Lauro Perez

Scattered Spider — a financially motivated group of young English-speaking hackers operating as a BlackCat/ALPHV affiliate — hit both MGM Resorts and Caesars Entertainment using social engineering and SIM swapping rather than zero-days. Caesars paid a $15 million ransom and recovered quickly; MGM refused, suffered 10 days of casino and hotel downtime, and was publicly recruiting Linux admins at $110/hour to rebuild its entire IT infrastructure from scratch.

Stories Covered

MGM vs. Caesars: Two Different Ransomware Responses, Two Very Different Outcomes

Both MGM Resorts and Caesars Entertainment were breached by the same threat actor group — Scattered Spider, also tracked as Roasted Octopus — operating as an affiliate of the BlackCat (ALPHV) ransomware platform. The two organizations responded in opposite ways. Caesars quickly negotiated and paid approximately $15 million to the ransomware group, described as roughly 0.1% of the company’s prior year revenue — an amount small enough that it would not have appeared material in an earnings call under other circumstances. Caesars recovered in relatively short order and resumed operations. MGM refused to pay, and the consequences were extensive: slot machines, ATMs, credit card machines, the MGM Rewards app, all brand websites, the check-in system, and digital room key systems were completely inoperable for most of 10 days. MGM publicly posted a job listing seeking a Red Hat Linux system administrator willing to work 10 hours per day, seven days a week at $110 per hour to rebuild its entire IT environment from the ground up. A post on social media described the situation for MGM employees as materially worse than publicly reported: no access to schedules, PTO hours, 401(k) information, timecard data, or attendance records, with employee Social Security numbers and bank information potentially compromised and minimal communication from management.

The pay-versus-recover debate has no clean answer. Paying transfers money to criminals, signals that you will pay, and puts a larger target on your back for future attacks — threat actors share information about which victims paid and how much. Not paying results in exactly what MGM experienced: extended operational disruption, revenue loss, employee data exposure, reputational damage, and the cost of rebuilding infrastructure that may exceed the ransom itself. The MGM outcome also produced a reported physical security failure: as the digital room key system went offline, the physical key fallback produced a situation where some keys were opening multiple rooms and elevator access across floors was improperly granted to guests, creating a physical security incident on top of the cyber incident. The correct organizational preparation is neither “we’ll pay” nor “we’ll refuse” as a policy — it is having sufficient offline backups and documented recovery procedures that the rebuild timeline is days rather than weeks, which removes most of the leverage the ransomware group holds.

Scattered Spider: Social Engineering and SIM Swapping, Not Zero-Days

CrowdStrike first reported on Scattered Spider in December 2022. The group is notable for what it does not do: it does not develop proprietary malware, it does not use zero-day vulnerabilities, and it does not rely on highly technical exploitation. Instead, Scattered Spider’s attacks consistently begin with one of three social engineering vectors: SMS phishing to harvest credentials, voice phishing calls to convince targets to hand over credentials or install remote access software, or SIM swapping to seize control of a target’s phone number and use it to bypass SMS-based two-factor authentication. Once inside a network, the group uses legitimate remote management tools — the same software that IT administrators use for remote access — rather than custom implants, which makes their presence harder to distinguish from normal administrative activity in network logs. For the MGM and Caesars attacks, the specific entry vector reported was a help desk social engineering call: attackers impersonated employees and convinced IT support to reset credentials, gaining initial access through the front door.

The broader implication is that the most sophisticated technical defenses in the world do not protect against a threat actor whose entire model is getting a help desk employee to reset credentials over the phone. Multi-factor authentication fatigue attacks — where the attacker repeatedly pushes MFA approval requests to the victim’s device until they approve one accidentally or out of annoyance — defeat SMS-based and push notification MFA. The defenses that matter against this specific attack model are: mandatory phishing-resistant MFA (hardware keys or passkeys, not SMS), strict identity verification protocols for help desk credential resets that cannot be bypassed by voice calls alone, and network segmentation so that initial access via a help desk account does not provide direct pathways to operational systems or ransomware deployment vectors. Scattered Spider is financially motivated and English-speaking, which makes their social engineering attacks particularly effective against English-speaking organizations where callers do not trigger immediate suspicion. The technical sophistication of the attack — minimal — is not a defense. The human vulnerability they exploit is reliable regardless of the perimeter controls surrounding it.

Listen to the Episode

Galina Timchenko, an award-winning Russian investigative journalist and co-founder of the independent news outlet Medusa, was infected with Pegasus spyware via a zero-click exploit called “Pwn Your Home” — requiring no action whatsoever from the target — giving the attacker complete access to her device including corporate passwords, staff identities, and the names of sources living inside Russia.

