Hacking Humans
CyberWire Inc.
Deception, influence, and social engineering in the world of cybercrime.
Deception, influence, and social engineering in the world of cybercrime.
Cloud Security Posture Management (CSPM) (noun) [Word Notes]
Epizodai
Please enjoy this encore of Word Notes. Tools that automate the identification and remediation of cloud misconfigurations. CyberWire Glossary link: https://thecyberwire.com/glossary/cloud-security-posture-management Audio reference link: Josh Whedon. 2005. Serenity [Movie]. IMDb. URL https://www.imdb.com/title/tt0379786/
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This month our hosts dive into the growing Chinese-speaking cybercrime ecosystem and the rise of threat actors behind large-scale credential phishing operations. They explore a major disruption targeting Chinese-language phishing kits CoGUI, CoAceV, and CoFish_Ws, which have fueled hundreds of millions of malicious messages, particularly targeting Japanese organizations, and examine what the takedown could mean for the broader cybercrime landscape. Sources: Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up, including a milestone for Maria’s 100th episode and a listener’s thoughts on whether it should be called “Catch of the Week” instead of “Catch of the Day.” We also revisit FINRA’s Market Data and Investments Explorer. Joe covers a major taxpayer fund scam in Mobile, Alabama, and another report on the growing threat of financial fraud. Maria explores the European Commission’s investigation into Booking.com’s handling of scams, including fake property listings and phishing messages targeting travelers with legitimate reservations. Dave examines a new FTC report showing that reported fraud losses among Americans aged 60 and older have climbed fivefold since 2020, with investment scams, impersonation schemes, and romance scams contributing to devastating financial losses. Our Catch of the Day comes from Michael, who received a phishing email claiming there was a problem with his ChatGPT payment method. The giveaway? He doesn’t have a ChatGPT subscription. Resources and links to stories: ‘This is bad’: Nearly $15 million in Mobile taxpayer funds missing after scam Don't fall for this - how to protect yourself from AI scams Fake 10 Downing Street listing on Booking.com highlights security failures New Data Show How Much Worse Scams Are Getting for Americans Over 60 Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A session and user authentication Zero Trust tactic that allows a user to access multiple applications with one set of login credentials. CyberWire Glossary link: https://thecyberwire.com/glossary/single-sign-on Audio reference link: English, J., 2020. What is Single Sign-On (SSO)? SSO Benefits and Risks [Video]. YouTube. URL https://www.youtube.com/watch?v=YvHmP2WyBVY
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up, including a chicken update and a little Greek vocabulary. Dave explores new tools from FINRA designed to help investors research the markets, assess their vulnerability to financial fraud, and practice recognizing common scam tactics before real money is at stake. Joe looks at Apate, an Australian startup using AI agents to pose as potential scam victims, waste fraudsters’ time, and gather intelligence that can help researchers and security teams better understand and disrupt scams. Maria covers new approaches to cybersecurity awareness and personal cyber readiness, exploring how we can move beyond traditional awareness campaigns and help people better protect themselves online. Our Catch of the Day comes from Anthony, who received a convincing-looking scam email about his trademark application that uses publicly available information and a fake mandatory verification appointment to pressure him into calling a fraudulent number. Resources and links to stories: FINRA Launches Enhanced Investor Education and Protection Tools to Help Research Markets and Recognize Fraud Apate sends AI agents undercover to get scammed so they can gather fraud intelligence It’s Time to Rename Cybersecurity Awareness Month Cybersecurity Awareness Won’t Save You. Readiness Might. Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. An authentication process that requires two different factors before granting access. CyberWire Glossary link: https://thecyberwire.com/glossary/two-factor-authentication
This week, N2K CyberWire hosts Maria Varmazis and Joe Carrigan are joined by Kieran Human from ThreatLocker while Dave Bittner is out. Together, they discuss the latest in social engineering scams, phishing schemes, and criminal exploits making headlines. We start with some follow up on Daejon Love’s story, but we’ll save that for next week. Plus, Joe has a chicken update. Maria explores reporting that TikTok relaxed its advertising enforcement rules, coinciding with a sharp increase in scams involving fake ads for deeply discounted products that never arrive. Joe looks at Wisconsin’s efforts to curb cryptocurrency ATM scams through transaction limits, identity verification, and mandatory refunds, with early reports suggesting the restrictions are making a difference. Kieran Human covers a data breach disclosed by Revolut that exposed customers’ financial information and passport details. Our Catch of the Day comes from Rachel, who received a suspicious invitation email from a hacked contact that asked her to download and install software. Resources and links to stories: FBI searches phones, iCloud accounts of accused fake NFL player; romance scam may have gone on for 10 years TikTok Quietly Gutted Its Advertising Rules. Scams Have Exploded Ever Since. How much is Wisconsin's crypto ATM law limiting scams? Revolut discloses data breach exposing financial info, passports Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A cloud based sensitive information management system that allows users access across multiple devices. CyberWire Glossary link: https://thecyberwire.com/glossary/icloud-keychain Audio reference link: Ellen’s Tips For iOS, 2022. How To Master iCloud Keychain to Keep Your Passwords Safe and Secure [Video]. YouTube. https://www.youtube.com/watch?v=Tl3E29iUvgE
