Why is a cute Star Wars fan website now redirecting to the CIA? How come Cambodia has become the world's hotspot for scam call centres? And can a WhatsApp image really drain your bank account with a single download, or is it just a load of hacker hokum?All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Allan Liska.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:How I found a Star Wars website made by the CIA - Ciro Santilli on YouTube.How the CIA failed Iranian informants in its secret war with Tehran - Reuters.Isis and al-Qaeda sending coded messages through eBay, pornography and Reddit - Independent.Games Without Frontiers: Investigating Video Games as a Covert Channel - IEEE.General David Petraeus used clever Gmail trick during affair - Network World.Cambodia is home to world’s most powerful criminal network: report - SCMP.How to protect yourself from suspicious messages and scams- WhatsApp.Is WhatsApp Safe? Tips for Staying Secure - WhatsApp.Hacked on WhatsApp – how to stay safe when using the messaging app - BBC.Just a GIF Image Could Have Hacked Your Android Phone Using WhatsApp - The Hacker News.Kon-Tiki: The Epic Raft Journey Across the Pacific - YouTube.Still Standing with Jonny Harris - CBC.Niki de Saint Phalle & Jean Tinguely - Myths & Machines - Hauser & Wirth.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Vanta– Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

In this week’s episode, Graham investigates the mysterious Iberian Peninsula blackout (aliens? toaster? cyberattack?), Carole dives in the UK legal aid hack that exposed deeply personal data of society's most vulnerable, and Dinah Davis recounts how Instagram scammers hijacked her daughter’s account - and how a parental control accidentally saved the day.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by special guest Dinah Davis.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:418 - I’m a teapot - MDN Web Docs.2025 Iberian Peninsula blackout - Wikipedia.What could have caused the major power outage in Spain and Portugal? Experts weigh in - Euro News.Spain investigates cyber weaknesses in blackout probe - Financial Times.Report on Working Conditions at INCIBE, the company Investigating the blackout - El Cierre Digital.My Teen's Instagram Account was Hacked - Dinah Davis.We Got Her Account Back, Here’s What the Forensics Revealed - Dinah Davis.'Significant amount' of private data stolen in Legal Aid hack  - BBC News.Civil legal aid: millions still without access to justice - The Law Society.Civil representation - Legal aid data - GOV.UK.Legal aid statistics England and Wales bulletin Oct to Dec 2024  - GOV.UK.Funding for justice down 22% since 2010 - Bar Council. The Assembly - ITV.The Assembly review – this celebrity interview show is going to be massive - The Guardian.

Don't get duped, doxxed, or drained! In this episode of "Smashing Security" we dive into the creepy world of sextortion scams, and investigate how crypto wallet firm Ledger's Discord server was hijacked in an attempt to phish for cryptocurrency recovery phrases.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Plus! Don't miss our featured interview with Drata's Matt Hillary.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:Ledger secures Discord after hacker bot tried to steal seed phrases - CoinTelegraph.Binance Founder CZ Warns: Ledger Discord Hack Targets Recovery Phrases - CoinPedia.Ledger confirms physical scam letters requesting seed phrase in fake security upgrade - The Block.Physical addresses of 270K Ledger owners leaked on hacker forum - Bleeping Computer.Criminals are mailing altered Ledger devices to steal cryptocurrency - Bleeping Computer.New Hello Pervert Email Attack Warning — ‘I Know Where You Live’ - Forbes.‘Hello pervert’: the sextortion scam claiming to have videoed you - The Guardian."Hello Pervert" Email Is A Total Scam - What You Need To Know - Malware Tips.Scam email sent from my own email address - Microsoft Community.Thunderbolts* review: 'The greatest Marvel offering in years' - BBC.Limelight, Exemplar - BBC Radio 4.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.Dashlane - Protect against the #1 cause of data breaches - poor password habits. Save 25% off a new business plan, or 35% off a personal Premium plan!

Brits face empty shelves and suspended meal deals as cybercriminals hit major high street retailers, and a terminated Disney employee gets revenge with a little help with Wingdings. Plus Graham challenges Carole to a game of "Malware or metal?", and we wonder just happens when you have sex on top of a piano?All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Plus! Don't miss our featured interview with Jon Cho of Dashlane.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:Why is the M&S cyber attack chaos taking so long to resolve? - BBC News.M&S 'had no plan' for cyber attacks, insider claims, with 'staff left sleeping in the office amid paranoia and chaos' - Sky News.Hackers target the Co-op as police probe M&S cyber attack - BBC News.Harrods latest retailer to be hit by cyber attack - BBC News.Alleged ‘Scattered Spider’ Member Extradited to US - Krebs on Security.British 'ringleader' of hacking group 'behind M&S cyber attack' fled his home after 'masked thugs burst in and threatened him with blowtorches' - Daily Mail.Incidents impacting retailers – recommendations - NCSC.Ex-Disney employee gets 3 years in the clink for goofy attacks on mousey menus - The Register. United States of America V Michael Sheuer - Plea Agreement - US District Court PDF.The Tall Guy - IMDB.At 99, David Attenborough shares strongest message for the ocean - Oceanographic magazine.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Dashlane - Protect against the #1 cause of data breaches - poor password habits. Save 25% off a new business plan, or 35% off a personal Premium plan! Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

