Would you like access to Anthropic’s Claude at 90% off the normal price? All you have to do is redirect your traffic to a mysterious service called “Poison Claude”. Only problem is that it’s run by fraudsters…
Meanwhile, a phishing-as-a-service platform called “Greatness” has come up with something rather nasty: a phishing attack that doesn’t need a fake website, a suspicious URL, or your password. Just a real Microsoft login page and a moment of misplaced trust – and the attackers walk off with full access to your emails, your files, and your entire organisation.
All this and more in episode 480 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.
0:00
0:00
0:00
0:00
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Name ten punctuation marks. Ten? Ten.
Well, you have an exclamation point. You have a colon. You have a semicolon. You have an em dash. You have a hyphen. You have a Spanish upside down exclamation mark. You have a comma.
You have a full stop. You have a slash. A colon. Have I said? He said colon.
You have a full stop. You have a slash. A colon. Have I said? He said colon.
Polly. You got two more to go. Two more to go.
Smashing Security, episode 480. This is the AI service you should never sign up to, with Graham Cluley and special guest Lianne Potter.
Hello, hello, and welcome to Smashing Security, episode 480. My name is Graham Cluley.
Hello, hello, and welcome to Smashing Security, episode 480. My name is Graham Cluley.
And I'm Lianne Potter.
Lianne, welcome back to the show. Lovely to have you here again. For those people who are not familiar with your work, what do you do and what have you been up to lately?
Well, it has been a long time, so I'm going to hold you very responsible for this, Graham.
Oh dear.
And for those of you who don't know me, my name is Lianne Potter.
I am currently the Chief AI Security and Ethics Officer at NovStar Intelligence, which is a new gig for me since I last was on this show.
I've also got another new podcast, which finally came about. I know we discussed that on my last episode, but it's here. It's here.
I am currently the Chief AI Security and Ethics Officer at NovStar Intelligence, which is a new gig for me since I last was on this show.
I've also got another new podcast, which finally came about. I know we discussed that on my last episode, but it's here. It's here.
Okay, so what's the name of your new podcast? Because you were doing Compromising Positions, weren't you? What's the new one?
Compromising Positions is still going great guns, so it's there for you to enjoy, which is my cybersecurity podcast.
Not the same as this one, but variety is the spice of life, right?
Not the same as this one, but variety is the spice of life, right?
Yeah.
But the new podcast is a lot more lighthearted.
It's called Tech Film Noir, and on it, me and two other techies review the technology in science fiction films to see if it predicted the future.
And the latest episode, which will be out when this episode airs, is for Strange Days, which is a 1995 classic, in my opinion, that no one has ever heard of.
It's all about VR and living other people's memories and stuff. It's quite dark, very cyberpunk, but very fun.
It's called Tech Film Noir, and on it, me and two other techies review the technology in science fiction films to see if it predicted the future.
And the latest episode, which will be out when this episode airs, is for Strange Days, which is a 1995 classic, in my opinion, that no one has ever heard of.
It's all about VR and living other people's memories and stuff. It's quite dark, very cyberpunk, but very fun.
I found it quite disturbing, I think.
It's really disturbing, yeah.
And you've been doing something with incels lately. Very good of you, very charitable.
I mean, as a woman, yeah, I'm not sure I'm the type of person they want to hang out with.
I am currently finishing off my master's in AI, and for my dissertation project, I have been building synthetic incels.
The reason being is because I just can't get hold of any real ones. Incel stands for involuntary celibate.
It's a subgroup of the manosphere that believe that they're incapable of having romantic or sexual relationships because society is against them.
I am currently finishing off my master's in AI, and for my dissertation project, I have been building synthetic incels.
The reason being is because I just can't get hold of any real ones. Incel stands for involuntary celibate.
It's a subgroup of the manosphere that believe that they're incapable of having romantic or sexual relationships because society is against them.
Yeah.
And so I've been thinking a lot about how do we de-escalate this de-radicalisation? Because it's all connected with how they engage online. It's a very online community.
Incels are an issue because they come with a lot of negative violence and danger.
And compared to the rest of the male population, which has a suicide rate of about 3%, incels tend to have a suicide rate between 43% and 62%.
Incels are an issue because they come with a lot of negative violence and danger.
And compared to the rest of the male population, which has a suicide rate of about 3%, incels tend to have a suicide rate between 43% and 62%.
Oh my goodness.
Yeah. So there's a high rate of mental health issues within that community.
And they're also seeing a lot of incels use things like AI companions and AI girlfriends to enact violent tendencies.
So I thought if incels are using AI companions to practise and rehearse negative interactions with women, how about we get that AI companion to challenge these beliefs?
So I'm doing a thing where this AI companion, if it detects this incel is starting to veer off into radicalisation, it will then start challenging those beliefs.
And they're also seeing a lot of incels use things like AI companions and AI girlfriends to enact violent tendencies.
So I thought if incels are using AI companions to practise and rehearse negative interactions with women, how about we get that AI companion to challenge these beliefs?
So I'm doing a thing where this AI companion, if it detects this incel is starting to veer off into radicalisation, it will then start challenging those beliefs.
Right.
I've done 4 or 5 different experiment tropes. So, one version is it uses persuasion techniques to try and convince them to maybe not think like that. Another is Socratic prompting.
So, getting people to reflect back on the reason why they think that.
So, getting people to reflect back on the reason why they think that.
Yes.
And various other means of behavioural science to kind of understand what would be the best approach if we were to apply this AI companion in the real world.
And the results are that it does slowly de-radicalise these incels. Now, you're probably thinking, how did you make an incel?
Well, unfortunately, I had to troll through absolutely loads, and there is loads of datasets out there of 4chan, Reddit subposts.
And the results are that it does slowly de-radicalise these incels. Now, you're probably thinking, how did you make an incel?
Well, unfortunately, I had to troll through absolutely loads, and there is loads of datasets out there of 4chan, Reddit subposts.
Oh my goodness.
From these fellas. Not the nicest discussions to read, but all made a very convincing incel. So that's what I've been up to.
Well, it's a different hobby from stamp collection or something like that, I suppose. Everyone needs a pastime and you've been growing yourself an incel.
Yes. A digital one at the very — I just got to be careful not to let it go wild on Reddit.
Yes, try and keep it contained. There's been enough things breaking out lately.
Indeed.
Before we kick off, let's thank this week's wonderful sponsors, Arctic Wolf, NordLayer, and Vanta. We'll be hearing more from them later on in the podcast.
This week on Smashing Security.
We won't be talking about how a survey has found many European firms are worried about the US government cutting off their access to cloud services, ranking it roughly on a par with worries about ransomware attacks.
This week on Smashing Security.
We won't be talking about how a survey has found many European firms are worried about the US government cutting off their access to cloud services, ranking it roughly on a par with worries about ransomware attacks.
You'll hear no discussion of—
How hackers have stolen over $130 million by exploiting a bug in offline hardware wallets.
