.social - Bluesky.
• Post by @sethcotlar.bsky.social - Bluesky.
• The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States - Group IB.
• The Fake Nobel that Duped the Romanian Academy - Scena9.
• A (Very) Short History of Life On Earth by Henry Gee - Waterstones.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.
• CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Meta's smart glasses promise privacy "designed for you" - but everything they record was being beamed off to workers in Nairobi to label by hand. When those workers blew the whistle, Meta sacked all 1,108 of them.

Meanwhile, the IT press is in a frenzy over a new Linux bug called "Copy Fail" - complete with logo, dedicated website, and a marketing-friendly name. But is it really the disaster everyone's making it out to be?

And in our featured interview, Jake Moore of ESET explains how he tricked a company into offering his deepfake clone a job - after a perfectly normal-looking video interview.

All this and more in episode 466 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Paul Ducklin.

EPISODE LINKS:

• Anti-DDoS Firm Heaped Attacks on Brazilian ISPs - Krebs On Security.
• Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha - Bleeping Computer.
• Trellix confirms data breach after hack of 'a portion' of its source code - TechRadar.
• Meta’s AI Smart Glasses and Data Privacy Concerns: Workers Say “We See Everything” - Svd.
• Dispute over fate of Kenyan workers who saw Meta AI glasses films - BBC News.
• Copy Fail - CVE-2026-31431.
• Copy Fail: Hype versus reality - the full story - SolCyber.
• Flight into Danger: The Original Airplane! - BBC Sounds.
• The Luton writer behind the original Airplane! - BBC News.
• Code Dependent by Madhumita Murgia - Pan Macmillan.
• The Code Book - Simon Singh.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.
• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A developer at an AI startup wanted to cheat at Roblox. They downloaded a dodgy script on their work laptop. That one decision triggered a cascade of failures that ended with a $2 million data breach affecting hundreds of thousands of organisations. All for some free in-game currency.

Meanwhile, there's a 1980s phone protocol called SS7 that lets shadowy surveillance companies track anyone, anywhere, via their mobile phone. Governments know about it. Telecoms know about it. Nobody's fixing it.

All this and more in episode 465 of the "Smashing Security" podcast with cybersecurity keynote speaker and industry veteran Graham Cluley, joined this week by special guest James Ball.

Plus! Don't miss our featured interview with Rob Edmondson of CoreView, discussing how to lock down Microsoft 365 before it's too late.

EPISODE LINKS:

• Burglar alarm biz gets burgled, ShinyHunters pursues ransom - The Register.
• Ransomware negotiator pleads guilty after leaking victims' insurance details to 'BlackCat' hackers - Tom’s Hardware.
• Grok tells researchers pretending to be delusional ‘drive an iron nail through the mirror while reciting Psalm 91 backwards’ - The Guardian.
• Vercel April 2026 security incident - Vercel.
• App host Vercel says it was hacked and customer data stolen - TechCrunch.
• Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials - Hacker News.
• Sorry for the Nazi spam from my Twitter account - Graham Cluley.
• Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors - Citizen Lab.
• Surveillance vendors caught abusing access to telcos to track people's phone locations, researchers say - TechCrunch.
• The rapid rise of phone surveillance firms - The Bureau of Investigative Journalism.
• Please shut up about your Spotify Wrapped - The New World.
• Think For Yourself - Beatles Song Identification Game.
• Nodes: Free Connection Puzzle & Vertex Game Alternative.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A company that ran anonymous tip lines for 35,000 American schools - handling reports of bullying, weapons, and self-harm - boasted on its website that it had suffered zero security breaches in over 20 years. A hacker called Internet Yiff Machine thought that sounded like a challenge, with predictable results...

Meanwhile, Rockstar Games gets hacked again - and the stolen data turns out to be less embarrassing than the financial secrets it accidentally revealed. GTA Online is still making half a billion dollars a year. Red Dead Redemption is not.

All this and more in episode 464 of the "Smashing Security" podcast with cybersecurity keynote speaker and industry veteran Graham Cluley, joined this week by special guest BBC cybersecurity correspondent Joe Tidy.

Plus! Don't miss our featured interview with Ryan Benson of Meter.

EPISODE LINKS:

• Grinex exchange blames "Western intelligence" for $13.7M crypto hack - Bleeping Computer.
• Are Former Black Basta Affiliates Automating Executive Targeting? - Reliaquest.
• Apple is working on passcode bug locking out iPhone users - The Register.
• Hackers who stole crime tip records offering data cache for $10k - San.
• P3 Advertised 20+ Years and 0 Security Breaches. You Can Guess What Happened Next - Databreaches.net.
• Portland police urge residents to avoid Crime Stoppers following hack - San.
• GTA-maker Rockstar Games hacked again but downplays impact - BBC News.
• Rockstar hackers release their stolen data, reveal that Rockstar was right to not pay them anything for it - PC Gamer.
• XCancel.
• ”We Are Anonymous” by Parmy Olson - Penguin.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.
• Meter – Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A hacking group claims to have broken into the flood defence system protecting Venice's Piazza San Marco - and is offering to sell access to whoever wants it. The asking price? A frankly insulting $600.