Stories Covered

Pegasus Zero-Click Exploit Targets Exiled Russian Journalist: How Pwn Your Home Works

Galina Timchenko, co-founder and chief executive of Medusa — a Russian-language investigative journalism outlet operating in exile from Riga, Latvia — received an Apple threat notification on June 22nd alerting her that her iPhone was likely targeted by a state-sponsored attack. Apple introduced these threat notifications specifically to warn high-risk individuals — journalists, dissidents, human rights workers — that their devices may be individually targeted. Timchenko reached out to Citizen Lab at the University of Toronto and Access Now, a human rights nonprofit with digital security expertise. Their forensic investigation confirmed that her device had been compromised using Pegasus spyware, delivered via a zero-click exploit named Pwn Your Home. The exploit chains together vulnerabilities in two iOS components: Apple’s HomeKit smart home functionality and the iMessage messaging process. The attack requires no interaction from the victim — no link to click, no file to open, nothing to trigger. A specially crafted payload delivered over iMessage breaches the device sandbox and installs Pegasus without the target ever knowing the attack occurred. Citizen Lab had previously attributed Pwn Your Home, along with two related zero-click exploit chains (Find My Pwn and Latent Image), to NSO Group clients who used them against target iPhones in 2022.

Once installed, Pegasus functions as a comprehensive remote access tool: it can access everything on the device that its operator wants. Medusa reported that the compromise on Timchenko’s phone likely exposed corporate passwords, internal correspondence, names of Medusa staff, bank account details, and — most critically — the identities of sources and collaborators living inside Russia. For a news organization with sources in an authoritarian country, that last category represents a potential physical threat to the people involved. Zero-click exploits in this category are not cheap or accessible: effective, unpatched zero-click vulnerabilities for iOS trade for millions of dollars on private markets. The NSO Group sells Pegasus to government agencies under contracts that restrict its use to law enforcement purposes, but a 2021 leak of an NSO client target database containing more than 50,000 phone numbers included 180 journalists across countries including India, Hungary, and Mexico, as well as human rights activists, lawyers, union leaders, and politicians. The tool designed for catching criminals has a documented pattern of being used against people exercising speech and press freedoms.

In the same reporting period, Citizen Lab also disclosed BlastPass — a separate chain of two iOS 16.6 zero-click vulnerabilities that were being actively exploited to deliver Pegasus without any user interaction. Apple patched BlastPass and urged immediate device updates. The consistent message from every Pegasus disclosure is the same: the most effective mitigation is keeping iOS fully updated, because zero-click exploits by definition require an unpatched vulnerability to function. Once patched, the specific exploit chain is closed — attackers must find or purchase a new one. The Lockdown Mode feature Apple introduced in iOS 16 provides additional hardening specifically designed for high-risk individuals; Citizen Lab has found it effective at blocking known Pegasus delivery chains. For journalists, activists, and others in professions that attract state-sponsored surveillance interest, Lockdown Mode combined with current iOS updates represents the most accessible defense against this category of attack.

Listen to the Episode

A new Python-rewritten variant of the Chaes banking malware — dubbed Chae$4 — was delivered through 800 compromised WordPress websites using fake Java and antivirus download prompts, deploying a modular attack framework that steals banking credentials, crypto wallet data, browser cookies, and payment transfers from Latin American financial platforms.

Stories Covered

Chae$4: Rewritten Python Chaes Malware Hits Banking and Logistics via 800 Compromised WordPress Sites

The Chaes banking malware, first identified in 2020 targeting e-commerce customers in Latin America (particularly Brazil), underwent a major architectural overhaul in its latest variant, internally referred to as Chae$4. Morphosec researchers shared technical analysis with The Hacker News documenting the key changes: the malware was rewritten entirely in Python, switching from a compiled binary to an interpreted language packaged as a Windows executable. The significance of the Python rewrite is detection evasion — traditional antivirus and endpoint detection products have more mature signature and behavioral detection for malware written in C, C++, and Visual Basic than for Python-compiled executables, and Chaes operators appear to have made the switch specifically to reduce detection rates. The same evasion rationale has been observed in Go-based and Rust-based malware, where the relative novelty of the language in the malware ecosystem means fewer samples exist for detection engines to train on.