He's not a pop star, but Jeffrey Bowie is alleged to have toured staff areas of a hospital in Oklahoma, hunting for computers he could install spyware on. We dive into the bizarre case of the man accused of hacking medical networks and then sharing how he did it on LinkedIn. Plus! Move over Nigerian princes — the WASPI scams are here. Fraudsters are now targeting UK women born in the 1950s, exploiting pension injustice for phishing gain.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:Cybersecurity Firm CEO Charged with Installing Malware on a Hospital Computer - HIPAA Journal.Edmond cybersecurity CEO accused in major hack at hospital - YouTube.Jeffrey Bowie’s post on LinkedIn - Wayback Machine.Martin Lewis issues scam warning as fraudsters use him to target WASPI women - Metro News.‘Waspi’ women warned over fake compensation websites - The Guardian.WASPI campaigners warn of "dangerous" spike in fake compensation scams - Financial Reporter.National Trust.Wallet Creator - iOS App Store.DIY Dubai chocolate: Ravneet Gill’s recipe for crunchy pistachio chocolate - The Guardian.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!1Password Extended Access Management – Secure every sign-in for every app on every device.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via Patreon or Apple Podcasts for ad-free...

Graham explores how the Elusive Comet cybercrime gang are using a sneaky trick of stealing your cryptocurrency via an innocent-appearing Zoom call, and Carole goes under the covers to explore the extraordinary lengths bio-hacking millionaire Bryan Johnson is attempting to extend his life.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:Elusive Comet advisory - Security Alliance.Mitigating Elusive Comet Zoom remote control attacks - Trail of Bits.Aureon Capital: The Fake VCs who Almost Hacked Me - David Z Morris.Requesting or giving Remote Control - Zoom knowledgebase article.Has Bryan Johnson’s anti-aging experiment backfired? Biohacker spending $2 million-a-year admits to a costly misstep - Economic Times.  How Blueprint Founder Bryan Johnson Sought Control Via Confidentiality Agreements - The New York Times.Anti-aging mogul Bryan Johnson claims NY Times preparing ‘hit piece’ about alleged use of prostitutes, drugs - NY Post.KOReader - document reader for E Ink devices.Killing Thatcher: The IRA, the Manhunt and the Long War on the Crown - Bookshop.org.The Urge - Our history of addiction by Carl Erik Fisher.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!1Password Extended Access Management – Secure every sign-in for every app on every device.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via

QR codes are being weaponised by scammers — so maybe think twice before scanning that parking meter. And in a blunder so dumb it makes autocorrect look smart, the White House explains how it leaked war plans on Signal because an iPhone mistook a journalist for a government insider.Plus! Don't miss our featured interview with Josh Donelson of Material and Tony Albano from Google, about detection and response in today's AI-driven world.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:The Trump Administration Accidentally Texted Me Its War Plans - The Atlantic.Here Are the Attack Plans That Trump’s Advisers Shared on Signal - The Atlantic.How the Atlantic’s Jeffrey Goldberg got added to the White House Signal group chat - The Guardian.From convenience to compromise: The rising threat of quishing scams - Fast Company.Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware - Hacker News.QR Code Statistics 2024: Trends & Use Cases - QR Code.Honey Garlic Scallop Kabobs - Heinz.With QR Code Redemption Set to Surge to 5.3 Billion in 2025, Cybercriminals will Increase Their Quishing Attacks - Wealth & Finance International.Chess Masters: The End Game - BBC iPlayer.Cribbage Classic - iOS app store.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Material - Email security that covers the full threat landscape – stopping new flavors of phishing and pretexting attacks in their tracks, while also protecting accounts and data from exploit or exposure.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!1Password Extended Access Management – Secure every sign-in for every app on every device.SUPPORT THE...