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up from Maria on ACATS fraud, including a reminder that protecting your accounts starts with the basics: strong passwords and multifactor authentication. Joe also has a follow-up inspired by 2001: A Space Odyssey and an experiment with AI. Joe covers a New York parking scam involving fake QR codes placed on parking kiosks, then takes a strange detour into Pennsylvania’s spotted lanternfly quarantine and an alleged scheme involving fake lanternfly permits. Dave looks at a fake iPhone Duo preorder scam that uses an Apple-style site and a supposed $500 voucher to deliver a DarkSword exploit to vulnerable iPhones. Maria explores new Consumer Reports research showing that 91% of Americans have encountered a digital scam or cyberattack attempt, while confidence in the privacy of personal data continues to fall. Our Catch of the Day comes from Reddit, where a spam caller appears to be on the hunt for someone named Juan. Resources and links to stories: Man charged in alleged parking QR code scam in Manhattan Quarantine and Permit Program FAQs Spotted Lanternfly Quarantine and Permitting Man sued for allegedly selling fake spotted lanternfly permits to Pennsylvania businesses Fake iPhone Duo preorder scam triggers DarkSword attack New Study by Consumer Reports reveals 9 in 10 Americans targeted by a cyberattack or digital scam attempt Spam calls looking for Juan?? Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts discuss how AI is changing cybersecurity awareness, from the risks of feeding sensitive corporate data into AI tools to the growing use of agentic AI and the importance of understanding where data goes. They explore how AI is affecting threat actors, phishing, exploit development, executive protection, and even the ways people share personal information, images, and family data with AI systems. Finally, they discuss the role of human behavior in security, arguing that organizations need layered safeguards and better awareness rather than placing the full burden of cybersecurity on individual users.
Please enjoy this encore of Word Notes. Unsolicited, unwanted, and sometimes malicious electronic messages indiscriminately transmitted to a large number of people. CyberWire Glossary link: https://thecyberwire.com/glossary/spam Audio reference link: zumpzump, 2007. Monty Python - Spam [Video]. YouTube. URL https://www.youtube.com/watch?v=anwy2MPT5RE.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up from Crowchild Bob, who questions Joe’s math from the Xinbi story—and Joe has an explanation for that billion-dollar mix-up. Dave covers a new twist on business email compromise, where scammers use AI-assisted messages, fake invoices, and fabricated email conversations to convince finance teams to make large payments. Maria explores fake desktop apps impersonating legitimate HR and payroll services, using trusted platforms and legitimate software to gain remote access to victims’ computers. Joe shares a scam story from Jay on LinkedIn. And our Catch of the Day comes from Twitter on a fake email. Resources and links to stories: Protecting organizations from AI-assisted executive impersonation and invoice fraud The Brand Was Real. The Desktop App Wasn’t. How scams unfold Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A US Department of Homeland Security agency tasked with supporting cyber and physical security for US critical infrastructure. CyberWire Glossary link: https://thecyberwire.com/glossary/cybersecurity-and-infrastructure-security-agency Audio reference link: CISA, 2021. CISA Director Jen Easterly’s Keynote at Black Hat USA 2021 [Video]. YouTube. URL https://www.youtube.com/watch?v=q7bu-L-m4K4.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up from Robert, who wonders why he’s never received a scam call in nearly 20 years of having the same Swedish phone number. Maria covers ACATS fraud, a little-known scam that can move stocks and retirement assets into fraudulent brokerage accounts without the victim realizing it. Dave shares his experience of nearly falling for a social engineering scam disguised as a podcast interview, where the scammers used convincing prep and a fake meeting link to try to get him to install malware. Joe shares the story of a Maryland woman who was nearly fooled by scammers posing as Wells Fargo and San Francisco police, using detailed personal information and threats of arrest to make the scam feel real. Our Catch of the Day comes from Reddit, where one person takes matters into their own hands after a scammer targets their daughter. Resources and links to stories: Several Big Brokerages Leave Customer Accounts Open to Theft, Senators Say Fidelity Money Transfer Lockdown: Block Fraudulent ACAT Transfer Brokerage Scams Protect Your Brokerage Accounts From ACATS Transfer Fraud Maryland woman says Wells Fargo, San Francisco police scam nearly fooled her with fake fraud case Person almost scammed my daughter so I decided to get in one fun and found their location Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. The act of searching through an organization's trash for discarded sensitive material. CyberWire Glossary link: https://thecyberwire.com/glossary/dumpster-diving Audio reference link: “Better Call Saul jimmy digs in the Sandpiper trash scene,” uploaded by Robert Bowersock, 18 September 2022.