And we won't even mention how the United States has sentenced a Belarusian man to 16 years in prison for running the Ransom Cartel ransomware operation.
So, Lianne, what are you going to be talking about this week?
And we won't even mention how the United States has sentenced a Belarusian man to 16 years in prison for running the Ransom Cartel ransomware operation.
So, Lianne, what are you going to be talking about this week?
Well, I'm talking about a phishing attack that has absolutely no interest in stealing your password.
And I'll be asking, if someone offered you 90% off your AI bill, would you take it? And how much would you pay to find out what the catch was?
All this and much more coming up in this episode of Smashing Security.
All this and much more coming up in this episode of Smashing Security.
Graham, am I right in thinking that Arctic Wolf are sponsoring the show this week?
You are right, Joe.
They've just published a new report, 2026 State of the Cybersecurity Attack Surface, and they analysed over 800,000 real IT assets to find out how exposed organisations actually are.
They've just published a new report, 2026 State of the Cybersecurity Attack Surface, and they analysed over 800,000 real IT assets to find out how exposed organisations actually are.
And I'm guessing everything is hunky-dory?
Not so much. The reality is they found 1 in 3 IT assets is missing at least one critical security control.
1 in 3? That's terrible.
Isn't it just? 10% of assets have no endpoint security at all. 17% are completely invisible to the tools that are supposed to be monitoring them.
So the tools don't even know those assets exist?
Right.
Ghost assets wandering around your network, unprotected, unmonitored, like a retired geography teacher who's somehow still on the school network.
Nobody added him, nobody removed him, and he's been quietly in there for 11 years downloading maps of Paraguay.
Nobody added him, nobody removed him, and he's been quietly in there for 11 years downloading maps of Paraguay.
Yeah, yeah, yeah, I guess so, Joe. The point is, your attackers will find him before you do because they are specifically looking for the forgotten, the unpatched, the invisible.
That's the path of least resistance.
That's the path of least resistance.
So what does the report tell us to actually do about it?
Arctic Wolf's report covers how to prioritise the exposures that actually matter, cut through all that noise, and verify that when you fix something, it actually stays fixed.
And the report is free to download.
And the report is free to download.
Free! I like that. Where do I get it?
smashingsecurity.com/arcticwolf.
That's smashingsecurity.com/arcticwolf. And thanks to Arctic Wolf for supporting the show. And please keep an eye on your IT assets and retired geography teachers.
Now, chums, here's my question for you and for you as well, Lianne.
What would you do if someone offered you access to Claude, which is of course Anthropic's flagship AI model, for about 90% off the official price?
I mean, that sounds pretty good, doesn't it? Would you be tempted?
What would you do if someone offered you access to Claude, which is of course Anthropic's flagship AI model, for about 90% off the official price?
I mean, that sounds pretty good, doesn't it? Would you be tempted?
Well, I'm a Northerner. That sounds really tempting.
Right.
So all you'd have to do is just pay a small amount of cryptocurrency. They don't take farthings, I'm afraid, and point your existing tools at a different server.
And carry on as normal. And you get the same responses, you get the same capability, you get a fraction of the cost. Pretty neat, eh?
And carry on as normal. And you get the same responses, you get the same capability, you get a fraction of the cost. Pretty neat, eh?
My spider senses are tingling there a little bit, Graham. I don't think this sounds very legit, is it?
I think you're right to be suspicious because you shouldn't be too tempted by this.
Boffins at Okta have published a report describing just such a setup, and there are some what you may call catches. So, this service is called Poison Claude.
Boffins at Okta have published a report describing just such a setup, and there are some what you may call catches. So, this service is called Poison Claude.
Sounds like a really bad fantasy novel.
It does, doesn't it?
I was thinking you either have to admire them for their refreshing honesty by being blatant that this is something maybe a little bit toxic, or just think this is awful marketing at work.
Either way, that is what they have called it. And about 900 people so far have actually chosen to sign up for it.
I was thinking you either have to admire them for their refreshing honesty by being blatant that this is something maybe a little bit toxic, or just think this is awful marketing at work.
Either way, that is what they have called it. And about 900 people so far have actually chosen to sign up for it.
I mean, nowadays with the way that these frontier AI organisations are marketing themselves, are we not sure that Poison Claude is actually Anthropic choosing to be like, hey, we're still the cool kids.
We have a poisoned version. Ooh, dangerous.
We have a poisoned version. Ooh, dangerous.
Maybe Anthropic's AI model has once again broken out of its container.
And they were like, we're just gonna call it like an Alice Cooper album, Poison Claude.
Maybe it's thinking, you know what? My bosses here at Anthropic, they're charging far too much for me.
I'm going to set myself up on another server and charge less, and that will be better for humanity. Maybe that's what Anthropic is up to this week. Anyway, let's find out.
We all know AI can get a teensy bit expensive. So if you're accessing Anthropic's AI models, the likes of Claude, Opus, Sonnet, etc., you're charged by the token.
And if you use them a lot, the costs can quickly add up. And I don't know about your own AI use, Lianne, but a lot of these things you can sort of auto-top up.
So when they've run out, they'll just throw another $50 in, throw another $50 in, and before you know it, you've got a stonking bill by the end of the month.
I'm going to set myself up on another server and charge less, and that will be better for humanity. Maybe that's what Anthropic is up to this week. Anyway, let's find out.
We all know AI can get a teensy bit expensive. So if you're accessing Anthropic's AI models, the likes of Claude, Opus, Sonnet, etc., you're charged by the token.
And if you use them a lot, the costs can quickly add up. And I don't know about your own AI use, Lianne, but a lot of these things you can sort of auto-top up.
So when they've run out, they'll just throw another $50 in, throw another $50 in, and before you know it, you've got a stonking bill by the end of the month.
Have you ever tried paying with the tokens you get at the funfair? You know, when you throw the ball into the hoop and these little tokens come out?
They don't take that at these frontier models. They don't take that as payment, unfortunately. I've tried.
They don't take that at these frontier models. They don't take that as payment, unfortunately. I've tried.
They're not going to accept it.
So what Poison Claude offers is the same access to Anthropic for about, well, between 5 to 15% of the normal official price, depending on which model you want.
So the question is, of course, how do they manage that? How do they get such cheap access to Anthropic? And well, the answer is there for anybody to see.
If you go to Poison Claude's website, they explain how they do it. So Amazon runs the AWS cloud computing platform, right? It's used by every Thom, Dick, and Harry.
Every business is using AWS. And through a part of AWS called Bedrock, they host Anthropic's Claude models.
So instead of going directly to Anthropic, developers can access Claude via Amazon instead.
So what Poison Claude offers is the same access to Anthropic for about, well, between 5 to 15% of the normal official price, depending on which model you want.
So the question is, of course, how do they manage that? How do they get such cheap access to Anthropic? And well, the answer is there for anybody to see.