Renowned cybersecurity expert Troy Hunt falls victim to a phishing attack, resulting in the exposure of thousands of subscriber details, and don't lose your life savings in a whisky scam...All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Plus! Don't miss our featured interview with Alastair Paterson, CEO and co-founder of Harmonic Security, discussing how companies can adopt Generative AI without putting their sensitive data at risk.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:A Sneaky Phish Just Grabbed my Mailchimp Mailing List - Troy Hunt.Thunderbird breach notice.Opération Cactus - Le Groupement d’Intérêt Public Action contre la Cybermalveillance.Cancer patient lost life savings to whisky barrel scammers - BBC. How to spot an investment scam - Saga Money.More than £612 million was lost to investment fraud in the UK last year - City of London Police. Adolescence - Netflix.Behind the scenes of Adolescence - YouTube.Thames Water: Inside the Crisis - BBC iPlayer.Who let the BBC inside Thames Water? - The New Statesman.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Harmonic - Let your teams adopt AI tools safely by protecting sensitive data in real time with minimal effort. Harmonic Security gives you full control and stops leaks so your teams can innovate confidently.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Acronis Threat Research Unit - Your secret weapon against cyber attacks. Access the reports now.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or

A YouTuber has unleashed an innovative AI bot army to disrupt and outwit the world of online scammers, and a New York Times investigation looks into the intricate web of global money laundering.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:O2’s AI granny Daisy unveils what she’s learnt from her time on the phone to scammers – and what you can do to ruin their day - O2.Lenny - The Telemarketing Troll.I Built a Bot Army that Scams Scammers - Kitboga on YouTube.Takeaways From Our Money Laundering Investigation - The New York Times.Infiltrating scammer networks with the world’s top fraud fighters - YouTube.Open Street Map - Open Street Map.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before. 1Password Extended Access Management – Secure every sign-in for every app on every device.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!FOLLOW US:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.This...

In episode 409 of the "Smashing Security" podcast, we uncover the curious case of the Chinese cyber-attack on Littleton's Electric Light Company, and a California landlord's hidden camera scandal. All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:This is the FBI, open up. China's Volt Typhoon is on your network - The Register.Landlord recorded nude videos of woman tenant with cameras hidden in bedroom smoke detectors, lawsuit says - The Independent.Landlord arrested after tenant discovers hidden camera in rented room - PBSO.Hidden Cameras: What Travelers Need to Know - The New York Times.Shakespeare insults t-shirt - Royal Shakespeare Company.OAS Exhibitions - Oxford Art  Society.Carole’s “Rusty Sage” - Bluesky.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before. Acronis Threat Research Unit - Your secret weapon against cyber attacks. Access the reports now.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!FOLLOW US:Follow us on Bluesky or Mastodon, or on the

The story of how hackers managed to compromise the US Government's official SEC Twitter account to boost the price of Bitcoins, AI isn't helping reduce the rife conspiracy theories inside classrooms, and is the funeral bell tolling for ransomware?All this and more is discussed in episode 404 of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by special guest Jane Wakefield.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:SEC's Twitter account hacked to say Bitcoin ETFs approved - Hot for Security.Twitter says it’s not its fault the SEC’s account got hacked - Graham Cluley.SEC Twitter hack blamed on SIM swap attack - Hot for Security.The SEC’s X account got hacked by a 25-year-old who went by ‘AGiantSchnauzer’ and got paid in Bitcoin, feds say - Fortune.Pupils share conspiracy theories for fun, with girls ‘more susceptible’ - The Times.AI chatbots unable to accurately summarise news, BBC finds - BBC News.US-led cybersecurity coalition vows to not pay hackers' ransom demands - TechCrunch.35% Year-over-Year Decrease in Ransomware Payments, Less than Half of Recorded Incidents Resulted in Victim Payments - Chain Analysis.Ransomware: proposals to increase incident reporting and reduce payments to criminals - GOV.UK.The 2024 Ransomware Landscape: ‘Looking back on another painful year’ - IT Wire.The Space Doctor’s Big Idea by Randall Munroe - The New Yorker.Reading guide: Creation Lake by Rachel Kushner - Booker Prizes.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored...

In episode 403 of "Smashing Security" we dive into the mystery of $65 million vanishing from Coinbase users faster than J-Lo slipped into Graham's DMs, Geoff gives a poor grade for PowerSchool's security, and Carole takes a curious look at QR codes.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by The Lazarus Heist's Geoff White.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:ZachXBT’s thread - Twitter.Coinbase employee tells users not to use a VPN or ad blocker - Twitter.What PowerSchool won’t say about its data breach affecting millions of students - TechCrunch.QR code - Wikipedia.Reed–Solomon error correction - Wikipedia.Urgent warning over QR code scam tricking drivers out of £100s at popular car parks - Express.Scam alert: QR code on an unexpected package - Consumer AdviceNew Star Blizzard spear-phishing campaign targets WhatsApp accounts - Microsoft Security Blog.What You Must Know Before Scanning a QR Code - AARP.“More” - Niall Conlon.“Money Men” by Dan McCrum - Penguin Books.Bitter Orange Marmalade Recipe - Ballymaloe Cooking School.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Tailscale – Tailscale is perfect for work or personal projects, making networking simple. Its free plan covers up to 100 devices and 3 users. Get started at tailscale.com and be up and running in less than 10 minutes!1Password – Secure every app, device, and identity – even the unmanaged ones at 1password.com/smashing.Cortex Symphony 2025 -...