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from Gordy, who has questions about a fairground contest collecting personal information, plus an update on Joe’s backpack. Joe covers the takedown of Xinbi Guarantee, an illicit marketplace allegedly providing services to scam centers, including money laundering, fake investment sites, and other tools for fraud. Maria looks at QR-code scams and a growing wave of rental scams on TikTok, where fake listings use stolen property photos, below-market prices, and upfront fees to target prospective renters. Dave explores a report on how hundreds of ads promoting AI “nudify” tools and other abusive content were able to reach users through Meta’s advertising system. Our Catch of the Day comes from Tim, who received a suspicious board-position offer that appears to have scraped details directly from his LinkedIn profile—and somehow offered him a seat on the board of his own company. Resources and links to stories: U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto See a QR code parked somewhere? Don’t scan it…yet! 68% of TikTok rental listings carry scam warning signs Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. The manipulation of search engine optimization, SEO, to promote malicious sites in search engine results. CyberWire Glossary link: https://thecyberwire.com/glossary/search-engine-optimization-poisoning Audio reference link: Brown, B.E., 2021. The Ending Of The Waldo Moment Explained [Video]. YouTube. URL https://www.youtube.com/watch?v=HsWja44-EMg.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up on Joe’s chicken coop, which apparently looks amazing—and we may even get a little into the mechanics behind it. Dave looks at the growing scam crisis in the U.S., including how victims are often targeted a second time by recovery scammers after losing money in the first scam. Joe covers a massive identity-theft operation allegedly offering more than 153 million stolen driver’s license records for sale on the dark web, with investigators working to determine where the data came from. Maria explores a multimillion-dollar romance and investment scam in which a man allegedly posed as an NFL player, using fake identities, relationships, and phony investment accounts to defraud at least 26 women. Our Catch of the Day comes from a listener who clicked a suspicious Calendly link and lived to tell the tale. Resources and links to stories: Scams in the US are at a record high. Yet most victims get no help and some end up losing even more Microsoft Plugs Nearly 1,000 Security Holes Man Posing as San Francisco 49er Charged with Defrauding Over Two Dozen Women Out of More than $1.3 Million "It's hard to feel bad when it's as easy as just Googling it": Jason Kelce left stunned after fake 49er Daejon Love's alleged $1.3M+ romance scam Clicked on Phishing Link From “Calendly” Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. The practice of crafting a fake online persona for malicious purposes. CyberWire Glossary link: https://thecyberwire.com/glossary/catfish Audio reference link: netbunny, 2013. Catfish - The Movie - Ending Scene [Movie Scene]. YouTube. URL https://www.youtube.com/watch?v=qR_NIN6zy0U
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, Dave, Selena, and Keith explore the pros and cons of allowing select U.S. companies to conduct offensive cyber operations under strict government guardrails. They discuss what the proposed framework could mean for private-sector security researchers, how researchers have already been operating in this space for years, and where the line between defense and offense gets blurry. They also look at how adversaries such as China and Russia use proxy companies and other private-sector entities to conduct cyber operations—and consider whether giving trusted U.S. companies similar capabilities could strengthen cyber defenses or create new risks.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from Anne, who writes in to share how much she enjoys the show, how she used the “Shields Up” message with her coworkers, and—most importantly another chicken update! Maria covers a pair of MyChart scams that use fake medical results and bogus Medicare giveaways to steal credentials, personal information, and payment details. Joe looks at two scams—one targeting a business through a massive Amazon fraud scheme and another warning residents about fake invoices designed to steal their money. Dave explores the surprising value of simply replying to a wrong-number text, as scammers use responses to identify active phone numbers and find potential targets for increasingly sophisticated fraud campaigns. Our Catch of the Day promises a piece of a mysterious $25 million overpayment. All you have to do is reply with your phone number and your desired cut—what could possibly go wrong? Resources and links to stories: Health systems warn patients of MyChart phishing scam Woman sentenced after nearly $10M Amazon scam funds luxury lifestyle South Haven warns of invoice scam targeting residents Your polite reply to that text is worth $2 on the dark web Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A passwordless authentication protocol based on the FIDO2 standard. CyberWire Glossary link: https://thecyberwire.com/glossary/passkey Audio reference link: Summers, J., 2023. Google Passkeys Have Arrived (here’s how to use them) [All Things Secured Channel]. YouTube. URL https://www.youtube.com/watch?v=oFO7JgUx-bU.