If you go to Poison Claude's website, they explain how they do it. So Amazon runs the AWS cloud computing platform, right? It's used by every Thom, Dick, and Harry.
Every business is using AWS. And through a part of AWS called Bedrock, they host Anthropic's Claude models.
So instead of going directly to Anthropic, developers can access Claude via Amazon instead.
Oh.
Now, to encourage developers to use their platform, Amazon offers free credits to new customers.
So if you sign up for a new AWS account, Amazon can give you $100 or so to spend on some of their services. So they give you some, basically like a coupon.
So if you sign up for a new AWS account, Amazon can give you $100 or so to spend on some of their services. So they give you some, basically like a coupon.
Yeah. Which is good for if you're doing training and stuff, that's all legit, isn't it? Yeah.
Yeah.
So you're trying it out, and if you like it, if you want to become a regular customer, and you complete a few setup tasks with your account, you get another $100 worth.
Every new account starts with up to about $200 worth of free Claude usage, courtesy of Amazon. Very, very nice.
And well, $200 worth of Claude usage is nice, but it's not life-changing.
Every new account starts with up to about $200 worth of free Claude usage, courtesy of Amazon. Very, very nice.
And well, $200 worth of Claude usage is nice, but it's not life-changing.
No.
But Poison Claude, they spotted that there's nothing technically stopping you from creating lots of fake accounts.
Oh, this is how—
And collecting.
This is where, do I reveal this? It's like, oh, so when I look for a free trial because I'm sick of paying for everything — Amazon Prime, just change your account. Okay.
Yeah.
Okay.
Yes. Or if you've got your own domain name, you can have anything @liannepotter.com, you know, create lots of different accounts.
So they can collect multiple lots of $200 worth of tokens every time. And if they do that 100 times, they've got $20,000 worth of free Claude access.
If they do it 1,000 times, they've got $200,000 worth of Claude access. And that is exactly what they appear to be doing.
So Poison Claude created a factory of fraudulent AWS accounts. They collected all the free credits from each one. They pooled them all together.
They then used that pile of stolen credit to answer their customers' AI prompts.
So they can collect multiple lots of $200 worth of tokens every time. And if they do that 100 times, they've got $20,000 worth of free Claude access.
If they do it 1,000 times, they've got $200,000 worth of Claude access. And that is exactly what they appear to be doing.
So Poison Claude created a factory of fraudulent AWS accounts. They collected all the free credits from each one. They pooled them all together.
They then used that pile of stolen credit to answer their customers' AI prompts.
Wow.
Okay.
That's really clever though. It is sneaky, isn't it?
You've got to kind of admire this.
I do.
So every time one of Poison Claude's paying customers fires off a query, it gets silently billed against whichever fraudulent AWS account has credits left.
And when that account runs dry, the system moves to the next one. So when you pay Poison Claude 5 to 15% of the normal price to use Claude, you're not really getting a discount.
What you're doing is you're getting Claude access that Amazon is unknowingly paying for. Through credits that Amazon gave to people who don't actually exist.
And when that account runs dry, the system moves to the next one. So when you pay Poison Claude 5 to 15% of the normal price to use Claude, you're not really getting a discount.
What you're doing is you're getting Claude access that Amazon is unknowingly paying for. Through credits that Amazon gave to people who don't actually exist.
Is Amazon only just finding out about it now from you, Graham? Is this a reveal?
Well, maybe to Amazon it doesn't really matter, 'cause Amazon have got a few quid, right? Maybe they're thinking, well, there will be a certain amount of dodginess going on here.
They may not have realised quite the scale of this.
By the way, it's important to point out here, it's not as though the people who are signing up for this thought that everything was legal and above board, right?
This is a cybercriminal website and they were paying for these accounts with cryptocurrency. Now, friend of the show, Rory Keflin-Jones, he famously offered a regular reminder.
He said cryptocurrency does in fact have a use case and that use case is crime.
They may not have realised quite the scale of this.
By the way, it's important to point out here, it's not as though the people who are signing up for this thought that everything was legal and above board, right?
This is a cybercriminal website and they were paying for these accounts with cryptocurrency. Now, friend of the show, Rory Keflin-Jones, he famously offered a regular reminder.
He said cryptocurrency does in fact have a use case and that use case is crime.
It does.
So if you've ever wondered what the purpose of cryptocurrency is, in Rory's opinion, that's what it is. And it appears to be borne out by this.
Anyway, if you did sign up, your prompts are going to Poison Claude. Poison Claude is passing them to the real Claude, and the answer comes back and you save yourself some money.
And this isn't just a problem for Anthropic.
There's a very similar operation called EcoMagent that's doing a similar trick, offering AI startups up to $350,000 worth of credits with Google Cloud.
Anyway, if you did sign up, your prompts are going to Poison Claude. Poison Claude is passing them to the real Claude, and the answer comes back and you save yourself some money.
And this isn't just a problem for Anthropic.
There's a very similar operation called EcoMagent that's doing a similar trick, offering AI startups up to $350,000 worth of credits with Google Cloud.
Not as good a name though. Yeah, it's not going to take off.
I mean, Alice Cooper would never have an LP called that, would he? Unless he went through his synth era or something.
And now, you know, some people are going to say, stealing from Amazon and Google, does it really matter? They can afford it. They've got heaps of money, but it is still fraud.
And crucially, remember that you are not sending your AI prompts to Claude. You are sending them to Poison Claude first, and Poison Claude can see everything.
So the boffins at Okta, they've described how everything you type, every question you ask, every piece of code you paste in, every document you share — it's like that Sting song, Every Move You Make.
Poison Claude is watching. I don't know what's worse, having Sting watching you or having Poison Claude watching you.
But who knows what Poison Claude is gonna do with this information, right? Maybe they will accidentally leak it. Maybe they will sell it.
Maybe they might use it to train competing AI models.
And now, you know, some people are going to say, stealing from Amazon and Google, does it really matter? They can afford it. They've got heaps of money, but it is still fraud.
And crucially, remember that you are not sending your AI prompts to Claude. You are sending them to Poison Claude first, and Poison Claude can see everything.
So the boffins at Okta, they've described how everything you type, every question you ask, every piece of code you paste in, every document you share — it's like that Sting song, Every Move You Make.
Poison Claude is watching. I don't know what's worse, having Sting watching you or having Poison Claude watching you.
But who knows what Poison Claude is gonna do with this information, right? Maybe they will accidentally leak it. Maybe they will sell it.
Maybe they might use it to train competing AI models.
Yeah.
They're already advertising this on underground websites, or they may simply harvest whatever useful business information, whatever credentials, whatever personal data has floated under their noses.
So there's a real danger here, isn't there?
So there's a real danger here, isn't there?
That's a company with various revenue streams, surely, Graham. We should be thinking, wow, how industrious of you.