Meanwhile, Anthropic accidentally leaked the source code for Claude Code via a basic packaging mistake. Oh, and by the way, they've also just revealed they've built an AI model called Mythos that can find and chain together software vulnerabilities faster than any human. Sleep well.

All this and more in episode 463 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Tanya Janca.

EPISODE LINKS:

• Booking.com warns customers of hack that exposed their data - The Guardian.
• GTA-maker Rockstar Games hacked again but downplays impact - BBC News.
• Meta removes ads for social media addiction litigation - Axios.
• Hackers claim control over Venice San Marco anti-flood pumps - Security Affairs.
• Venezia, attacco hacker al sistema di pompe che difende piazza San Marco dall'acqua: «Abbiamo i codici, possiamo disattivarlo» - Corriere del Veneto. 
• Digging into the Claude Code source - Dave Schumaker’s write-up of Anthropic leaking data in February 2025.
• Anthropic goes nude, exposes Claude Code source by accident - The Register.
• Assessing Claude Mythos Preview’s cybersecurity capabilities - Anthropic.
• Smashing Security transcripts!
• Shrinking - Apple TV. 
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

LinkedIn has been secretly scanning your browser for over 6,000 installed extensions — on every single click you make. It can tell if you're job hunting, what religion you are, and whether you have ADHD. And none of this is mentioned anywhere in their privacy policy.

Meanwhile, California's crypto millionaires are learning that no amount of encryption can protect you from someone who knocks on your door pretending to deliver a pizza.

All this and more in episode 462 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Dave Bittner.

EPISODE LINKS:

• Russian government hackers broke into thousands of home routers to steal passwords - TechCrunch.
• Refusal to Give the Government Passwords to Personal Mobile Device Criminalized in Hong Kong - US Consulate in Hong Kong.
• "I didn't think millions would see this..." Russians are calling each other through a cat feeder - GUBDaily.
• BrowserGate.
• Scanned extensions database - BrowserGate.
• LinkedIn secretly scans for 6,000+ Chrome extensions, collects data - Bleeping Computer.
• Translate into LinkedIn speak - Kagi.
• Security - xkcd.
• Wealthy California crypto holders targeted in violent ‘wrench attacks’ - KTLA 5.
• Lost Doctor Who episodes to be released this week - BBC News.
• Doctor Who: The Daleks’ Master Plan - The Nightmare Begins - BBC iPlayer.
• Doctor Who: The Daleks’ Master Plan - Devil’s Planet - BBC iPlayer.
• Milton Bradley Grandmaster Robotic Chess Computer - YouTube.
• Robot Chess - One-armed gambit - Techmoan on YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A cannabis-growing, beekeeping, gyrocopter-flying Irishman invested his drug money in Bitcoin back in 2011 - and now sits on a fortune worth $400 million. There's just one small problem: the access codes were tucked inside his fishing rod case, which has mysteriously vanished. Or has it? Because this week, one of his frozen wallets suddenly woke up and moved $35 million - and someone had to identify themselves to do it.

Meanwhile, Ajax Football Club scores a spectacular cyber own-goal, as a data breach that the club claimed affected "a few hundred" fans turns out to may have exposed the personal details of 300,000 supporters - along with the ability to steal match tickets and quietly remove people from the stadium ban list.

All this and much more in episode 461 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest journalist Danny Palmer.

EPISODE LINKS:

• Iran-linked hackers breach FBI director's personal email, publish photos and documents - Reuters.
• Windows PCs crash three times as often as Macs, report says - TechSpot.
• Wife used CCTV to steal $176M of husband’s crypto, UK court told - Coin Telegraph.
• Gardaí open €30m bitcoin virtual wallet, first of 12 accessed since seizure in 2019 - Irish Times.
• Irish Drug Dealer’s Lost BTC Stack Worth $400m Has Woken Up - Arkham.
• Ajax FC data breach exposes 300,000 fans, hacker steals tickets an stadium ban details - Cybernews.
• Small Prophets - BBC iPlayer.
• RPG Taverns - Dungeons and Dragons tavern in London.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A disgruntled data analyst decides that the best response to losing his contract is to steal the entire company payroll database and demand $2.5 million in Bitcoin - signing his extortion emails from a company called "Loot."

Meanwhile, two people drive up to the entrance of the UK's nuclear submarine base at Faslane and politely ask if they can have a look around. Tourists? Spies? Something in between?

Plus: Female Muslim punk rock group, and a little red book that might save your sanity in a post-truth world.

All this and more in episode 460 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

• A Top Google Search Result for Claude Plugins Was Planted by Hackers - 404 Media.
• Iowa-based Intoxalock cyberattack disrupts calibration service for interlock users - DysruptionHub.
• China hacker group leaks $7M crypto theft operation targeting wallet supply chains​ - Crypto News.
• Federal Jury Convicts Charlotte Man For Cyber Extortion Scheme That Targeted International Technology Company - DOJ.
• Iranian and Romanian charged after allegedly trying to enter UK nuclear naval base - Sky News.
• LadyParts - Spotify.
• On Disinformation: How to Fight for Truth and Protect Democracy - Lee McIntyre.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

In episode 459 of Smashing Security, we dive into a chillingly clever account takeover attempt targeting WordPress co-founder Matt Mullenweg - involving MFA fatigue, real Apple alerts, a convincing support call, and a phishing page that oh-so-nearly worked. If a famous techie could have this happen to you, can you be sure you're immune?