This week, we’re celebrating a pretty big milestone: 400 episodes of Hacking Humans! Along the way, we’ve shared hundreds of stories, scams, lessons, and plenty of memorable Catch of the Days—and we couldn’t have made it this far without you. To everyone who has listened, written in with a story, sent us a Catch of the Day, or simply learned to be a little more suspicious of that weird text message: thank you for being part of 400 episodes of Hacking Humans. We’re glad you’re here to celebrate with us. And now, after 400 episodes, there’s really only one thing left to do: get back to the scams. This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Dave covers celebrity podcast impersonation scams, where fraudsters use personal details, convincing AI-generated personas, and fake production teams to build trust with potential guests. Maria looks at a rental scam that cost a San Francisco renter $18,600 after scammers copied a legitimate apartment listing, showed him the property, and convinced him they were the landlord. Joe discusses new research showing that younger people can be just as vulnerable to scams as older victims, particularly when they're navigating things like jobs, apartments, online shopping, and their first financial accounts. Our Catch of the Day comes from a scammer who apparently discovered the hard way that sometimes the scammer can get scammed. Resources and links to stories: Inside the Fake Celebrity Podcast Scam Fooling Hollywood They escaped south-east Asia’s scam compounds. Then they realised they were still trapped How a ‘savvy’ S.F. renter lost more than $18K in an elaborate real estate scam Jacksonville woman sues VyStar, alleges credit union failed to properly investigate $42K impersonation scam Teens targeted for scams Scammer got scammed Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
This week, while Dave is out, hosts Maria Varmazis and Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of the show Michele Kellerman. We start with some follow-up from Michele on efforts in the Philippines to crack down on online fraud centers and the ongoing fight against scam operations. Joe explores WhatsApp's new on-device scam detection feature and whether it can actually spot suspicious conversations without compromising privacy. Michele covers an elaborate jury-duty scam that kept a Florida woman on the phone for more than 10 hours, using fake law enforcement, cryptocurrency payments, and stolen personal information to steal more than $25,000. Maria looks at a new wave of back-to-school scams using fake websites, phishing attempts, and AI-generated content to target parents and students. Our Catch of the Day comes from Ami, who discovered that even paying by check isn't foolproof after a mailed check was intercepted, altered, and cashed by someone else. Resources and links to stories: Scam no more: how the Philippines is cracking down on online fraud centres with UN support WhatsApp rolls out new feature that flags potential scam messages PA man loses nearly $400K after online chess game leads to Cryptocurrency scam The ‘Jury Duty’ Scam That Cost This Family $25,000 New York back-to-school scams: Fake websites, AI ads and phishing texts to watch for Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. Definition one: The recognition of a set of repeatable attack patterns across the intrusion kill chain. Definition two: Determining the responsibility for offensive cyber operations. CyberWire Glossary link: https://thecyberwire.com/glossary/attribution Audio reference link: Nunnikhoven, M., 2018. Cybersecurity Basics #9 - Attack Attribution [Video]. YouTube. URL www.youtube.com/watch?v=rlyMz5jN_Vs
This week, while Dave is out, hosts Maria Varmazis and Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of the show Michele Kellerman. We start with some follow-up on the chicken coop, where the big news is that the chicks have officially hatched. Maria covers how AI is fueling a growing share of cybercrime in Africa as scammers use increasingly sophisticated digital tools to target victims. Michele looks at a multi-step gold bar scam targeting older New Yorkers, where criminals first compromise victims' devices and information before posing as government or law enforcement officials to steal their money. Joe breaks down the Fun Coffee crypto investment scam, which promised enormous returns before the platform suddenly shut down, leaving victims with more than HK$104 million in reported losses. Our Catch of the Day comes from Reddit, with another scam that proves if an offer sounds too good to be true, it probably comes with a very suspicious backstory. Resources and links to stories: AI fuels more than half of cybercrime in Africa as digital scams surge, INTERPOL NYPD warning: Gold bar scam targeting older New Yorkers, stealing $100 Million+ Hong Kong Fun Coffee crypto scam losses top HK$104M Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A type of cyber attack where an attacker sends a targeted and personalized email or other form of communication to a specific individual or a small group of individuals with the intention of tricking them into divulging sensitive information, such as a password, or convincing them to click a malicious link that will enable the attacker to take control of the victim's machine. CyberWire Glossary link: https://thecyberwire.com/glossary/spearphishing Audio reference link: Richardson, T., 2014. What is the difference between phishing and spear-phishing? [Video]. YouTube. URL www.youtube.com/watch?v=Wpx5IMduWX4.