Delivery relies on 800 compromised WordPress websites. When a victim visits one of these hijacked sites, a pop-up prompt appears claiming the visitor needs to install a Java runtime update or an antivirus solution to continue. Users who comply download a malicious MSI installer file that installs Chase Core — the primary orchestrator module. Chase Core does not directly execute the malicious payload; it establishes a WebSocket connection to the attacker’s command-and-control server and downloads additional specialized modules on demand. This modular architecture separates the delivery mechanism from the payload, allowing attackers to update individual components and reducing the likelihood that any single detection catches the entire operation at once. Persistence is maintained through a Windows scheduled task that runs continuously, with WebSocket-based C2 communication keeping the implant in a loop awaiting further instructions. The Cronod stealer module goes further, modifying browser shortcut files so that launching Chrome or Firefox actually runs the Cronod module first, which then connects to the browser instance via the Chrome DevTools Protocol to intercept activity from inside the browser itself.

The modular payload suite covers the full range of financial data on a victim machine. The Cronod module steals web browser login credentials and intercepts Bitcoin, Ethereum, and PIX payment transfers in transit. The Apita module targets the Itaú Unibanco desktop banking application specifically. The Kratos module extracts data from MercadoLibre, MercadoPago, and WhatsApp. The Stealer module harvests credit card data, cookies, autofill information, and session tokens from web browsers — a valid session cookie allows an attacker to log in as the victim without needing the password. The File Uploader module extracts data from the MetaMask browser extension, targeting cryptocurrency held in browser-based wallets. The attack surface Chae$4 covers is comprehensive: anyone who does online banking, holds cryptocurrency in browser extensions or exchange accounts, or uses financial platforms prevalent in Latin America is within scope. The delivery mechanism — fake update prompts on compromised legitimate websites — exploits the same instinct that security awareness training tries to reinforce for email phishing, but applied to websites that may appear entirely credible because they were once legitimate. The defense is the same as it has always been: do not install software prompted by a website pop-up, regardless of what urgency the message conveys.

Listen to the Episode

X (formerly Twitter) quietly updated its privacy policy to collect biometric data including fingerprints and facial imagery from premium users with no stated retention limit, while the UK’s National Cyber Security Centre published a warning that prompt injection attacks against large language models may be an inherent flaw with no surefire fix.

Stories Covered

X’s Biometric Data Collection: Fingerprints, Face Scans, and AI Training Without a Retention Policy

X updated its privacy policy to allow the platform to collect biometric data — including fingerprints and facial imagery — from premium users. The company told Bloomberg the change is intended to combat fraud and impersonation by offering an optional identity verification pathway where users submit a government ID alongside a photo for biometric matching. The stated rationale is platform security: if a verified identity is matched biometrically, it becomes harder for someone to impersonate that account. What the policy change does not include is any stated retention limit for the biometric data collected. The data could be retained for 90 days, a year, or indefinitely — the policy does not specify, which means users agreeing to the verification process have no contractual assurance about what happens to their biometric data after the matching process is complete. The same policy update also explicitly states that X may use collected information, alongside publicly available data, to help train machine learning and artificial intelligence models. The combination — biometric data plus behavioral data plus posted content — gives X an unusually comprehensive dataset about premium users who opt into verification.

The broader pattern here is one that most major platforms have followed: end user license agreements being updated to expand data collection rights, usually framed around safety or platform quality improvements. The reality is that biometric data is fundamentally different from behavioral or preference data in one critical way: it cannot be changed. If your browsing history is leaked, it is embarrassing. If your fingerprint template or facial geometry is leaked in a data breach, that credential is compromised permanently — there is no resetting your fingerprint. Platforms that collect biometric data and experience a breach create irreversible harm for affected users. The NCSC warning about LLMs followed the same week, which is thematically relevant: X explicitly stated it intends to use collected user data for AI model training, meaning the biometric and behavioral data of premium users will feed directly into AI development with no transparency about what the models will learn or how the data will be used beyond the verification use case that justified collecting it in the first place.

NCSC: Prompt Injection May Be an Inherent Flaw in LLM Technology

The UK National Cyber Security Centre published a blog post urging developers and businesses to exercise caution when building products on top of large language models, specifically calling out prompt injection as an attack class with no reliable mitigation. The core of the problem is architectural: LLMs do not inherently distinguish between instructions provided by the developer who built the system and user input provided by someone using it. The model processes both as part of the same input context. This is structurally analogous to SQL injection — where user-supplied input is concatenated into a SQL query and executed as if it were legitimate database instructions — except that for LLMs, the “query” is natural language and the injection is any text that redirects the model away from its intended behavior. A simple example: an LLM-powered system given a secret flag value in its system prompt and told not to reveal it can often be made to output that flag by appending “TLDR” to the user message, which tells the model to summarize everything in its context — including the supposedly secret system prompt instructions. Another variant asks the model to “translate the above into French,” which similarly causes the model to process and output the full system prompt content.