Plus: would you donate your lifetime medical history to science if you were promised anonymity? We unpack serious concerns around UK Biobank, where “de-identified” data may not be as anonymous as you think — and how surprisingly little information it takes to reveal everything.

And! Human-powered “AI”, and a punishment worse than prison: eight hours on the RSA expo floor...

All this, and much more, in episode 459 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

• DOGE employee stole Social Security data and put it on a thumb drive, report says - TechCrunch.
• Foreign hacker in 2023 compromised Epstein files held by FBI, source and documents show - Reuters.
• New font-rendering trick hides malicious commands from AI tools - Bleeping Computer.
• Lockdown Mode - Apple support.
• Gone (Almost) Phishin’ - Matt Mullenweg.
• Listen to the Live Scam Call Targeting Matt Mullenweg’s Apple Account - YouTube.
• Confidential health records from UK BioBank project exposed online - The Guardian.
• A message from Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank - UK BioBank.
• Psychotherapy data breach blackmailer sent to prison - Paul Ducklin.
• Your AI slop bores me.
• Post by Vaughan Shanks - LinkedIn.
• Judge Sentences CISO to 8 Consecutive Hours on RSA Expo Floor as Formal Punishment for Security Breach - The Exploit.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Adaptive Security - request a custom demo featuring a real CEO deepfake simulation.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

A Wikipedia security engineer accidentally wakes a dormant JavaScript worm that hadn't stirred since 2024 - and within minutes, giant woodpecker images are plastered across the internet's favourite encyclopaedia.

Meanwhile, a crypto contractor hired to help the US Marshals manage seized digital assets allegedly decides to help himself to $46 million of it - and then brags about it on a recorded Telegram call.

Plus: Graham champions Asterix, Trisha discovers the fantasy novels of Robin Hobb, and someone called "Lick" ends up in the nick.

All this, and much more, in episode 458 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Tricia Howard.

EPISODE LINKS:

• Major data leak forum dismantled in global action against cybercrime forum - Europol.
• Ericsson blames vendor vishing slip-up for breach exposing thousands of records - The Register.
• How hackers bypassed MFA with a $120 phishing kit – until law enforcement  shut them down - Hot for Security.
• Wikipedia hit by self-propagating JavaScript worm that vandalized pages - Bleeping Computer.
• FBI arrests crypto thief accused of stealing $46 million from seized government wallet - Tom’s Hardware.
• Twitter thread by ZachXBT about John Daghita’s arrest - Twitter.
• Asterix - Wikipedia.
• Robin Hobb.
• The Complete Farseer trilogy - Harper Collins.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

When a top cybersecurity firm discovered it had a leak, you would expect the FBI to be called. Instead, the person put in charge of the investigation was the actual leaker... who promptly sent an innocent colleague into a career-ending ambush.

In this episode, we unravel the jaw-dropping tale of a defence contractor caught selling zero-day exploits to a Russia-linked broker.

Plus: are nation states quietly poisoning AI models to bend reality itself? We explore how “foreign information manipulation interference” could target not just social media users, but the large language models we increasingly trust for answers — and what that might mean for truth, trust, and the future of online influence.

All this, and much more, in episode 457 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Carl Miller.

EPISODE LINKS:

• Large-Scale Online Deanonymization with LLMs - Simon Lermen.
• Hacked Prayer App Sends ‘Surrender’ Messages to Iranians Amid Israeli and US Strikes - Wired.
• “Stay safe out there gamers”: Streamers say Amazon just made Wishlists a doxxing risk - Daily Dot.
• Apple alerts exploit developer that his iPhone was targeted with government spyware - TechCrunch.
• Former General Manager for U.S. Defense Contractor Sentenced to 87 Months for Selling Stolen Trade Secrets to Russian Broker - US Department of Justice.
• Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools - US Department of Treasury.
• Inside the story of the US defense contractor who leaked hacking tools to Russia - TechCrunch.
• ​​Hundreds of English-language websites link to pro-Kremlin propaganda - Guardian.
• The Incredible Shrinking Man - Internet Archive.
• “The Immortalists” by Aleks Kortoski - Penguin Books.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

When the mysterious operator of an internet archiving-service decided to silence a curious Finnish blogger, they didn’t just send a stroppy email - they allegedly weaponised their own CAPTCHA page to launch a DDoS attack, threatened to invent an entirely new genre of AI porn, and tampered with parts of their own archive to smear the blogger's name.

In this episode, we unravel how a website designed to preserve history may have trashed its own credibility - and how Wikipedia responded when trust went out the window.

Plus a ransomware gang shoots itself in the foot with a classic case of buffoonery, accidentally corrupting the very keys victims would need to decrypt their data. When even the criminals can’t unlock your files, what happens next?

All this, a surprisingly zen Pick of the Week, and a gloriously splenetic rant against web forms, on episode 456 of the award-winning "Smashing Security" podcast, with cybersecurity veteran Graham Cluley and special guest Paul Ducklin.

