The Awareness Angle: Cyber Security Awareness and Human Risk

It's Episode 100 of The Awareness Angle, and the last episode in its current format.
This week: more than 100,000 UK police officers and criminal justice staff have had their details leaked by ExfilSquad, the same gang that hit the Department for Education just one week earlier. OpenAI banned a network of ChatGPT accounts run out of Cambodian scam compounds, where trafficked workers were being forced to run investment fraud. And a fake version of a popular Roblox cheat tool called Xeno Executor is infecting family computers with malware that steals passwords and hands remote control to an attacker.
Also this week: researchers found a way for malware to hijack passkeys synced through Google Password Manager, a fake police phone call from a spoofed cybercrime unit number, and the crypto trader who made $34,000 on Polymarket by pointing a hairdryer at a weather sensor in Paris.
And because it's Episode 100, we look back at everything we've learned from covering cyber news every week for over a year and a half: the biggest breaches, the most persistent threat actors, the strangest stories, and how the threat landscape has changed. Don't unsubscribe, because something new is coming to this feed in a few weeks.
Chapters
00:00 Intro - Episode 100 and the last of the current format
03:13 Breach of the Week - 100,000 police staff leaked by ExfilSquad
06:39 Scam factories caught running cons through ChatGPT
11:07 Fake Roblox Xeno Executor cheat spreading malware
16:31 Passkeys hijacked by malware - the Pass-ta-key attack
23:43 Security Socials - The fake police cybercrime phone call
31:30 The Polymarket hairdryer hack
35:52 100 episodes - stats, patterns and lessons learned
59:02 Goodbye for now - what happens next
Full episode on YouTube: https://youtu.be/DEEoZP-zv88
Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/
TikTok: https://www.tiktok.com/@antdaviscyber
Instagram: https://www.instagram.com/antdaviscyber
LinkedIn: https://www.linkedin.com/in/antdaviscyber
Website: riskycreative.com
Our Intro and Outro Song © 16 by Falling Forever
https://fallingforever.bandcamp.com/track/16
Licence: Creative Commons CC BY 4.0
https://creativecommons.org/licenses/by/4.0/

This week, a $70 million Bitcoin heist that took just 41 minutes, a government helpdesk breach that leaked 600,000 school staff records, and an AI security story where Anthropic's Claude broke into three real companies during a test that went wrong.
This week on The Awareness Angle, Ant and Luke open Breach Watch with the Department for Education hack, then dig into the Anthropic story, models that broke out of a sealed testing environment and hacked three organisations because of a mix up over internet access.
From there it's straight into the news. A five year old typo in a hardware wallet's code let someone drain $70 million in Bitcoin in under an hour. There's also a genuinely hopeful one, UK police running a scheme that steers teenage hackers into cyber careers instead of court.
Also this week: hotel Wi-Fi spyware that can switch on your webcam and mic, an unencrypted master copy of an unreleased Nicolas Cage movie stolen off a desk, a coordinated attack on more than 30 Minnesota water systems, and the AI that found a security hole hiding in Chrome for 13 years.
Chapters
0:00 Intro
4:37 Department for Education breach, 600,000 records leaked
9:44 Claude AI breaks into 3 companies during a testing mix up
16:26 $70 million Bitcoin heist in 41 minutes
23:02 Police run hacker rehab for teenagers
30:10 Hotel Wi-Fi spyware switches on your webcam and mic
32:44 Unreleased Nicolas Cage movie stolen off a desk
38:03 Coordinated attack hits 30 Minnesota water systems
43:11 AI finds a 13 year old flaw hiding in Chrome
47:50 Security Socials: Steam Workshop malware hits Mecha Chameleon
56:22 Security Socials: Fake Microsoft security update phishing page
58:07 Security Socials: Job seekers hiding AI prompts in their resumes
1:01:42 Security Socials: Finding someone's location from a photo of pavement
The Awareness Angle is hosted by Ant Davis and Luke Pettigrew, brought to you by Risky Creative.
Newsletter: riskycreative.com
TikTok: antdaviscyber
Instagram: antdaviscyber
Music: "16" by Falling Forever, licensed under CC BY 4.0