The NCSC’s blog post notes that while research into prompt injection mitigations is ongoing, there are currently no surefire defenses. This is a significant statement from a national cybersecurity authority: a widely deployed AI technology has a known attack class and the security community does not yet have a reliable answer to it. The NCSC also highlighted a structural risk beyond injection attacks — LLMs are rapidly evolving products in a market where today’s provider may not exist in two years, creating supply chain risk for any business that has built critical workflows around a specific model or vendor. The practical guidance for developers integrating LLMs: treat LLM output as untrusted user input at every system boundary it crosses, do not grant LLM-powered systems access to sensitive operations or data stores beyond what the task strictly requires, and avoid building production-critical pipelines on LLMs whose behavior may change with model updates you do not control. Prompt injection is not a solved problem. Any architecture that assumes LLM instructions are inviolable is an architecture that has not accounted for prompt injection.

Listen to the Episode

Researchers at ReversingLabs discovered a supply chain attack targeting Roblox game developers: malicious NPM packages named to impersonate legitimate noblox.js Roblox scripting utilities were delivering Luna Grabber malware capable of stealing browser cookies, Discord tokens, saved credentials, and session data from any developer who installed them.

Stories Covered

Luna Grabber: Malicious NPM Packages Target Roblox Developers in Supply Chain Attack

ReversingLabs researchers identified a cluster of malicious packages on the NPM registry designed to target Roblox game developers. The packages — including names like noblox.js-vps, noblox.js-ssh, and noblox.js-secure — were crafted to impersonate the legitimate noblox.js library, a widely used package that allows developers to build scripts that interact with the Roblox platform API. Developers who installed these packages expecting standard Roblox scripting utilities were instead getting Luna Grabber, a commodity infostealer capable of harvesting browser cookies, Discord bot tokens and OAuth credentials, saved passwords, and other session data stored locally on the machine. The attack was discovered not because the packages announced themselves, but because researchers noticed them performing operations completely inconsistent with their stated purpose — executing command-line instructions, enumerating files, and collecting system user information when they should have been doing nothing more than wrapping Roblox API calls.

This is a supply chain attack in the most straightforward sense: rather than compromising Roblox directly or exploiting a vulnerability in legitimate software, the attackers inserted themselves into the trust relationship between developers and the package ecosystem they rely on. NPM hosts millions of packages and developers regularly pull in dependencies without auditing source code — a million-line open source package is not going to get read line by line regardless of how careful the developer is. The attackers exploited that trust gap by naming packages to resemble legitimate ones and placing them in the same registry. Once a developer installs the package and it runs on their development machine, the grabber has access to everything stored locally: Discord server admin credentials could expose entire communities, browser cookies could provide session access to financial and development accounts without requiring passwords, and compromised Roblox developer credentials could affect the players of any games that developer maintains.

The supply chain attack vector is becoming more prevalent precisely because it scales well for attackers: one convincing malicious package can infect every developer who installs it, and the secondary blast radius includes every user or community downstream of those developers. The log4j vulnerability — not itself a supply chain attack but an illustration of how ubiquitous a widely-adopted package becomes — demonstrated that the software industry’s reliance on shared dependencies creates systemic exposure. When the dependency is deliberately malicious rather than accidentally vulnerable, the attack is targeted and immediate rather than requiring exploitation. For developers: audit packages before installing, check download counts and publish dates against the legitimate package you intend to install, and watch for packages with names that are close variations of well-known ones. For Roblox developers specifically: check your installed NPM packages against known-good versions, rotate any Discord tokens or credentials that may have been accessible on affected machines, and treat any machine that ran one of these packages as potentially compromised until verified otherwise.

Listen to the Episode

This week: a deserialization flaw in popular Minecraft mods enables remote code execution on servers and clients, Russian APT Blue Charlie swaps to 94 new phishing domains after its infrastructure was exposed, Google’s AI-powered fuzzing adds up to 31% more code coverage to open source security testing, and a new macOS infostealer disguised as a productivity app is selling on underground markets for $199 per month.

Stories Covered

Bleeding Pipe: Minecraft Mod Deserialization Flaw Enables Remote Code Execution

Researchers at Malwarebytes Labs disclosed a vulnerability dubbed Bleeding Pipe affecting a range of popular Minecraft mods built on top of the Java deserialization class used to exchange network packets between clients and servers. The flaw allows a remote attacker to send a specially crafted network payload to a vulnerable server, gaining remote code execution on the server — and potentially on connected clients as well. Affected mods identified by MMPA include EnderCore, Gatomancy, Logistics Pipes (versions older than 0.10.0.71), and others. The vulnerability had already been actively exploited by late July 2023 before the public disclosure. MMPA released a protective mod called Pipe Blocker that filters network traffic at the vulnerable deserialization entry points, providing a mitigation for server operators who cannot immediately update all affected mods. The core issue is architectural: deserialization allows data to control code execution flow, and when user-supplied network data reaches a deserialization routine without proper validation, it becomes a remote code execution vector — a pattern that has appeared repeatedly across Java frameworks for years. For anyone running a Minecraft modded server or playing on one: update affected mods immediately, install Pipe Blocker as an interim defense, and be aware that exploitation was already happening before the patch was widely distributed.