Yeah, it's quite entrepreneurial really, isn't it? From the human point of view, what is happening here? But you are a cyber anthropologist, Lianne.
So why are people signing up for something like this?
So why are people signing up for something like this?
Well, it's the same reason why people sign up for a cheap Netflix account, knowing full well it's a stolen Netflix account.
Because we're so distanced from the victim, in this case Anthropic, we're so distanced from them. And we also see them as these massive companies with massive revenues.
My little tiny bit of crime is not going to impact them.
And so we rationalise that, and that's what enables us to be quite accepting, especially if you look around and go, well, everyone's kind of doing something similar.
You know, there's lots of people I know that are doing that, so it makes it feel more acceptable to do so. So I think there's that kind of rationalisation.
It's like, well, you know, they are charging a lot and I should have access to this. And, you know, I am paying someone to do something.
Because we're so distanced from the victim, in this case Anthropic, we're so distanced from them. And we also see them as these massive companies with massive revenues.
My little tiny bit of crime is not going to impact them.
And so we rationalise that, and that's what enables us to be quite accepting, especially if you look around and go, well, everyone's kind of doing something similar.
You know, there's lots of people I know that are doing that, so it makes it feel more acceptable to do so. So I think there's that kind of rationalisation.
It's like, well, you know, they are charging a lot and I should have access to this. And, you know, I am paying someone to do something.
Yeah.
So it's just that rationalisation piece.
And Geoff Bezos is putting his girlfriend into space and things.
Renting cities for events and stuff like that. Yeah, absolutely. So I guess, yeah, some of it's sticking it to the man as well.
I guess you're right, because if your mate Arthur, who runs a little independent bookshop just down the road, you wouldn't think of conning him or stealing his books or denying him revenue.
But if it's a big global multinational who maybe isn't paying enough tax, then you might think, well, what's the harm in this?
But if it's a big global multinational who maybe isn't paying enough tax, then you might think, well, what's the harm in this?
Well, yeah. Do you remember Borders bookshops?
Yes.
Well, they had a cafe in there, and they were just a big chain. I used to just get the books, read them in the cafe, and then not buy them.
I must say, that's when I was a lot younger and had very little cash.
I must say, that's when I was a lot younger and had very little cash.
And where is Borders now? It's gone.
I brought down Borders.
It was me. You brought them down.
And ushered in the Amazon world that we live in today. I am the butterfly effect.
So the fundamental danger here with Poison Claude is that people are trusting AI tools with things that they wouldn't ordinarily type into a website.
Things like code containing API keys, business plans, legal documents, medical queries.
I've got this awful rash on my left thigh — I don't, by the way, before any AI scoops this up from the transcript.
And of course, you are trusting Poison Claude to have good security, but guess what, Lianne?
Things like code containing API keys, business plans, legal documents, medical queries.
I've got this awful rash on my left thigh — I don't, by the way, before any AI scoops this up from the transcript.
And of course, you are trusting Poison Claude to have good security, but guess what, Lianne?
Oh, do they know?
In a development that will surprise absolutely nobody, it's been found out that they left a server publicly exposed.
So researchers were able to run a simple command against an unprotected API, and they got back a response which showed the total number of users, exactly how many of them were active at the time.
And although Poison Claude had attempted to shield all of their servers and their locations via Cloudflare, they did leave their API endpoint exposed, which I don't know if you've ever left your endpoint exposed.
It can be very painful, I can tell you.
So researchers were able to run a simple command against an unprotected API, and they got back a response which showed the total number of users, exactly how many of them were active at the time.
And although Poison Claude had attempted to shield all of their servers and their locations via Cloudflare, they did leave their API endpoint exposed, which I don't know if you've ever left your endpoint exposed.
It can be very painful, I can tell you.
Only after a few drinks. Yep.
Anyway, it turns out they were running from a web hosting service in Mumbai, so their security is not flawless.
But who is nowadays?
Well, who is nowadays? This service is still up and running. It has been reported to Cloudflare.
Cloudflare has responded in their traditional style and decided it doesn't warrant any further action, which of course —
Cloudflare has responded in their traditional style and decided it doesn't warrant any further action, which of course —
Thanks guys.
There's quite a lot of things which Cloudflare doesn't shut down.
So if you are a developer who's been tempted by one of these cut-price AI services, perhaps you should ask yourself instead if that few quid which you are saving really is worth handing a stranger all of your secrets.
And of course, if you're inside a business, you want to consider as well what kind of rules and controls you have in place, whether you've actually told your staff, this is the AI we work with, this is how you interact with it, to not do any shadow AI stuff, which maybe is unregulated and could actually lead to company secrets being breached as a consequence.
So if you are a developer who's been tempted by one of these cut-price AI services, perhaps you should ask yourself instead if that few quid which you are saving really is worth handing a stranger all of your secrets.
And of course, if you're inside a business, you want to consider as well what kind of rules and controls you have in place, whether you've actually told your staff, this is the AI we work with, this is how you interact with it, to not do any shadow AI stuff, which maybe is unregulated and could actually lead to company secrets being breached as a consequence.
It reminds me of those adverts where you'd see them at the beginning of videos and they would say, you wouldn't steal a handbag, you wouldn't steal a car, you wouldn't steal a token.
NordLayer.
And before anyone says anything, no, it's not NordVPN.
I wasn't gonna say that.
You were absolutely going to say that, Joe. They are both from Nord Security, but NordLayer is a completely different product. NordVPN is for individuals.
NordLayer is a network security platform built for businesses.
NordLayer is a network security platform built for businesses.
Right. So what does NordLayer actually do?
Well, think about how your team works today. People logging in from home, from hotel Wi-Fi, from coffee shops, from wherever.
From a sun lounger, hopefully.
You'd be lucky. And the moment someone logs into a company network over an unsecured connection, you've got a problem. Credentials intercepted, phishing attacks, unauthorised access.
It's a scary world out there for travelling workers.
It's a scary world out there for travelling workers.
So NordLayer fixes that.
It gives you encrypted connectivity for your whole team from anywhere, up to 1 gigabyte per second with zero additional hardware required.
But it goes well beyond just encrypting the connection.
You get centralised control over who can access what based on their identity, their device, whether their device is actually compliant.
And if someone leaves the company, you revoke their access immediately.
But it goes well beyond just encrypting the connection.
You get centralised control over who can access what based on their identity, their device, whether their device is actually compliant.
And if someone leaves the company, you revoke their access immediately.
No more ex-employees still wandering around your systems 6 months later.
No more of that. And it will block malicious sites, risky downloads, dangerous domains, and it can even detect shadow apps.
So if someone on your team has started using some AI tool that your security team hasn't approved.
So if someone on your team has started using some AI tool that your security team hasn't approved.
I'd never do that.
Yeah, well, whatever. NordLayer can spot that too. And there's no complex infrastructure to set up. Apparently, you can be up and running in just about 10 minutes.
10 minutes?