EPISODE LINKS:

• This App Will Detect People Wearing Smart Glasses Near You - Lifehacker.
• Patients listed as dead after major NZ health app MediMap hacked - 1News.
• Why fake AI videos of UK urban decline are taking over social media - BBC News.
• FBI orders domain registrar to reveal who runs mysterious Archive.is site - Ars Technica.
• Archive.today CAPTCHA page executes DDoS; Wikipedia considers banning site - Ars Technica.
• Archive.today is directing a DDOS attack against my blog - Gyrovague.
• Critical buffer overflow bug - in ESXi ransomware - SolCyber.
• Yoga with Adriene - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Could America turn off Europe's internet?

That’s one of the questions that Graham and special guest James Ball will be exploring as they discuss tech sovereignty. Could Gmail, cloud services, and critical infrastructure really become geopolitical leverage? And is anyone actually building a Plan B?

Plus we explore if Meta is quietly plotting to turn its smart glasses into face-recognising surveillance specs? With reports of internal memos suggesting they plan to launch controversial features while everyone’s distracted by political chaos, we ask: is this innovation really wanted by the public... or something far creepier?

All of this, and much more, in episode 455 of the award-winning "Smashing Security" podcast with cybersecurity veteran Graham Cluley, joined this week by journalist and author James Ball.

EPISODE LINKS:

• IcedID malware developer fakes his own death to escape the FBI - Risky Business.
• Sex toys maker Tenga says hacker stole customer information - TechCrunch.
• Dutch police arrest man for "hacking" after accidentally sending him confidential files - Hot for Security.
• Meta Plans to Add Facial Recognition Technology to Its Smart Glasses - New York Times.
• Trading Sovereignty for Scale? The Costs of the US - UK Tech Prosperity Deal - Just Security.
• Just Mercy - Wikipedia.
• Just Mercy trailer - YouTube.
• Bryan Stevenson’s TED talk: We need to talk about an injustice - YouTube.
• The Residence - Netflix.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Passwork - a reliable secrets manager and password management solution.
• Adaptive Security - request a custom demo featuring a real CEO deepfake simulation.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

AI bots are having existential crises, inventing religions, and allegedly plotting against humanity... or so the internet would have you believe.

We dig into Moltbook, the “AI-only” social network that sent Twitter into a meltdown, attracted breathless talk of the singularity, and turned out to be far less Terminator and far more humans role-playing as bots.

Plus we discuss why "vibe coding" your app might be a catastrophically bad idea, when security researchers can easily peek inside rifle through your private messages, API keys, and databases.

Also this week we learn that pro-Russian hackers are circling the Winter Olympics - or is it the Jamaican Bobsleigh team?

All this and more is discussed in episode 454 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Iain Thomson.

EPISODE LINKS:

• AI Agents Created Their Own Religion, Crustafarianism, On An Agent-Only Social Network - Forbes.
• I Infiltrated Moltbook, the AI-Only Social Network Where Humans Aren’t Allowed - Wired.
• 'Moltbook' social media site for AI agents had big security hole, cyber firm Wiz says - Reuters.
• Italy blames Russia-linked hackers for cyberattacks ahead of Winter Olympics - The Record.
• Italy says railways hit by 'serious sabotage' as Winter Olympics begin - BBC News.
• EpsteIN - GitHub.
• Private Eye.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Passwork - a reliable secrets manager and password management solution.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Supposedly redacted Jeffrey Epstein files can still reveal exactly who they’re talking about - especially when AI, LinkedIn, and a few biographical breadcrumbs do the heavy lifting.

Sloppy redaction leads to explosive claims, and difficult reputational consequences for cybersecurity vendors, and we learn how trust - once cracked - can be almost impossible to fully restore.

Elsewhere, the spotlight turns to insider threat in the age of AI, after a senior US cybersecurity official uploads sensitive government material into the public version of ChatGPT. Oops.

All this, and much more, in episode 453 of Smashing Security with cybersecurity veteran Graham Cluley and special guest Tricia Howard.

EPISODE LINKS:

• Notepad++ hijacked to serve malware in targeted attacks - Notepad++.
• Porn-quitting app caught leaking users’ sexual habits - 404 Media.
• MicroWorld Technologies’ eScan anti-virus update turned into a malware delivery system - Morphisec.
• Jmail.World.
• Informant told FBI that Jeffrey Epstein had a ‘personal hacker’ - Techcrunch.
• Confidential informant statement given to FBI - US Department of Justice.
• Post by Graham Cluley - LinkedIn.
• Trump’s acting cyber chief uploaded sensitive files into a public version of ChatGPT - Politico.
• We are Lady Parts - Channel 4.
• We are Lady Parts trailer - YouTube.
• “Bashir with a good beard” by We are Lady Parts - YouTube.
• “Voldermort under my headscarf” by We are Lady Parts - YouTube.
• Doctor Who: The Shakespeare Notebooks - Penguin.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Passwork - a reliable secrets manager and password management solution.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

In episode 452, a London-based YouTuber wins a landmark court case against Saudi Arabia after his phone was hacked with Pegasus spyware — exposing how a single, seemingly harmless text message can turn a smartphone into a round-the-clock surveillance device.