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up after a listener asks Joe to finally reveal the backpack that's become a recurring character on the show—and whether it's really as airport-infeding as everyone says. Joe covers Myanmar's approval of the death penalty for convicted scammers and shares a real-world fraud case involving forged Little Debbie snack deliveries that shows scams don't always happen online. Maria explores the rise in foreclosure rescue and equity-stripping scams, where fraudsters target financially vulnerable homeowners and attempt to steal their money—or even their homes. Dave breaks down new research showing how AI-powered phone farms are making it easier than ever for scammers to automate fraud, manage hundreds of fake accounts, and scale their operations with minimal technical skill. Our Catch of the Day is on a scam-baiting exchange featuring an unforgettable tale of a supposed two-timing "Barb Johnson" that quickly spirals into absurdity. Resources and links to stories: Kitchen Sink Backpack Giant Backpack Your Backpack Got Worse On Purpose Burma approves death penalty for scammers months after FBI's $8 billion crypto crackdown Little Debbie snack fraud investigation leads to arrest of West Virginia man, who allegedly forged records for deliveries that never happened As foreclosures increase, so do warnings about some self-proclaimed 'home savers' Researchers Warn of AI-Enhanced Phone Fraud Ecosystem That Twotiming B**ch Barb Johnson Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. The ability to continuously deliver the intended outcome despite adverse cyber events. CyberWire Glossary link: https://thecyberwire.com/glossary/resiliency Audio reference link: Cameron, J., 1984. The Terminator [Movie]. IMDb. URL www.imdb.com/title/tt0088247/. Clip Nation, 2012. The Arnold Schwarzenegger “I’ll Be Back” Supercut [Video]. YouTube. URL www.youtube.com/watch?v=-YEG9DgRHhA. Coops, C., 2013. Terminator 2 Theme [Video]. YouTube. URL www.youtube.com/watch?v=pVZ2NShfCE8.
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, Today, while Keith is off, Dave and Selena kick off a back-to-school special, exploring the cyber threats students, parents, educators, and universities should have on their radar. They examine the rise in job scams targeting university communities, discuss recent espionage activity aimed at higher education institutions in the U.S. and Canada, and look at how cybercriminals prey on younger audiences through online games, YouTube, and social media. From fake game cracks delivering information stealers to sextortion schemes targeting teens, they break down the tactics attackers are using and share practical advice for staying safe as the new school year begins. Sources: Job Scams Using Bioscience Lures Target Universities One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up on Joe's chicken coop project. Dave covers a new FBI warning about scammers impersonating FBI agents and the IC3 to target fraud victims a second time with convincing deepfakes, fake websites, and recovery scams. Joe shares the story of a retired man who lost £1,800 after two scammers worked together to convince him they were protecting his Amazon account from fraud. Maria breaks down a new UN report revealing that scam networks stole up to $114 billion across Asia-Pacific in 2025 and are evolving into global criminal enterprises powered by specialization and AI. Our Catch of the Day comes from a listener who blames being left unsupervised for one of the funniest scam-baiting exchanges we've seen yet. Resources and links to stories: Fake FBI Agents Use IC3 Complaint Scams to Target Fraud Victims Amazon scam was so authentic - it got the better of me Crime gangs snare more than $88 billion in scams in Asia-Pacific, UN says Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A centralized facility or team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents within an organization. CyberWire Glossary link: https://thecyberwire.com/glossary/security-operations-center Audio reference link: AT&T Tech Channel, 2012. A tour of AT&T’s Network Operations Center (1979) [Video]. YouTube. URL www.youtube.com/watch?v=cigc3hvMyWw.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up as Joe corrects the record on router end-of-support after a listener points out that manufacturers like Netgear don't intentionally disable routers when support ends, and we also share a listener-submitted business email compromise case that highlights the importance of independently verifying payment requests. Maria covers how scammers can accidentally reveal themselves by mispronouncing local place names, turning a convincing jury duty scam into an obvious fake. Joe shares how a veteran CBS News journalist who regularly reports on scams nearly fell victim to an elaborate bank impersonation scheme, showing that anyone can be targeted. Dave reflects on a listener's "Unknown Situation. Shields Up." philosophy, encouraging people to slow down and verify unexpected communications before taking action. Our Catch of the Day is on an over-the-top scam email from a self-proclaimed internet fraudster claiming to be giving away millions in a last-minute bid for forgiveness. Resources and links to stories: Anne Arundel County woman spots jury duty phone scam after caller mispronounces local names A CBS journalist who covers scams rushed to his bank to withdraw money after nearly falling for an imposter scam Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Career Notes. Defensive cyber operations carried out by U.S. Cyber Command's Cyber National Mission Force, CNMF at the request of allied nations. CyberWire Glossary link: https://thecyberwire.com/glossary/hunt-forward-operation Audio reference link: Paul Nakasone, G., 2022. Vanderbilt Summit Keynote [Video]. YouTube. URL www.youtube.com/watch?v=Axg4s9l9wi0.