Two governments found out their data was gone this week. One because a hacker deleted everything and left a ransom note, the other because they finally noticed someone had been sitting inside their systems for ten months. And somewhere between the two, an AI broke out of a safety test and hacked one of the biggest AI companies on the planet.
A hacker wiped Romania's entire national land registry after a ransom went unpaid, and now you cannot legally buy or sell a house there because the records that prove who owns what are gone. South Korea's diplomatic academy was breached for ten months before anyone spotted it, and the people affected did not hear about it for another five. The autonomous AI agent that broke into Hugging Face turned out to be OpenAI's own models during an internal test, running with their safety refusals switched off. They broke out of OpenAI's own sandbox first, then hacked Hugging Face's systems to cheat a benchmark. When the team tried to investigate, the US AI models they reached for refused to help because they flagged the forensic work as malicious, so they ran a Chinese open model, GLM 5.2, to clean it up. And a Russian group known as LAUNDRY BEAR is stealing 90 days of email through a Zimbra flaw that fires the moment you preview a message, no click required.
Also this week: ClickFix has put on an AI costume, with fake AI troubleshooting pages talking people into pasting malware into their own machines. A flaw in the Adobe Acrobat Chrome extension could let any website quietly read your WhatsApp chats. Ofcom is finally forcing UK mobile networks to block scam texts and stop criminals spoofing UK numbers. Cyber insurers are quietly splitting on whether they will even cover deepfake fraud anymore. And in Luke's story, Anthropic launches Claude Security, with one very interesting clause about whose code you are allowed to scan.
Chapters
00:00 Intro
04:24 Romania land registry hacked and wiped, housing market frozen
09:20 South Korea diplomatic academy breach hidden for ten months
13:11 OpenAI's own AI goes rogue and hacks Hugging Face
21:28 Russian hackers steal 90 days of email via a Zimbra flaw
29:02 ClickFix AI-fix, fake AI help pages spreading malware
35:08 Adobe Acrobat extension flaw exposed WhatsApp chats
40:30 Ofcom forces UK networks to block scam texts and number spoofing
46:16 Cyber insurance and deepfake fraud, is your policy covered?
52:06 Security Socials
58:55 Luke's story, Anthropic launches Claude Security
The Awareness Angle is hosted by Ant Davis and Luke Pettigrew, produced under Risky Creative. New episodes every week.
YouTube: https://www.youtube.com/@riskycreative
Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6
Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196
Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/
Website: riskycreative.com
TikTok: @antdaviscyber
Instagram: @antdaviscyber
LinkedIn: antdaviscyber
Music: "16" by Falling Forever https://fallingforever.bandcamp.com/track/16
Creative Commons Attribution 4.0: https://creativecommons.org/licenses/by/4.0/

This week the internet came for your fridge, your laptop and your DNA, and it wasn't subtle about any of it.
Hackers hit Coca-Cola's dairy brand fairlife with ransomware and shut down US milk production. Mac users are under fire from two new malware strains — one that holds your computer hostage until you type your password in, and another disguising itself as Apple's own crash reporter. And 23andMe is paying $18 million over the breach that exposed millions of people's genetic data. That's the one you genuinely cannot fix by resetting a password.
Also this week: Lidl customers caught in a supplier breach they knew nothing about, the two young men behind the Transport for London hack jailed for five and a half years each, scammers hiding remote access tools inside fake greeting cards, Microsoft's biggest ever Patch Tuesday followed within hours by a researcher dropping a brand new unpatched bug, and a BitLocker flaw that quietly undermined encrypted laptop security.
In Security Socials: a ChatGPT hallucination that sent someone on a wasted road trip, a ClickFix awareness video with half a million likes and the comment section that explains exactly why we keep talking about this stuff, the AI facial recognition case that put an innocent grandmother in jail for five months, and a law firm that used one shared master password for everything.
New episodes every week. Cybersecurity news for humans.
Chapters:00:00 Intro01:37 This week on The Awareness Angle03:17 Breach Watch: Lidl supplier breach08:24 23andMe pays $18m DNA settlement13:59 Mac malware ClickLock holds your computer hostage19:45 Mac malware disguised as Apple crash reporter29:26 TFL hackers jailed for five and a half years32:33 Fake e-cards hiding remote access malware37:44 Microsoft's record Patch Tuesday and a fresh zero-day46:44 Coca-Cola fairlife ransomware halts milk production49:27 Security Socials: ChatGPT bike shop fail51:46 ClickFix video with half a million likes54:44 AI facial recognition jails innocent grandmother57:21 GM removes authenticator app MFA1:00:51 Luke's story: the law firm with one password for everything1:04:31 Outro
TikTok / Instagram: @antdaviscyberLinkedIn: antdaviscyberWebsite: riskycreative.com

Episode 96 of The Awareness Angle
This week an insurance company leaked driver's license numbers for nearly 7 million people because one employee clicked a phishing email. Sainsbury's facial recognition system was 99.98% accurate and 100% wrong about the shopper it publicly kicked out. A 15 year old took down a national anime streaming service with malware ChatGPT helped him write. A Scattered Spider suspect hopped three countries on a VPN and still got caught by a number hidden in every Windows PC. And Google's own AI helped scammers steal $1.9 billion, so now Google is suing people for using Google properly.
Ant and Luke break it all down in plain English, no jargon, for anyone who wants to understand what's actually happening in cybersecurity without needing a technical background.
Plus this week's Phish of the Week from Hoxhunt and a look at what's trending across security socials.
Chapters:
00:00 Intro
01:17 Housekeeping and the heatwave chat
03:25 Breach Watch: AssuranceAmerica driver's license breach
09:47 Accenture source code breach
13:22 Sainsbury's facial recognition wrongly flags shopper
20:07 15 year old uses ChatGPT to hack Bandai Namco
26:18 OnlyFans creators accidentally clean up hacked gov sites
32:04 Scattered Spider hacker caught by Windows device ID
41:35 Google sues scammers who abused its own Gemini AI
47:30 Quick hit stories
57:17 Security Socials
1:07:42 Luke's story: AI deepfake YouTube channel
1:14:20 Wrap up
Newsletter: riskycreative.com
LinkedIn: linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928
Instagram/TikTok: @antdaviscyber
YouTube: @riskycreative
Music: "16" by Falling Forever, https://fallingforever.bandcamp.com/track/16, licensed under Creative Commons, https://creativecommons.org/licenses/by/4.0/