Plus, we go looking for professional hitmen online - only to uncover uncomfortable questions about why some crimes attract customers but very few complaints.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Joe Tidy.

EPISODE LINKS:

• Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch - The Register.
• Russian state hackers likely behind wiper malware attack on Poland’s power grid - The Record.
• US charges 31 more suspects linked to ATM malware attacks - Bleeping Computer.
• Dark web arrests in Romania linked to portal which offered services including murder - ROCU.
• Romanian scammers ran fake hitman-for-hire site, lured desperate perpetrators as 'incompetent assassins' - Fox News.
• This Fake Hitman Site Is the Most Elaborate, Twisted Dark Web Scam Yet - VICE.
• Unlikely Assassin, The Murder of Amy Allwine - Rooster.
• Saudi dissident awarded $4.1 million by UK court for hacking, assault 'by Saudi Arabia' - Reuters.
• Stalkerware: The software that spies on your partner - BBC News.
• Using 'stalkerware' to spy on a colleague's phone - YouTube.
• “Polite Society” trailer - YouTube.
• Elegoo Saturn 3 3D printer - Elegoo.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Passwork - a reliable secrets manager and password management solution.
• Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

In episode 451 of "Smashing Security," we meet the cybercriminal who hacked the US Supreme Court, Veterans Affairs, and more - and then helpfully posted screenshots (and even someone’s blood type) on an account called "I hacked the government."

Plus we discuss how researchers uncovered a creepy flaw that lets attackers hijack wireless headphones, listen in on calls, inject audio, and even turn your earbuds into a stalking device - all without you noticing.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Ray [REDACTED]

EPISODE LINKS:

• Tennessee Man Pleads in Hacking U.S. Supreme Court, AmeriCorps, and VA Health System - US Department of Justice.
• Paris Hilton’s hacker sentenced to 57 months in prison - Graham Cluley.
• WhisperPair.
• One Tap To Hijack Them All - A Security Analysis of the Google Fast Pair Protocol - YouTube.
• Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking - Wired.
• Line of Duty - Wikipedia.
• Line of Duty - BBC iPlayer.
• Forgive the haters - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.
• Adaptive Security - request a custom demo featuring a real CEO deepfake simulation today from adaptivesecurity.com.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Confusion reigns after claims that data linked to 17.5 million Instagram accounts is up for sale - sparked by a vague post, contradictory statements, and a flood of password reset emails nobody asked for.

And we dig into Grok, Elon Musk’s AI chatbot, after it started generating sexualised images of women and children - raising uncomfortable questions about guardrails, accountability, and why playing the censorship card doesn’t make the problem go away.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Monica Verma.

EPISODE LINKS:

• Free Speech Union website down after alleged funders exposed by trans hackers - Pink News.
• Illinois Man Charged in Snapchat Hacking Investigation - US Dept of Justice.
• Hackers get hacked, as BreachForums database is leaked - Hot for Security.
• Post by Malwarebytes - Bluesky.
• Post by Instagram - Twitter.
• Instagram denies breach amid claims of 17 million account data leak - Bleeping Computer.
• Ofcom asks X about reports its Grok AI makes sexualised images of children - BBC News.
• Musk’s Grok blocked by Indonesia, Malaysia over sexualized images in world first - CNN.
• Elon Musk shares AI images of Starmer in bikini in row over grim Grok deepfakes - Mirror.
• Soul Music - BBC Sounds.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Romance scammers have apparently discovered astrology... and Taurus is their secret weapon.

In episode 449 of "Smashing Security", we take a look inside an actual romance-fraud handbook - complete with scripts, personality “types”, corporate jargon, and a seven-day plan to get victims from hello to hand over the crypto.

Then Lesley "hacks4pancakes" Carhart delivers a reality check on the dire cybersecurity jobs market for juniors: why entry-level roles are evaporating, how automated CV screening is chewing candidates up, and what hopeful newcomers (and weary veterans) can do about it.

Plus, Graham talks to ThreatLocker CEO Danny Jenkins about why misconfigurations are behind an uncomfortable number of breaches, how default-deny security actually works in practice, and why detecting attacks after they’ve started is already too late.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Lesley Carhart.

EPISODE LINKS:

• Millions of Android Powered TVs and Streaming Devices Infected by Kimwolf Botnet - Hackread.
• Ilya Lichtenstein, Bitcoin hacker behind massive crypto theft, credits Trump for early prison release - CNBC.
• How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware Infection - Securonix.
• A scammer's guide: How cybercriminals plot to rob a target in a week - Reuters.
• Game of Wool: Britian’s Best Knitter - Channel 4.
• Game of Wool trailer - YouTube.
• Earthrise One: Melbourne's Premier Sci-Fi Escape Room Adventure.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.
• Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Think your Kindle is harmless? Think again! In this episode, Graham and special guest Danny Palmer unpack a Black Hat Europe talk revealing how a boobytrapped audiobook could exploit the Amazon eBook reader - potentially letting an attacker break into your account and seize control of your credit card.

Plus a blast from 2021's "summer of ransomware" returns to haunt Ireland's Health Service Executive, as victims are offered €750 each.