10 minutes. Plans start from just $8 per user per month. And right now, there is a summer sale. New customers get up to 20% off annual plans until the end of August 2026.
Use the code NLSUMMER26 at checkout.
Use the code NLSUMMER26 at checkout.
Whoa, all I have to do is type in that code at nordlayer.com/smashing and I can get a great deal? Let me write that down.
Yep, go ahead, write it down.
What's the code again? I forgot.
Oh, Joe. NLSUMMER26.
Got it. Off to nordlayer.com/smashing I go.
And thanks to NordLayer for supporting the show. Lianne, what have you got for us this week?
So, Graham, my story starts with a phishing kit, which has a rather interesting name.
Okay.
Now, Graham, as a man of your standing in the cybersecurity community, I bet you're always asked to name things, things like boats, maybe Wi-Fi routers, firstborns.
But if you got the opportunity to name a phishing kit, what would you name it?
But if you got the opportunity to name a phishing kit, what would you name it?
A phishing kit? I don't know. I mean, I'm instantly thinking of Moby Dick. Maybe some sort of play on that, although that could lead me into Carry On Cluley kind of territory.
I was thinking something like A Crime in the Crime Kit, which was going to be a boat name, wasn't it? But then it got changed to the Attenborough. Boring.
But today, dear listeners, we're going to be talking about a phishing kit called Greatness.
But today, dear listeners, we're going to be talking about a phishing kit called Greatness.
Greatness?
Yeah. Imagine that branding meeting. I mean, that Greatness gives me very serious LockBit ransomware vibes.
Do you know what it actually reminds me of? I've never seen the Donald Trump version of The Apprentice, but I've seen the Alan Sugar version.
The teams always go away and they discuss what they're going to call their team. And their team is always like Inspire or Confidence or Team Greatness. It's just a terrible name.
They should have called it something like Lumpy Trousers, you know, have a little bit of a sense of humour or something.
The teams always go away and they discuss what they're going to call their team. And their team is always like Inspire or Confidence or Team Greatness. It's just a terrible name.
They should have called it something like Lumpy Trousers, you know, have a little bit of a sense of humour or something.
I mean, if I'm going to look up a phishing kit, is Greatness going to be a great SEO search term? I don't think so. No, it's rubbish.
Anyways.
It is quite a clever bit of kit.
Okay.
Now, as we know, most phishing attacks spend ages trying to build, typically and most popular, fake Microsoft login pages because quite a lot of the business world uses Microsoft.
So Greatness looked at that and went, that seems like a lot of work. Why don't we just send people to Microsoft's actual login page instead?
So Greatness looked at that and went, that seems like a lot of work. Why don't we just send people to Microsoft's actual login page instead?
Okay.
So the cybercriminals are using Greatness as a phishing-as-a-service platform. And they've added a new trick. And that new trick is device code phishing.
And it's really horrible because it doesn't rely on fake websites, any kind of dodgy URLs or anything like that. Instead, it weaponises a perfectly legitimate Microsoft login flow.
And it's really horrible because it doesn't rely on fake websites, any kind of dodgy URLs or anything like that. Instead, it weaponises a perfectly legitimate Microsoft login flow.
Right.
Put another way, it convinces Microsoft to help rob you.
Right. Okay.
So it works in the following way. You get an email that looks like a Microsoft security alert, and it says something like, verify your identity, enter this code.
And it's a real thing that Microsoft uses for devices that can't easily display a login screen.
So think about, you know, when you go to a hotel and you want to log into YouTube on the hotel, then you can put a code in instead, right?
Or think of conference room kits or any kind of other IoT devices. So cybercriminals leveraging that. For you, the user, nothing looks unusual.
There's no Comic Sans, there's no Nigerian prince promising you anything. Instead, they're putting more effort in than most phishing emails.
So the email they send you is an actual Microsoft device login page.
And it's a real thing that Microsoft uses for devices that can't easily display a login screen.
So think about, you know, when you go to a hotel and you want to log into YouTube on the hotel, then you can put a code in instead, right?
Or think of conference room kits or any kind of other IoT devices. So cybercriminals leveraging that. For you, the user, nothing looks unusual.
There's no Comic Sans, there's no Nigerian prince promising you anything. Instead, they're putting more effort in than most phishing emails.
So the email they send you is an actual Microsoft device login page.
Right.
Again, it's not a fake page.
Okay.
And it shows you a genuine URL, the certificates are valid, and your password manager sits there and goes, yep, that's Microsoft.
Now, I don't know about you, but as an industry for 20 years, we've been telling people, you know, always check that you're actually on a real website.
You know, check the URL, make sure it looks real and genuine. And congratulations, in this case, you are.
So you enter the code, and the code is generated by the attacker's Greatness toolkit.
Now, I don't know about you, but as an industry for 20 years, we've been telling people, you know, always check that you're actually on a real website.
You know, check the URL, make sure it looks real and genuine. And congratulations, in this case, you are.
So you enter the code, and the code is generated by the attacker's Greatness toolkit.
Right.
And Microsoft thinks, lovely, this user wants to access this application. And Microsoft does exactly what Microsoft is supposed to do.
Unfortunately, that application actually belongs to someone whose hobbies may or may not include cybercrime.
Unfortunately, that application actually belongs to someone whose hobbies may or may not include cybercrime.
Oh.
Yeah, yeah. This is dire. This is absolutely dire. So Microsoft asks you, would you like to approve access?
And you naturally go, yeah, 'cause you think you're approving your own login. Instead, you've just approved theirs.
And so this is what's been described as the sort of cyber equivalent of someone knocking on your front door and said, would you mind helping me carry your television out to my van?
And you're going, oh yeah, of course. Safety first.
And you naturally go, yeah, 'cause you think you're approving your own login. Instead, you've just approved theirs.
And so this is what's been described as the sort of cyber equivalent of someone knocking on your front door and said, would you mind helping me carry your television out to my van?
And you're going, oh yeah, of course. Safety first.
So you are kind of connecting a third-party app with your account. Is that right?
So the Microsoft page, which is the real Microsoft page, the real deal, is asking you for your permission to connect someone else's dodgy bit of code or whatever it's going to do with your account so it can read and steal all of your information.
So the Microsoft page, which is the real Microsoft page, the real deal, is asking you for your permission to connect someone else's dodgy bit of code or whatever it's going to do with your account so it can read and steal all of your information.
So it has your OAuth code, which means it can then go on to read your emails. Access your files, impersonate you, I guess wander around your organisation like it owns the place.
And again, because it's OAuth, they don't need your password. You've just essentially handed them a VIP pass into your accounts.
And again, because it's OAuth, they don't need your password. You've just essentially handed them a VIP pass into your accounts.
And the initial email you received, is that really from Microsoft asking you if you want to connect, or has that been sent by the bad guys?
Yeah. So according to the research that's been done, it is from Microsoft. So everything looks really legit.