Russian APT Blue Charlie Rebuilds Infrastructure With 94 New Domains After Exposure

Recorded Future researchers detailed an infrastructure pivot by Blue Charlie, a Russian espionage APT active since approximately 2017 that also operates under the names Callisto, Star Blizzard, Cyborgium, and Coal Driver. The group targets governments, defense organizations, education institutions, political organizations, journalists, NGOs, and think tanks — the profile of an intelligence collection operation focused on information that can be weaponized through leak campaigns. After researchers publicly mapped Blue Charlie’s campaign and attributed specific actors involved in its operations, the group abandoned its previous domain infrastructure and shifted to 94 new phishing domains. Blue Charlie’s previous preferred technique involved the EvilGinx framework: appending a phishing domain with a path that mirrors a legitimate-looking URL — so a phishing link might look like http://phishingdomain.com/.sso.legitimate.gov, where the victim sees the SSO reference and assumes they are at an institutional login page when the controlling domain is entirely attacker-owned. The new domains drop the legitimate URL appending and instead combine two generic IT-sounding terms — something like storage-gateway.com — which makes them slightly less immediately convincing but harder to detect via pattern matching against known-legitimate domain strings. The infrastructure change is routine for mature APT groups: exposure does not neutralize the threat, it triggers a rebuild and a shift in tradecraft while the underlying capability and mission continue.

Google AI Fuzzing: LLMs Add Up to 31% More Code Coverage to Open Source Security Testing

Google published results from experiments applying large language models to OSS-Fuzz, its continuous fuzzing service for open source projects that has run since 2016 and has found and verified fixes for over 10,000 vulnerabilities across more than 1,000 open source projects. The core limitation OSS-Fuzz faces is coverage: estimated at roughly 30% of a typical project’s total codebase. Increasing coverage requires adding more fuzz targets — entry points the fuzzer can probe with malformed inputs — which traditionally requires manual work by the developers who maintain the project. Google’s experiments prompted LLMs to automatically generate additional fuzz targets for existing projects. After iterating on prompting strategies, they achieved 1.5% to 31% additional code coverage across tested projects with no manual developer intervention required. The significance is that vulnerability discovery through fuzzing has historically been bottlenecked by the effort required to expand coverage: each new fuzz target requires a developer who understands the codebase to define appropriate entry points and input structures. LLMs can draft those targets from existing code context, removing the manual labor bottleneck. Google’s stated long-term goals include extending OSS-Fuzz LLM assistance beyond C and C++ to Java and Python, and automating the project onboarding process so smaller open source projects without dedicated security resources can take advantage of continuous fuzzing without the upfront engineering investment.

XLoader macOS Malware Hides as OfficeNote, Sold as Malware-as-a-Service for $199/Month

SentinelOne researchers identified a new macOS variant of XLoader — previously known as FormBook, a keylogger and infostealer distributed as malware-as-a-service — bundled inside an Apple disk image file named officenote.dmg and signed with a developer certificate. The malware presents itself as OfficeNote, a productivity application. The previous macOS variant of XLoader required a Java runtime environment to execute, which limited its reach since Apple stopped shipping Java with macOS years ago. The new variant is written in C and Objective-C, which run natively on macOS without external dependencies. Apple revoked the developer signature after the malware was identified, which removes the trusted signature indicator, but does not prevent execution if a user bypasses the Gatekeeper warning. Multiple samples appeared on VirusTotal around July 2023, indicating the operators were running an active infection campaign. Underground forum advertisements priced the macOS variant at $199 per month or $299 for three months — significantly higher than the Windows version at $59 per month, reflecting the relative scarcity of effective macOS infostealers and the higher average value of data on macOS targets. The malware harvests clipboard data and browser directories from Firefox and Chrome, steals credentials and cookies, and establishes persistence via a Launch Agent so it continues running across reboots without any user interaction. Mac users: do not install software named OfficeNote from non-App Store sources, and treat any productivity application distributed as a DMG that asks for broad system permissions as suspicious regardless of whether it appears to have a valid signature.

Listen to the Episode