ShadowTalk: Powered by ReliaQuest

494 Episodes

Reverse

DPRK Insider Threats: How Remote-Worker Tactics Are Evolving

2026-10-0730:01

Security leaders should be asking a hard question: if a remote hire looks legitimate at every checkpoint, what would expose the operation? Security operations is the defense layer of the business, and the teams defending it need AI to move faster across the full environment. In this episode of ShadowTalk, Daxton Wirth and John Dilgen share practical guidance on what to verify, where teams miss inconsistencies, and how HR, onboarding, identity, and security can investigate together before acce...

CISO Wisdom: Turning Security Investments Into Measurable Risk Reduction

2026-09-3033:13

Security teams are contending with more tools, alerts, and vulnerabilities than ever—but volume does not necessarily equal security. Jigar Shah joins us to discuss how organizations can automate repetitive work, prioritize vulnerabilities based on business risk, build identity-driven security strategies, and connect cybersecurity investments to measurable outcomes. With two decades of leadership experience across healthcare, financial services, retail, and consulting, Jigar brings a business-...

Fake NDAs, Real Money: Inside the M&A Social Engineering Playbook

2026-09-2328:07

In this episode, we examine the Phantom Deal campaign, in which threat actors used publicly available details about companies’ acquisition histories, subsidiaries, executives, and employees to create convincing fake M&A scenarios. The goal: persuade employees to initiate large financial transfers while keeping conversations off corporate communication channels. We also cover a recent series of zero-day disclosures affecting major endpoint-security and Windows products. These vulnerabiliti...

From Vulnerability Research to Domain Admin in Minutes

2026-09-1631:25

AI is changing the economics of cyberattacks. In this episode, we examine how a suspected threat actor used AI agents to accelerate PaperCut vulnerability research, exploit development, target identification, and post-compromise activity—moving from initial access to domain administrator access in as little as seven minutes. We also explore recent reporting on large-scale AI-model distillation campaigns by China-based companies and what the increasing availability of frontier-level AI capabil...

One Empty Field: The Email Security Bypass Letting Attackers Impersonate Your Executives

2026-09-0929:54

Organizations rely on Microsoft 365's RejectDirectSend control to block internal email spoofing—but a structural gap lets attackers walk right past it. With nothing more than a basic Python script and an empty envelope sender, threat actors are impersonating executives, IT support, and finance teams to launch Business Email Compromise, payment fraud, and follow-on account takeover. Join hosts Alexandra Moore and John Dilgen as they discuss: How an empty email header field bypasses RejectDirec...

#box-pro-ellipsis-179187210584438{-webkit-line-clamp:2;}ShadowTalk: Powered by ReliaQuest