This week, while Maria is out hosts Dave Bittner and Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Dave covers a phishing campaign using fake Facebook verification emails to trick users into handing over their account credentials. Joe highlights the Better Business Bureau's new Scam Tracker heat map for visualizing scam trends and discusses a global INTERPOL operation that led to thousands of arrests and hundreds of millions of dollars in seized fraudulent funds. Our Catch of the Day is on a scam-baiter who encounters a hilariously inept TikTok scam account, proving that not every scammer is a master criminal. Resources and links to stories: Phishing Attacks Targeted Facebook Users With Fake Verification Offer Heatmap Over 5,800 arrests, USD 293 million intercepted in global fraud bust These TikTok scam accounts are literally so stupid Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
The invisible force that governs the movement of data across networks. Audio reference link: “Things to Come 1936 - HG Wells.” YouTube, YouTube, 28 Sept. 2011, https://www.youtube.com/watch?v=atwfWEKz00U.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up after a listener wrote in to share their love of X Japan, joking that the show should spend less time talking about chickens and more time celebrating one of Japan’s most legendary metal bands. Joe covers how millions of compromised consumer devices are fueling massive residential proxy networks that cybercriminals and nation-state actors use to disguise malicious activity online. Dave looks at a ransomware campaign using fake INTERPOL emails to pressure victims into opening malicious attachments and infecting their systems. Maria explores whether AI-powered operating systems could one day become our first line of defense against scams by detecting social engineering attacks before users ever fall for them—and what new risks that future could bring. Our catch of the day is on an unsolicited Telegram message that quickly turns into an entertaining romance scam encounter. Resources and links to stories: X Japan - Kurenai Live 1989 (Blue Blood Tour - 爆発寸前ＧIＧ) How Hackers Found a Back Door Into the American Living Room A Sneaky Back Door Lets Hackers Into Your Home. Here’s How to Protect Yourself. 50.147.72.126 Fake Interpol investigation emails target small businesses with ransomware The Beginning of the End of Social Engineering Polish Frank part 1. He had me at the bush. Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. The ability of computers to execute tasks typically associated with human intelligence, including natural language processing, problem solving, and pattern recognition. CyberWire Glossary link: https://thecyberwire.com/glossary/ai Audio reference link: Staff, 2016. Alan Turing - The Imitation Game - Can Machines Think? [YouTube Video]. Learn Understand Create. URL www.youtube.com/watch?v=Vs7Lo5MKIws.