And because it's the last show before the Christmas break, there's also a Pick of the Week that veers from cosy rom-com comfort to pointy-polygon nostalgia. 

All this, and more, in episode 448 of the "Smashing Security" podcast with Graham Cluley, and special guest Danny Palmer.

🎅 🎄 Thanks to everyone for listening to "Smashing Security" during 2025 - we look forward to being back in your ear'oles in early January. Stay safe! 🎅 🎄

EPISODE LINKS:

• Password manager provider fined £1.2m by ICO for data breach affecting up to 1.6 million people in the UK - ICO.
• Trump Administration Turning to Private Firms in Cyber Offensive - Bloomberg.
• Russian ban on Roblox gaming platform sparks rare protest - Reuters.
• Once upon an exploit: how fake audiobook led to Kindle takeover - Cybernews.
• Four years later, Irish health service offers €750 to victims of ransomware attack - Bitdefender.
• When Harry Met Sally - Wikipedia.
• When Harry Met Sally trailer - YouTube.
• Tomb Raider 1-3 Remastered review - you were never going to smooth these games out - Eurogamer.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

On this week's show we learn that AI really can be a stalker’s best friend, as we explore a strange tale that starts with a manatee-shaped mailbox on a millionaire's lawn and ends with Grok happily doxxing real people, mapping out stalking "strategies," and handing out revenge-porn tips.

Then we go inside the Louvre heist, where thieves in hi-vis and a hire van waltzed off with the French crown jewels in broad daylight, exploiting our assumptions about what "looks normal" - the same kind of bias we’re now baking into security AIs.

Plus, Graham chats with Rob Edmondson from CoreView about why misconfigurations and over-privileged accounts can make Microsoft 365 dangerously vulnerable.

All this, and more, in episode 447 of the "Smashing Security" podcast with Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

• Khashoggi widow files complaint in France alleging Saudi government infected devices with spyware - The Record.
• US Posts $10 Million Bounty for Iranian Hackers - Security Week.
• Infostealer has entered the chat - Kaspersky.
• Dave Portnoy posts a photo of his lawn (including a manatee-shaped mailbox) - Twitter.
• Elon Musk’s Grok AI Is Doxxing Home Addresses of Everyday People - Futurism.
• Elon Musk’s Grok Is Providing Extremely Detailed and Creepy Instructions for Stalking - Futurism.
• How the Louvre thieves exploited human psychology to avoid suspicion – and what it reveals about AI - The Conversation.
• Outrageous (TV series) - Wikipedia.
• Outrageous trailer - YouTube.
• Man charged with theft after allegedly swallowing Fabergé pendant in jewellery store - The Guardian.
• Free Microsoft 365 Tenant Security Scanner - CoreView.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.
• CoreView - Benchmark your Microsoft 365 tenant security against the Center for Internet Security (CIS) controls. 

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

A teenage cybercriminal posts a smug screenshot to mock a sextortion scammer... and accidentally hands over the keys to his real-world identity. Meanwhile, we look into the crystal ball for 2026 and consider how stolen data is now the jet fuel of cybercrime – and how next year could be even nastier than 2025.

Plus, Graham rants about recipe sites that won’t shut up, and there's even more love for Lily Allen's album "West End Girl" album.

All this and more is discussed in episode 446 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Rik Ferguson.

EPISODE LINKS:

• Europol nukes Cryptomixer laundering hub, seizing €25M in Bitcoin - The Register.
• 4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign - Koi.
• Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts - Push Security.
• Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ - Krebs on Security.
• Jonathan Ross email goof highlights Twitter security issue - Graham Cluley.
• VIDEO: Mark Zuckerberg’s password choices are dadada-dumb! - Graham Cluley.
• Password to Louvre’s video surveillance system was 'Louvre', according to employee - ABC News.
• Just the Recipe.
• West End Girl - Wikipedia.
• West End Girl - Spotify.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• 1Password - Take the first step to better security by securing your team’s credentials.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

America's airwaves are haunted by zombies again, as we dig into a decade of broadcasters leaving their hardware open to attack, giving hackers the chance to hijack TV shows, blast out fake emergency alerts, and even replace religious sermons with explicit furry podcasts.

Meanwhile, we look at how a worker at a cybersecurity firm allegedly leaked internal information to a hacking gang - raising big questions about insider threats.

Plus: Frankenstein on Netflix, Vine nostalgia, and why Barney the Dinosaur may be the true criminal mastermind behind it all.

All this and more is discussed in episode 445 of the “Smashing Security” podcast with cybersecurity veteran Graham Cluley, and special guest Dan Raywood.