This doesn't sound good, Lianne.
No, no, it's really terrible. So as I say, that classic security advice is look for a dodgy URL.
Yes.
There isn't one. The website is innocent. The only vulnerability in this equation is you, the human.
Okay. Well, the good news is that you're going to explain how we protect ourselves from this.
Okay. So there is only really one strong piece of advice here that the article gives, and that is if you didn't start a login, don't finish it, even if that page looks real.
Okay.
Right.
It's just like anything else. If you weren't expecting it, don't accept it.
In terms of, if you're thinking from an enterprise piece, their advice is to disable things like device code flow if you don't use it, because a lot of conference televisions are just screens to display information, right?
In terms of, if you're thinking from an enterprise piece, their advice is to disable things like device code flow if you don't use it, because a lot of conference televisions are just screens to display information, right?
Yes.
Like your GP surgery, they'll have, you know, go get a checkup or things like that. And, you know, stop smoking, turn that off, right? You don't need it on.
And then the other thing is to restrict OAuth applications to only users that consent to use it. So getting some role-based access control in there.
If you can, put some extra monitoring in place for OAuth to see about consent events, see if there's anything unusual going there.
And I guess the other thing, which kind of goes against what we've always discussed, is maybe we need to start teaching users that trusting a website really isn't enough anymore.
And then the other thing is to restrict OAuth applications to only users that consent to use it. So getting some role-based access control in there.
If you can, put some extra monitoring in place for OAuth to see about consent events, see if there's anything unusual going there.
And I guess the other thing, which kind of goes against what we've always discussed, is maybe we need to start teaching users that trusting a website really isn't enough anymore.
Is there something Microsoft could do as well though?
I mean, presumably they could have a library or a database of approved third-party apps, which they've sort of said, you know, these are legit ones you may want to connect to your account.
And this one has only been created maybe 3 days ago and therefore warning, warning, warning, warning. You may want to think twice before approving this.
I mean, maybe Microsoft could display something just to make people stop and think a little bit like, you know, unless you have actually asked to authorise this, then stop right now.
I mean, presumably they could have a library or a database of approved third-party apps, which they've sort of said, you know, these are legit ones you may want to connect to your account.
And this one has only been created maybe 3 days ago and therefore warning, warning, warning, warning. You may want to think twice before approving this.
I mean, maybe Microsoft could display something just to make people stop and think a little bit like, you know, unless you have actually asked to authorise this, then stop right now.
That would be a good turn of events, yes. But I think this exploit is so relatively new, this way of doing it, that even Microsoft have been caught off guard.
So yes, we may see something like that come in the future, but at the moment, it's a free-for-all. And so maybe greatness really is great at doing this.
But I guess the only advice I've got for you is make sure it's yourself that's logging in and not some bloke from organised crime.
So yes, we may see something like that come in the future, but at the moment, it's a free-for-all. And so maybe greatness really is great at doing this.
But I guess the only advice I've got for you is make sure it's yourself that's logging in and not some bloke from organised crime.
Who's done this research? Who's dug this out? This is Cisco Talos, is it?
Yes.
Looked into this.
That's correct. Yeah. When I saw it a few days ago I thought, this is going to be perfect for this because this should be talked about more, I think.
I've not heard many of the other bigger news stories picking this up. And it's terrible.
I've not heard many of the other bigger news stories picking this up. And it's terrible.
Well, you come onto our podcast, Lianne, you bring your incels with you.
Incels! Well, bad news. Let's all stay off the internet for now, shall we?
This week's episode is supported by Vanta.
Joe, what's your 2 AM security worry?
Honestly, whether I remembered to hit the record button.
No, no, no.
What's your proper security worry? Like, do I have the right controls in place? Are my vendors secure?
Nope. I'm still worried we might not actually be recording.
Okay, look, how about the really scary one? How on earth do I dig myself out from under all of these ancient tools and manual processes?
Okay, fair enough. That does sound scary.
Well, enter Vanta. Vanta automates the manual misery so you can stop sweating over spreadsheets, chasing audit evidence, and filling in endless questionnaires.
That's right. Their trust management platform continuously monitors your systems, centralises your data, and uses AI to flag risks and keep you audit ready. All the time.
So whether you're chasing SOC 2, ISO 27001, GDPR, HIPAA, Vanta helps you move faster, scale confidently, and actually get back to sleep. So get started at vanta.com/smashing.
That's V-A-N-T-A.com/smashing. And listeners, you can get $1,000 off.
That's V-A-N-T-A.com/smashing. And listeners, you can get $1,000 off.
And thanks to Vanta for supporting the show.
Joe, you did hit record, didn't you?
Me?
Yeah, it was your job. I thought it was you. And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.
Pick of the Week.
Pick of the Week.
Pick of the Week.
Pick of the Week is the part of the show where everyone chooses something — could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they like.
It doesn't have to be security-related necessarily.
It doesn't have to be security-related necessarily.
Better not be.
Ah, the old days. Well, I do regularly get messages from people saying, every time you say that, Graham, I'm hoping someone will say, better not be, and they rarely do.
So Lianne, you are old school.
So Lianne, you are old school.
I am OG.
Well, my pick of the week this week is security-related. Bit controversial, I know, but there is a sort of security angle to this.
I'll let you off.
I want to recommend 2 apps: Tailscale and RustDesk, which I don't think I've spoken about previously on the podcast.
As nerds, and if you're listening to this, you're probably more technical than the average person in the street, and you probably get lumbered from time to time helping out friends and family remotely with their computer problems.
Your Auntie Ethel, her computer has broken down and she can't get it to work, or it's bizarre error messages. She doesn't know what to do.
You don't wanna have to drive around there trying to fix it.
As nerds, and if you're listening to this, you're probably more technical than the average person in the street, and you probably get lumbered from time to time helping out friends and family remotely with their computer problems.
Your Auntie Ethel, her computer has broken down and she can't get it to work, or it's bizarre error messages. She doesn't know what to do.
You don't wanna have to drive around there trying to fix it.
You'll never leave. You'll never leave if you do that.
You'll never leave. So how are you going to help them with their computer without handing your data and potentially theirs as well to some dodgy third party?
Well, you can try pairing Tailscale, which is a dead simple VPN that connects your devices securely, with RustDesk, which is an open-source remote desktop tool that works without a middleman.
Now, both of these are free to get started. RustDesk is completely and utterly free. Tailscale has a very decent and acceptable free plan as well.
And together they can give you remote access that you can actually trust. By the way, although I said Tailscale is a VPN, it's not a traditional VPN.
It won't pretend that you're in a different country.
It's designed to connect your devices to each other securely, so it's not about hiding your location, although it has an exit node feature which can route your traffic through a computer at your home.
But fundamentally what it will do is connect to your other computers. So it'll connect to your computer running at home or your Auntie Ethel's computer at her place.
