Hacking Humans

When a scammer meets the Force.

This week, while ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/varmazis/] (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://space.n2k.com/podcasts/t-minus?__hstc=223811332.a636bba53840b4700c929fe67723a129.1721054632698.1747145009569.1747159962459.413&__hssc=223811332.2.1747159962459&__hsfp=3690629108] Space Daily show) is out, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/dave-bittner-27231a4/] ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/dave-bittner-27231a4/] and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/joecarrigan/] are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Joe starts us off with a chicken update. Joe’s story is on CrowdStrike’s 2025 Global Threat Report, which reveals faster-than-ever breakout times, a surge in vishing and initial access attacks, widespread abuse of valid accounts, and a growing shift toward malware-free intrusions as adversaries become more numerous and sophisticated. Dave’s got the story on how “pig-butchering” romance scams are industrialized, detailing Reuters’ reporting on cyberfraud gangs using step-by-step psychological playbooks to groom victims, manufacture emotional attachment, and rapidly funnel them into fake investments that leave lasting financial and emotional damage. Rishika Desai [https://www.linkedin.com/in/rishika-d-61a765159/], Threat Researcher and Writer from Bfore.ai [https://www.linkedin.com/company/bforeai/], joins Dave and Joe to discuss renting social media ad accounts for scamming purposes. Our catch of the day comes from Reddit, where one user channels their inner Jedi and uses the Force to send a pesky scammer retreating to the dark side. Resources and links to stories: * ⁠ [https://www.jec.senate.gov/public/_cache/files/c1717fa4-9ab4-444e-b6f6-0e9000bfccea/12.2025-holiday-travel-scams-alert.pdf]A scammer’sblueprint [https://www.reuters.com/graphics/SOUTHEASTASIA-SCAMS/MANUALS/klpyjlqelvg/?utm_source=Sailthru&utm_medium=Newsletter&utm_campaign=Daily-Briefing&utm_term=010826&lctg=64493bdb2c0862838c0ad236] * CROWDSTRIKE 2025 GLOBAL THREAT REPORT [https://go.crowdstrike.com/2025-global-threat-report.html] ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://therecord.media/fin6-recruitment-scam-malware-campaign]⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://therecord.media/fin6-recruitment-scam-malware-campaign]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [hackinghumans@n2k.com].

MFA prompt bombing (noun) [Word Notes]

Please enjoy this encore of Word Notes. Hackers bypass, multifactor authentication schemes by sending a blizzard of spamming login attempts until the accounts owner accepts the MFA prompt out of desperation to make the spamming stop.  CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/mfa-prompt-bombing⁠ [https://thecyberwire.com/glossary/mfa-prompt-bombing] Audio reference link: movieclips. “⁠Sneakers (2/9) Movie Clip - Defeating the Keypad (1992) HD.⁠ [https://www.youtube.com/watch?v=oG5vsPJ5Tos]” YouTube, YouTube, 29 May 2011, https://www.youtube.com/watch?v=oG5vsPJ5Tos.

It's just too good to be true.

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/dave-bittner-27231a4/] ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/dave-bittner-27231a4/], ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/joecarrigan/], and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/varmazis/] (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://space.n2k.com/podcasts/t-minus?__hstc=223811332.a636bba53840b4700c929fe67723a129.1721054632698.1747145009569.1747159962459.413&__hssc=223811332.2.1747159962459&__hsfp=3690629108] Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up on a big honor for Dave, recognized by SANS as a Difference Maker in Media—plus a quick chicken update, a newly named rooster, and construction officially getting underway on the new run. Maria has the story on a congressional warning about a surge in winter holiday travel scams, as fake booking sites and airline impersonators drive millions in losses during peak travel season. Dave has two stories this week, one on a friend who received a suspicious email appearing to come from the chair of a nonprofit, and the other on a BBC investigation uncovering how fraudulent crowdfunding campaigns exploited children with cancer and their families, siphoning off millions meant for life-saving treatment. Joe’s story covers a warning from the IRS on how to spot and avoid tax scams, highlighting red flags like too-good-to-be-true refunds, urgent threats, fake websites, and impersonators pressuring victims for money or personal information. For our Catch of the Day, it turns out Aquaman isn’t just ruling the seas — he’s apparently sliding into fans’ texts, proving once again that when a celebrity starts sounding a little too approachable, it’s probably not Hollywood calling. Resources and links to stories: * ALERT: Winter Holidays Travel Scams [https://www.jec.senate.gov/public/_cache/files/c1717fa4-9ab4-444e-b6f6-0e9000bfccea/12.2025-holiday-travel-scams-alert.pdf] * Children with cancer scammed out of millions fundraised for their treatment, BBC finds [https://www.bbc.com/news/articles/ckgz318y8elo] * Recognize tax scams and fraud [https://www.irs.gov/help/tax-scams/recognize-tax-scams-and-fraud] * How to know it's the IRS [https://www.irs.gov/help/how-to-know-its-the-irs] ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://therecord.media/fin6-recruitment-scam-malware-campaign]⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [https://therecord.media/fin6-recruitment-scam-malware-campaign]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ [hackinghumans@n2k.com].

Apple Lockdown Mode (noun) [Word Notes]

Please enjoy this encore of Word Notes. An optional security mode for macOS and iOS that reduces the attack surface of the operating system by disabling certain commonly attacked features.  CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/apple-lockdown-mode⁠ [https://thecyberwire.com/glossary/apple-lockdown-mode] Audio reference link: “⁠How NSO Group’s Pegasus Spyware Was Found on Jamal Khashoggi’s Fiancée’s Phone⁠ [https://www.youtube.com/watch?v=a2BIYWHdfTE],” FRONTLINE, YouTube, 18 July 2021.

Poisoned at the source. [OMITB]

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/selenalarson/], ⁠⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠⁠ [https://www.proofpoint.com/] intelligence analyst and host of their podcast ⁠⁠⁠⁠⁠DISCARDED⁠⁠⁠⁠⁠ [https://www.proofpoint.com/us/podcasts/discarded]. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts ⁠⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠⁠ [https://www.n2k.com/] ⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠ [https://www.linkedin.com/in/dave-bittner-27231a4/] and ⁠⁠⁠⁠Keith Mularski⁠⁠⁠⁠ [https://www.linkedin.com/in/keith-mularski-b737551/], former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠⁠Qintel⁠⁠⁠⁠ [https://www.linkedin.com/company/qintel/]. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we dive into supply chain attacks through the lens of a massive Android malware campaign that infects devices before they ever reach users, embedding itself in firmware and reseller-installed system images. We connect the dots to other high-impact supply chain incidents—from SolarWinds to the recent F5 breach—and share new intelligence on Android devices compromised during manufacturing and distribution in China. Together, these cases highlight how attacks at the source can quietly scale, persist, and evade traditional defenses.