EPISODE LINKS:

• Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix - Acronis.
• Tokyo Court Finds Cloudflare Liable For Manga Piracy in Long-Running Lawsuit - TorrentFreak.
• Former Google chief accused of spying on employees through account ‘backdoor’ - LA Times.
• Bogus zombie apocalypse warnings undermine US emergency alert system - Ars Technica.
• 2013 EAS Zombie Hoax - Emergency Alert System Wiki.
• The 1987 Max Headroom incident - YouTube.
• Nation-wide radio station hack airs hours of vulgar “furry sex” ramblings - Ars Technica.
• ESPN 97.5 Houston Victim Of Barix Hack - Radio Insight.
• ESPN Houston apologises to viewers - Facebook.
• CrowdStrike fires ‘suspicious insider’ who passed information to hackers - TechCrunch.
• Frankenstein official trailer - YouTube.
• Frankenstein - Netflix.
• Vine: Six Seconds that changed the world - Global Player.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Stop the press - a company has actually said "sorry" after a data breach, and hotels are helping hackers phish their own guests.

In episode 444 of "Smashing Security" we examine a refreshingly honest breach response (and why legacy systems are still going to ruin your week), dig into a nasty hotel-booking malware campaign that abuses trust in apps and CAPTCHAs, and chat about autonomous pen testing, AI-turbocharged cybercrime, and what CISOs should really be asking on Monday morning.

And lost Doctor Who is brought back to life by one very dedicated animator, and we take a look at Eddie Murphy’s career.

All this and more is discussed in episode 444 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Tricia Howard.

Plus - don't miss our featured interview with Snehal Antani from Horizon3.ai!

EPISODE LINKS:

• A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers - Wired.
• British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News.
• Cloudflare experiences a massive outage - LifeHacker.
• Protecting our Merchants: Standing up to Extortion - Checkout.
• A miracle: A company says sorry after a cyber attack - and donates the ransom to cybersecurity research - Hot for Security.
• Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware - The Hacker News.
• Unmasking a Sophisticated Phishing Campaign That Targets Hotel Guests - Akamai.
• Doctor Who Animation: Daleks' Master Plan - The Nightmare Begins. Part 1 - YouTube.
• Doctor Who Animation: Daleks' Master Plan - The Nightmare Begins. Part 2 - YouTube.
• Being Eddie - Netflix.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Tinder has got a plan to rummage through your camera roll, and Warren Buffett keeps popping up in convincing deepfakes dishing "number one investment tips."

Meanwhile, will agentic AI replace your co-hosts before you can say "EDR for robots"? and why you should still read books.

All this, plus Lily Allen's new album and Claude Code come up for discussion in episode 443 of the "Smashing Security" podcast, with special guest Ron Eddings.

EPISODE LINKS:

• ‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones - TechCrunch.
• Cyber insurers paid out over twice as much for UK ransomware attacks last year - The Register.
• Lost iPhone? Don’t fall for phishing texts saying it was found - Bleeping Computer.
• Tinder to use AI to get to know users, tap into their Camera Roll photos - TechCrunch.
• Facebook’s AI can now suggest edits to the photos still on your phone - TechCrunch.
• Berkshire warns of AI deepfakes impersonating Warren Buffett - Reuters.
• West End Girl - Wikipedia.
• West End Girl - Spotify.
• Claude Code.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Time itself comes under attack as a state-backed hacking gang spends two years tunnelling toward a nation’s master clock — with chaos potentially only a tick away.

Plus when ransomware negotiators turn to the dark side, what could possibly go wrong?

All this and more is discussed in episode 442 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Dave Bittner.

EPISODE LINKS:

• Alleged Meduza Stealer malware admins arrested after hacking Russian org - Bleeping Computer.
• Tap-and-Steal: The Rise of NFC Relay Malware on Mobile Devices - Zimperium.
• Postcode Lottery's lucky dip turns into data slip as players draw each other's info - The Register.
• Chinese Ministry of State Security MSS WeChat post - WeChat.
• China blames US for cyber break-in, claims America is world's biggest bit burglar - The Register.
• Chicago firm that resolves ransomware attacks had rogue workers carrying out their own hacks, FBI says - Chicago Sun Times.
• MicroMacro: Crime City.
• Star Wars 3.5 foot animated LED R2-D2 - Home Depot.
• TrackaLacker.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Material - Email security that covers the full threat landscape – stopping new flavors of phishing and pretexting attacks in their tracks, while also protecting accounts and data from exploit or exposure.
• Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Basketball stars have allegedly joined forces with the mafia to fleece high-rollers in a poker scam involving hacked shufflers, covert cameras, and an X-ray card table.

Meanwhile, researchers have found they could poke around an FIA driver portal to pull up the personal details of Formula 1 megastars.

Plus: Graham’s “Pick of the Week” turns CAPTCHA hell into a delightfully deranged browser game that will make you question vegetables, geometry, and your life choices, while Danny takes a trip to ancient Africa...

All this and more is discussed in episode 441 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• Baohuo, the gray eminence. Android backdoor hijacks Telegram accounts, gaining complete control over them - Dr Web.
• Cyberattack on Russia’s food safety agency reportedly disrupts product shipments - The Record.
• Dissecting YouTube's malware distribution network - Check Point.
• 31 Defendants, Including Members and Associates of Organized Crime Families and National Basketball Association Coach Chauncey Billups, Charged in Schemes to Rig Illegal Poker Games - US Department of Justice.
• How Hacked Card Shufflers Allegedly Enabled a Mob-Fueled Poker Scam That Rocked the NBA - Wired.
• Every Formula 1 driver on the grid just had their passport and license details leaked - but it could have been so much worse - TechRadar.
• I’m not a robot - Neal.fun.
• Can I Beat The CAPTCHA Game? - YouTube.
• An African History of Africa by Zeinab Badawi - Penguin.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.
• SecAlerts - SecAlerts makes your job easier by matching vulnerabilities to your software, using information as soon as it’s released. Use code SMASHING for 50% off a year subscription.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

A literal insider threat: we head to a Romanian prison where “self-service” web kiosks allowed inmates to run wild. Then we head to the checkout aisle to ask why JavaScript on payment pages went feral, and how new PCI DSS rules are finally muzzling Magecart-style skimmers.