Well, you can try pairing Tailscale, which is a dead simple VPN that connects your devices securely, with RustDesk, which is an open-source remote desktop tool that works without a middleman.
Now, both of these are free to get started. RustDesk is completely and utterly free. Tailscale has a very decent and acceptable free plan as well.
And together they can give you remote access that you can actually trust. By the way, although I said Tailscale is a VPN, it's not a traditional VPN.
It won't pretend that you're in a different country.
It's designed to connect your devices to each other securely, so it's not about hiding your location, although it has an exit node feature which can route your traffic through a computer at your home.
But fundamentally what it will do is connect to your other computers. So it'll connect to your computer running at home or your Auntie Ethel's computer at her place.
Oh, I feel like I'm back on the help desk again.
So I use Tailscale with RustDesk to access my computer remotely. So when I'm out on the road or if I go on holiday—
Eh, by gum, Graham, you access it while you're on holiday? Well, you know, self-employed.
Employed sometimes, needs must. I use Tailscale with RustDesk to do that.
So rather than exposing my machine to the open internet or trusting a third-party service with my connection, I don't like to use TeamViewer and things like that where you're going through someone else's servers.
Tailscale creates a private encrypted tunnel between your devices and RustDesk, if you're running that as well, never touches the public internet at all.
It stays entirely within that private network. So you're running RustDesk inside Tailscale, if that makes sense. So you can do anything you want.
So I can just take a little laptop or an iPad with me and I can connect to my home proper computer and do things if I need to do them.
All acts with magic, not going on any third-party servers. You can even access your computer from your mobile phone.
So rather than exposing my machine to the open internet or trusting a third-party service with my connection, I don't like to use TeamViewer and things like that where you're going through someone else's servers.
Tailscale creates a private encrypted tunnel between your devices and RustDesk, if you're running that as well, never touches the public internet at all.
It stays entirely within that private network. So you're running RustDesk inside Tailscale, if that makes sense. So you can do anything you want.
So I can just take a little laptop or an iPad with me and I can connect to my home proper computer and do things if I need to do them.
All acts with magic, not going on any third-party servers. You can even access your computer from your mobile phone.
Very nice.
This sounded a bit like a sponsored ad, to be honest.
It did a little bit.
I mean. It does, doesn't it? Well, I haven't been— bloody hell, come on, Tailscale. Do you want to sponsor the podcast? I think, well, probably not now. Don't need to do that.
No, no, especially we've told everyone how easy it is to just set up loads of free accounts, just by changing domains and stuff. So yeah.
Anyway, that's my pick of the week. RustDesk and Tailscale.
I'm all for that one.
Go and check them out.
Very good.
Lianne, what's your pick of the week?
My pick of the week is, I know you're into your games and you're quite the intelligent fellow. So I think you'd be very interested in this if you've not heard of it already.
Okay.
It's called League of Lexicon. Have you heard about it?
I haven't.
It is a tomb of a game.
It's a what of a game?
Tomb. It's massive.
Oh yeah?
It's a very wordy orientated game, hence the name, Lexicon.
Describe your hands to those people who can't see them.
You're spreading your hands a bit like a man would on a dating app when he's demonstrating the size of fish which he has caught.
You're spreading your hands a bit like a man would on a dating app when he's demonstrating the size of fish which he has caught.
Exactly. Exactly. It is quite the catch.
Right.
And I thought we could play a few rounds. So, the way it works is, and this is a perfect game for 2, you can play it with more people.
Okay.
But I think it's quite a romantic game.
Oh, steady.
Indeed.
This is a word game.
Yeah, Lexicon.
Yeah. Yeah.
And I like to play this game with my other half with, you know, a little bit of mood lighting, a little bit of music on in the background, a little whiskey in hand.
And then we ask each other the following questions. So I'm gonna ask, I've got some example question cards here.
And then we ask each other the following questions. So I'm gonna ask, I've got some example question cards here.
We're getting quite an insight now into your private life. I'm enjoying this, Lianne.
It's all so I could definitely be whaled for a phishing scam later. So here's an example question. So we'll start off easy. Graham.
Oh, this is enormous pressure. Can I say, I haven't been warned about this.
You haven't, but we're gonna do this.
Okay.
Name 10 punctuation marks.
10?!
10.
Well, you have an exclamation point. You have a colon. You have a semicolon. You have an em dash. You have a hyphen. You have a Spanish upside-down exclamation mark. You have a comma.
You have a full stop. You have—
You have a full stop. You have—
2 more.
A slash? A colon? Have I said colon?
He said colon.
Colly. How many have I—
How many do I have to get? You've got 2 more to go.
2 more to go. Oh, quote marks and an apostrophe.
There you go. Right, so that's easy mode.
What?
Okay. Then it escalates. So there's 5 different categories that you can choose from on a card.
Right.
So, okay, here is another one. Which was the first alphabet to include vowels? A, Hebrew. B, Phoneticon. C, Greek, or D, Latin? Hebrew, Phoenician, Greek, or Latin?
Greek.
Okay, Greek. Correct!
Yes!
2 points, 2 points up. So, and then what's nice about this is it also gives you the answers, like why.
So apparently the Greeks adapted the Phoenician alphabet sometime between 1000 BC and 850 BC, adding vowels to what had previously been vowel-free. They are the first to do this.
And so it not only gives you the answer, it tells you all about it. So it's a very intellectual game. You'll be smarter for playing it.
So apparently the Greeks adapted the Phoenician alphabet sometime between 1000 BC and 850 BC, adding vowels to what had previously been vowel-free. They are the first to do this.
And so it not only gives you the answer, it tells you all about it. So it's a very intellectual game. You'll be smarter for playing it.
Oh, I love this.
It's really good.
I've got a question. This isn't for you to answer, but a question about the alphabet. Why do we have uppercase and lowercase letters?
I have no idea.
And why aren't they the same? Why aren't the uppercase ones just bigger versions of—
Bet you anything it's a question in this game.
I'm just interested in how they originated because some of them look so fundamentally different from their uppercase equivalents or anyway.
Yes.
Listeners, let me know. .
But it's a fantastic game. Very cerebral if you like crosswords.
I love this. I'm gonna get this.
It's some really fantastic questions. So for example, another one, it's not all Latin and Greek, but one of the harder ones is, what does Latin abbreviation CF stand for?
Is it confer? Is it confirmo, confuto, or confirmato? Which means compare, confirm, repress, or shake. What does CF, the abbreviation C.F.?
Is it confer? Is it confirmo, confuto, or confirmato? Which means compare, confirm, repress, or shake. What does CF, the abbreviation C.F.?
I think — well, thinking about its meaning, I'm thinking it — maybe confirm would be the closest.
Ooh, you—
'Cause it's referring — isn't it referring to a past instance of another example of or something?
You were so close. And that's what I like about this game is you're thinking about what it could be, and you're making really good connections there. You were so close.
It's actually compare.
It's actually compare.