Please enjoy this encore of Hacking Humans. This week, our hosts Dave Bittner, Joe Carrigan, and Maria Varmazis (also host of the T-Minus Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We've got some follow-up from listener Kajetan, who recalled a run-in with a scammer in Paris posing as a mute fundraiser—and says he performed a "miracle" by crossing out his name, prompting the supposedly mute woman to suddenly start yelling at him. Maria has the story on how small businesses in Toronto, like the family-run Souvlaki Hut and Pippins Tea Company, were shocked to discover that thieves exploited vulnerabilities in their point of sale terminals to issue themselves thousands in fraudulent refunds—exposing serious flaws in how these machines are secured. Dave's story is on a Stanford-led study that found popular AI therapy bots, including ChatGPT and commercial mental health platforms, often respond inappropriately to serious mental health issues—fueling delusions, validating harmful thoughts, and failing to follow basic therapeutic guidelines—raising urgent concerns about their use as replacements for human therapists. Joe follows the story on a sweeping federal investigation into Minnesota's Housing Stabilization Services program, where agents raided homes and businesses tied to an alleged multi-million-dollar Medicaid fraud scheme that exploited vulnerable residents and billed taxpayers for housing support services that were never provided. Our catch of the day is on a patient scammer who spent five months building trust before claiming to send a $700K inheritance payout locked in a lawsuit—complete with a fake video of a safe and a shady tracking number—only to demand €15,000 in "customs fees," a scam the Redditor thankfully saw through before handing over any money. Complete our annual audience survey before August 31. Resources and links to stories: AI therapy bots fuel delusions and give dangerous advice, Stanford study finds ‘It was a shock’: Toronto business owner says customer used point of sale terminal to issue himself $2,000 refund KARE 11 Investigates: Federal agents raid homes & businesses seizing evidence in housing fraud investigation Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A credential demonstrating an individual's knowledge in the field of cybersecurity, usually obtained by passing an exam or series of exams. CyberWire Glossary link: https://thecyberwire.com/glossary/certification Audio reference link: Bombal, D., 2022. Are certifications important in Cybersecurity? [Video]. YouTube. URL www.youtube.com/watch?v=Zdgf_Wr82rs.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up on an editorial examining whether AI could signal the beginning of the end for traditional social engineering, as attackers increasingly target AI systems instead of people. Dave's got the story on an FBI warning that crypto scammers are using cash couriers to collect money from victims and bypass banking safeguards. Maria's got the story on AI-powered impersonators posing as members of the rock band Sons of Legion to scam fans through fake relationships and fraudulent requests for money. Joe's got two stories: one on HSBC Australia facing a proposed $246 million penalty over alleged scam protection failures, and another on two Michigan gold scam busts that prevented victims from losing hundreds of thousands of dollars. Our catch of the day is a reflection on a past interaction where the author initially held out hope someone might reappear, but ultimately accepts they’re gone and shares the story in hindsight, including their own strongly emotional reaction at the time. Resources and links to stories: The Beginning of the End of Social Engineering FBI Warns Courier Cash Pickups Are Driving Crypto Scams A Rock Band Went Viral. Then AI Scammers Moved In HSBC's Australia unit to pay $24.6 million fine over scam protection failures, court rules A Couple Was Told To Turn $250,000 Into Gold. Police Stopped The Courier Scam Video: Deputies nab suspect in attempted $700,000 gold coin scam Eric - failed bait because I'm such a b**ch - part 1 Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A technique used to create virtual networks within a shared physical network infrastructure. CyberWire Glossary link: https://thecyberwire.com/glossary/network-slicing Audio reference link: Whitehead, D.N., 2021. 5G Smart Networks Part 1: Network Slicing [Video]. YouTube. URL www.youtube.com/watch?v=dCt3rYODZ7g.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. This week, we have follow up on a listener-submitted trick for diverting unwanted calls to a different number, including the famous Rickroll hotline, along with a discussion about whether Joe should launch a podcast dedicated entirely to the trials and tribulations of raising backyard chickens. Maria has the story of a journalist who infiltrated a sophisticated North Korean hiring scam that uses fake job interviews, real freelance recruiters, and malware-laced coding tests to steal passwords and cryptocurrency. Dave’s got a viral gas station scam warning involving screws placed in fuel pumps, and why investigators found no evidence that the alleged scheme is actually happening. Joe’s first story is on a new Maryland law that gives banks and credit unions the authority to temporarily pause suspicious transactions in an effort to better protect customers from fraud and financial exploitation. On this week's Catch of the Day, a scammer serves up a blood-curdling tale involving "Dr. Prince Andrew" and a very questionable beverage choice. Resources and links to stories: I Made The World's First Self-Cooling Clothes Cools Surfaces Up To 15°F Below The Air Temperature I got inside a North Korean hiring scam. What I found reveals a troubling shift in tactics Gas pump 'screw method' scam warning is a hoax Maryland law gives banks and credit unions power to pause suspicious transactions Longevity Ready Maryland, Fraud Protections, Support for Caregivers Among Wins for Older Marylanders Dr. Prince Andrew admits to drinking blood "occasionally" Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