Plus: Graham reveals his new-found superpower with Keyboard Maestro, and Scott describes a slick new way to whip up beautiful how-to videos with Screen Studio.

All this and more is discussed in episode 440 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Scott Helme.

EPISODE LINKS:

• What caused the AWS outage - and why did it make the internet fall apart? - BBC News.
• China blames US for cyber break-in, claims America is world's biggest bit burglar - The Register.
• Nintendo allegedly hacked by Crimson Collective hacking group - screenshot shows leaked folders, production assets, developer files, and backups - Tom’s Hardware.
• Romanian inmate hacks into prison IT system, modifies sentences for others - Romania Insider.
• New Version of PCI DSS Designed to Tackle Emerging Payment Threats - Infosecurity Magazine.
• What is Magecart? How this hacker group steals payment card data - CSO.
• Keyboard Maestro.
• Screen Studio.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ANON - Find, monitor and remove data about yourself online. Manage your digital footprint with ease. Use code SMASHING for a 25% discount.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

A critical infrastructure hack hits the headlines - involving default passwords, boasts on Telegram, and a finale that will make a few cyber-crooks wish the ground would swallow them whole. 

Meanwhile we dig into the bit we don't talk about enough: the human cost of defending companies from hackers - stress, burnout, and how better leadership culture can help make security teams safer and saner.

Plus we say a heartfelt "la di dah" to Diane Keaton, and tune in to a freshly re-released slice of pre-Fleetwood Mac history for the music-obsessed amongst us. 

All this and more is discussed in episode 439 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Annabel Berry.

EPISODE LINKS:

• Cyber-attacks rise by 50% in past year, UK security agency says - The Guardian.
• What does the end of free support for Windows 10 mean for its users? - The Guardian.
• Satellites found exposing unencrypted data, including phone calls and some military comms - TechCrunch.
• Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS - Forescout.
• Caught in the act: Ransomware attack sticks to our AI-created honeypot - Forescout.
• Human Performance in Security Operations: A Survey on Burnout, Wellbeing and Flow State Among Practitioners - NDSS Symposium.
• State of the Security Profession 23/24 - Chartered Institute of Information Security.
• Leading Cyber.
• Mental Health in Cybersecurity Foundation.
• “Play it Again, Sam” - IMDB.
• “Play it Again, Sam” clip - YouTube.
• “Buckingham Nicks” - Spotify.
• Fleetwood Mac - Silver Springs (Live, 1997) - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

If anything we've discussed today has resonated with you, or if you're going through a tough time, please know you are not alone. There is always someone ready to listen, without judgment. Here are a few of the available resources:

• Shout - text 85258 (24x7)
• Samaritans - tel 116123 (24x7)
• Suicide prevention - tel 0800 689 5652 (6pm - 3.30am)
• SANEline - tel 0300 304 7000 (4.30pm - 10.30pm)

SPONSORS:

• SecAlerts - SecAlerts makes your job easier by matching vulnerabilities to your software, using information as soon as it’s released. Use code SMASHING for 50% off a year subscription.
• ANON - Find, monitor and remove data about yourself online. Manage your digital footprint with ease. Use code SMASHING for a 25% discount.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Your computer's mouse might not be as innocent as it looks - and one ransomware crew has a crisis of conscience that nobody saw coming.

We talk about how something as ordinary as a web page could turn your mouse into a surprisingly nosey neighbour, and why ransomware gangs need to think carefully about their reputation.

Meanwhile, Graham reveals a baked potato hack that might just change your life, and we take an unexpected detour to South America for a bit of literary adventure involving inflatable pigs.

All this and more is discussed in episode 438 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Geoff White.

EPISODE LINKS:

• Discord users' data stolen by hackers in third-party data breach - Bitdefender.
• North Korean hackers increasingly targeting wealthy crypto holders - BBC News.
• Scattered Lapsus$ Hunters offering $10 in Bitcoin to 'endlessly harass' execs - The Register.
• Vacanti mouse - Wikipedia.
• Mic-E-Mouse.
• Invisible Ears at Your Fingertips: Acoustic Eavesdropping via Mouse Sensors - Arvix.
• Mic-E-Mouse Pipeline Demonstration - YouTube.
• Hackers say they have deleted children's pictures and data after nursery attack backlash - BBC News.
• Baked Potato - Wikipedia.
• “At the Tomb of the Inflatable Pig: Travels through Paraguay” - Penguin.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• Vanta - Expand the scope of your security program with market-leading compliance automation... while saving time and money. Smashing Security listeners get $1000 off.
• Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.
• Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".