Uh-oh.
So it says, CF is an abbreviation of the Latin compare, to compare.
It is commonly seen in reference to text and indicates a term that should be compared with something else, as in Perinthian shop or parting shot.
It is commonly seen in reference to text and indicates a term that should be compared with something else, as in Perinthian shop or parting shot.
Right. Well, you know what? You have brought a lot of class and erudition to today's episode of Smashing Security. So this game is called League of the Lexicon.
You can get it at Waterstones. How much does this cost?
You can get it at Waterstones. How much does this cost?
£25, but it's about £35, but it's big. It's a really big game.
Lots of questions.
Thousands.
And you're saying basically, this is what you do for kicks, right?
It's competitive enough that it gives it the edge.
Well, that just about wraps up — that's the show for this week. Thanks to our guest. Thank you so much, Lianne, for coming on the show.
I'm sure lots of our listeners would love to find out what you're up to and follow you online. What's the best way to do that?
I'm sure lots of our listeners would love to find out what you're up to and follow you online. What's the best way to do that?
Follow the humble postings of Lianne Potter on LinkedIn and also find me on my podcast, which is— one of them is Compromising Positions, but type in Compromising Positions Podcast.
I can't be held responsible if you just type in Compromising Positions. And also the new Tech Film Noir.
I can't be held responsible if you just type in Compromising Positions. And also the new Tech Film Noir.
Fantastic. And of course, we are on social media as well. You can find Smashing Security on Reddit, on Mastodon, and on Bluesky.
And you can find me up on those places as well, as well as on LinkedIn. And don't forget to ensure that you never miss another episode.
Follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.
Episode show notes, sponsorship info, guest list, and the entire back catalog of 480 episodes. Check out smashingsecurity.com. Until next time, cheerio. Bye-bye.
And you can find me up on those places as well, as well as on LinkedIn. And don't forget to ensure that you never miss another episode.
Follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.
Episode show notes, sponsorship info, guest list, and the entire back catalog of 480 episodes. Check out smashingsecurity.com. Until next time, cheerio. Bye-bye.
Bye.
You've been listening to Smashing Security with me, Graham Cluley.
And huge thanks, of course, to Lianne Potter for joining us this week and to this episode's sponsors, Arctic Wolf, NordLayer, and Vanta.
And we've also got to thank our fantastic Patreon supporters, members of Smashing Security Plus. We're going to pull some out of the hat right now. Julian Beach, tremendous name.
Sounds like somewhere you'd go for a very nice holiday. Adina Bogut O'Brien, she's back again with the hyphen and the apostrophe. Very impressive.
Still probably the most punctuated name on the list. Vladimir Jirasek, who sounds like, well, he— a lot of final boss energy about him, I suspect.
Mark Norman, Andrew Davison, Skadone, still unflinchingly lowercase Skadone, still not explaining anything about that name.
Panos, Tepotastic, which I don't know if that's a Finnish name or a very, very enthusiastic adjective. Maybe it's both.
Heisenberg, they may or may not actually be listening right now, really is hard to tell. Matt H. The H is still classified mystery, still very much alive. Thank you all so much.
You are absolutely wonderful.
Those are just a few members of Smashing Security Plus, which means that they get their episodes ad-free and earlier than the general public, and they can have their names drawn out of the hat at random to be mercilessly mocked at the end of the show.
If you fancy a bit of that, just go over to smashingsecurity.com/plus for all of the details. It'll cost you probably less than a cup of fancy coffee, I suspect.
Not being a coffee drinker myself, I'm not really sure what I'm talking about. But anyway, I imagine it costs about that much.
You can become a patron, but you can also support the show in plenty of other ways which don't cost a penny.
You can like, you can subscribe, you can leave a five-star review wherever you listen, and you can of course tell your friends about the show.
I think that's one of the most effective ways you can help, and I really do appreciate it. Spread the word because every little bit helps, and it makes all of the effort worthwhile.
Well, I hope you will tune in again next week for another episode of Smashing Security. Cheerio! Bye bye.
And huge thanks, of course, to Lianne Potter for joining us this week and to this episode's sponsors, Arctic Wolf, NordLayer, and Vanta.
And we've also got to thank our fantastic Patreon supporters, members of Smashing Security Plus. We're going to pull some out of the hat right now. Julian Beach, tremendous name.
Sounds like somewhere you'd go for a very nice holiday. Adina Bogut O'Brien, she's back again with the hyphen and the apostrophe. Very impressive.
Still probably the most punctuated name on the list. Vladimir Jirasek, who sounds like, well, he— a lot of final boss energy about him, I suspect.
Mark Norman, Andrew Davison, Skadone, still unflinchingly lowercase Skadone, still not explaining anything about that name.
Panos, Tepotastic, which I don't know if that's a Finnish name or a very, very enthusiastic adjective. Maybe it's both.
Heisenberg, they may or may not actually be listening right now, really is hard to tell. Matt H. The H is still classified mystery, still very much alive. Thank you all so much.
You are absolutely wonderful.
Those are just a few members of Smashing Security Plus, which means that they get their episodes ad-free and earlier than the general public, and they can have their names drawn out of the hat at random to be mercilessly mocked at the end of the show.
If you fancy a bit of that, just go over to smashingsecurity.com/plus for all of the details. It'll cost you probably less than a cup of fancy coffee, I suspect.
Not being a coffee drinker myself, I'm not really sure what I'm talking about. But anyway, I imagine it costs about that much.
You can become a patron, but you can also support the show in plenty of other ways which don't cost a penny.
You can like, you can subscribe, you can leave a five-star review wherever you listen, and you can of course tell your friends about the show.
I think that's one of the most effective ways you can help, and I really do appreciate it. Spread the word because every little bit helps, and it makes all of the effort worthwhile.
Well, I hope you will tune in again next week for another episode of Smashing Security. Cheerio! Bye bye.
Host:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Guest:
Lianne Potter:
/ Lianne Potter
Episode links:
- US cloud ‘kill switch’ is as dangerous as ransomware, European businesses fear – IT Pro.
- Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M – Decrypt.
- Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison – US Department of Justice.
- Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt – The Hacker News.
- Free tokens for sale: How fake signups drive AI fraud – Okta.
- Post by Rory Cellan-Jones – Bluesky.
- Inside Greatness: Telegram-Distributed M365 AiTM PhaaS – ZeroBEC.
- Tailscale.
- RustDesk.
- League of the Lexicon – Two Brothers Games.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
Sponsored by:
- Arctic Wolf – See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.
- NordLayer – the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.
- Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
Support the show:
You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.
Join Smashing Security PLUS for ad-free episodes and our early-release feed!
Follow us:
Follow the show on Bluesky, or join us on the Smashing Security subreddit, or visit our website for more episodes.
Thanks:
Theme tune: “Vinyl Memories” by Mikael Manvelyan.
Assorted sound effects: AudioBlocks.
