ShadowTalk: Powered by ReliaQuest

499 Episodes

Reverse

Claude Chat Invites and a Backdoored Coding Extension

2026-11-1128:59

In this episode of ShadowTalk, Brandon Tirado and John Dilgen look at two recent initial access campaigns that used Anthropic's Claude to gain trust. In the first, attackers turned Claude's real chat-sharing notifications into callback phishing lures. In the second, a tampered Claude Code extension in Cursor's marketplace planted a persistent SSH backdoor on developer machines. Learn what defenders can do now, from hunting for both attacks and reimaging affected hosts to governing developer e...

ARTEX for Everyone: What Widely Available AI Hacking Means for Defenders

2026-11-0427:47

In this episode of ShadowTalk, John Dilgen and Dylan Deane examine ARTEX, an AI-powered penetration-testing framework that was openly available on GitHub and is now appearing in real-world intrusions. Learn what defenders can do now—from rotating exposed credentials and treating application records as security telemetry to using AI-enabled red-team tools and exposure management to find viable attack paths before adversaries do. Resources: https://linktr.ee/ReliaQuestShadowTalk John Dilgen: C...

PHP2Shell: Inside the AI-Assisted Exploit Race

2026-10-2833:50

In this episode of ShadowTalk, John Dilgen and Alexandra Moore break down PHP2Shell, two critical vulnerabilities in PHP that sent the security community scrambling. With PHP powering roughly 70% of the web, the blast radius is unlike most vulnerability disclosures. The discussion pulls directly from ReliaQuest's own lab research: How AI tools compressed exploit development to under an hourWhy the initial attack sequence looks more like an application crash than a compromiseWhy a single PHP e...

QuartzLine: A PDF Viewer Deploying a Backdoor at Scale

2026-10-2124:07

In this episode of ShadowTalk, John Dilgen and Tehman Tariq examine QuartzLine, a malware campaign disguised as a legitimate, signed Windows PDF viewer. The application works as advertised while quietly maintaining persistence, stealing browser data, and waiting for instructions to deploy backdoors at scale. The discussion covers the campaign’s malvertising delivery chain, its evasion techniques, and why blocked C2 traffic should be treated as a confirmed compromise. Learn what defenders can ...

AI Attacks From the Front Lines

2026-10-1434:11

In this episode of ShadowTalk, John Dilgen and Alexandra Moore break down a campaign where AI carried out major parts of an intrusion. The conversation covers the attack flow, the feedback loop, and what defenders should change now. Attackers have gone agentic, gaining speed, scale, and lower skill barriers. Resources: https://linktr.ee/ReliaQuestShadowTalk John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest cust...

#box-pro-ellipsis-179456881544818{-webkit-line-clamp:2;}ShadowTalk: Powered by ReliaQuest