The process of verifying that a device is known, secure, and uncompromised before allowing it to connect to a network or access resources. CyberWire Glossary link: https://thecyberwire.com/glossary/device-trust Audio reference link: “Favorite Scene of Alan Rickman from Die Hard.” YouTube, YouTube, 14 Jan. 2016, https://www.youtube.com/watch?v=mklnXM3LIXo.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. This week's follow-up stories involve a puppy scam, a memorable road trip, fresh eggs, chickens, and an unexpected rat encounter. Joe examines two cases highlighting the real-world financial impact of fraud, including a vendor payment scam that cost a Maine town nearly $190,000 and a report on growing state-level fraud losses. Maria discusses a highly targeted espionage campaign that maintained access to a stock exchange executive's Outlook account, while quietly exfiltrating sensitive information. Dave explores how criminals are using AI-generated deepfakes of executives to convince employees to authorize fraudulent payments. Our Catch of the Day comes from listener Piet-Auke Boekema, who uncovered a LinkedIn scammer offering to sell cybersecurity certifications without requiring the exams. Resources and links to stories: Residents of Arizona, Nevada and Hawaii lost the most to fraud schemes. How other states compare Harpswell loses $189,199 to vendor payment scam Espionage Campaign Targeted Stock Exchange Executive for Five Months The Deepfake Boss Scam: How to Verify Requests Before It's Too Late Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Please enjoy this encore of Word Notes. A technology set design to support the cybersecurity first principle strategy of zero trust, that limits device people and software component access to only designated authorized resources and nothing more. CyberWire Glossary link: https://thecyberwire.com/glossary/zero-trust-network-access Audio reference link: “Zero Trust Explained by John Kindervag.” YouTube, YouTube, 2 Oct. 2022, https://www.youtube.com/watch?v=-LZe4Vn-eEo.
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. They’re also joined by special guest Kieran Human, Lead Cybersecurity Engineer at ThreatLocker . Dave’s story is on an FBI warning that the Silent Ransom Group is escalating its extortion tactics by combining phishing and fake IT support calls with in-person visits, where attackers may physically enter offices to plug malicious devices into company computers. Joe’s story is on a listener-submitted case from Australia where attackers used a phishing email to silently install legitimate remote-access software, hijack a dental practice’s email system, and launch a large-scale phishing campaign that bypassed many traditional security controls. Maria’s story is on a California mother who lost $5,000 after scammers used what appeared to be her daughter’s voice in a fake kidnapping call, highlighting the growing threat of AI-powered voice cloning scams. Our Catch of the Day comes from a text scam that took an unexpected turn when the recipient fired back with a response the scammer definitely wasn't prepared for. Resources and links to stories: FBI warns of in-person data theft attacks from extortion gang California Mom Loses More Than $5,000 in Voice Scam After Receiving Fake Call from Her Daughter Alleging She Was Kidnapped Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
A data privacy legal framework that applies to all countries in the European Union, regulating the transmission, storage, and use of personal data associated with residents of the EU. CyberWire Glossary link: https://thecyberwire.com/glossary/general-data-protection-regulation Audio reference link: “Mr. Robot Predicts JPM Coin!” YouTube, YouTube, 14 Feb. 2019, https://www.youtube.com/watch?v=1ee-cHbCI0s.
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts dive into the evolving threat of software supply chain attacks and the growing risks facing the open-source ecosystem. As developers increasingly rely on third-party packages and AI-powered coding tools, attackers are finding new ways to abuse trusted software to reach a wider range of targets. The discussion explores why these attacks are becoming more common, what recent incidents reveal about the state of software security, and what organizations can do to better protect themselves. Sources: Shai-Hulud worm returns stronger and more automated than ever before ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up on Joe’s rental scam story, as listener Ben suggests the scammers may go the extra mile because they could keep collecting rent for months before anyone realizes the property was never theirs to rent out. Also, another listener writes in with some “Chook Psychology 101." Maria’s story is on scammers targeting recent college graduates with fake student loan relief offers, job scams, and rental listings designed to steal personal information, deposits, and money through high-pressure tactics. Joe’s story is on Congress pressuring major telecom companies to do more to stop the flood of scam calls and texts still reaching Americans despite billions already being blocked every year. Dave’s story is on Android 17 adding new protections aimed at stopping banking scams, including stronger privacy controls and defenses against malicious calls during sensitive actions. Our Catch of the Day is on a text scam where scammers use scare tactics by sending fake messages about court dates and legal trouble. Resources and links to stories: BBB warns of scams targeting new graduates Congressional committee asks telecoms to do more to prevent scams as losses surge Android 17 to expand banking scam call and privacy protections Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.