Scinary Information Nexus

Welcome back to the Scinary Information Nexus! This week, Richard, Joseph, Hunter, and Mario kick things off by suffering through "The Trojan Horse", a cocktail spiked with ghost pepper tincture, before jumping straight into two wild cybersecurity stories breaking across the industry. First up, Joseph breaks down a fresh attack chain uncovered in the Scinary SOC: cybercriminals are buying Google ads that funnel users searching for ChatGPT directly to malicious custom GPT models hosted right on OpenAI. Once there, the custom model fakes an error message and redirects victims to a ClickFix CAPTCHA lure, tricking them into pasting malicious PowerShell commands that sideload dangerous DLLs. Next, the crew digs into the explosive news surrounding ransomware negotiators cutting covert deals with cybercrime syndicates like ShinyHunters. We break down the arrest of Edward Dubrovsky, allegations against MonsterCloud, and the twisted financial incentives that plague the incident response and cyber insurance racket. Finally, we take a quick detour to France, where script kiddies weaponized an old 2021 controller vulnerability to spoil industrial refrigerators. In this episode, we discuss: How Google search ads are steering users toward malicious custom GPT models on OpenAI. The ClickFix trap: Why you should never paste terminal commands from a fake CAPTCHA. DLL sideloading and how attackers abuse signed applications for exfiltration. The arrest of ransomware negotiator Edward Dubrovsky and ties to ShinyHunters. "Ransomware drop-shipping" and why some firms secretly buy decryptors at a markup. Why Scinary offers incident response without billable-hour conflicts of interest. How an unpatched 2021 OT vulnerability spoiled refrigerated food in France. Have you seen ClickFix lures pop up in your organization, or did the ransomware negotiator scandal catch you off guard? Let us know in the comments below! Connect with Us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 05:45 Weaponized Custom GPTs & ClickFix 28:45 Corrupt Ransomware Negotiators & ShinyHunters 49:25 Hacked French Refrigerators: OT Vulnerabilities Cybersecurity #InfoSec #Ransomware #Malware

Welcome back to the Scinary Information Nexus! This week, Richard, Joseph, and Mario are joined by Hunter Isham (stepping in while Brazos travels) for a spooky season special complete with themed Halloween cocktails. We're answering listener survey feedback and focusing squarely on the day-to-day chaos facing K-12 tech directors. Before getting into the heavy threats, we share a wild investigation from the SOC: an emergency alert about elementary school computers supposedly compromised and blaring profanity-laced music at full volume. Spoiler alert: the culprit wasn't an advanced threat actor, it was an unmonitored YouTube autoplay left running overnight. Then, we tackle the serious security headaches hitting school districts. We break down the rise of automated polymorphic phishing, where attackers abuse legitimate platforms like Google Docs and dynamically switch senders and cheap domains to slip past email gateways. Plus, we examine the Frontline Education breach and confront a tough reality: why compliance badges like SOC 2 and StateRAMP don't guarantee third-party assurance, and why districts need to shift from chasing zero breach probability to minimizing operational impact. In this episode, we discuss: Why annual checkbox compliance training fails to stop phishing attacks. How automated polymorphic phishing bypasses traditional email security filters. Attackers abusing Google Docs share notifications and .cfd domains. A hilarious SOC incident response story featuring overnight YouTube autoplay. The Frontline Education breach and downstream supply chain risks like JetBrains TeamCity. Why true third-party vendor assurance is an impossible promise. Reframing your security posture: focus on reducing operational impact over zero probability. How does your team verify vendor security, and do you trust compliance badges like SOC 2? Let us know in the comments below! Connect with Us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 08:45 Automated Polymorphic Phishing in K-12 23:30 Incident Response: YouTube Autoplay False Alarm 27:45 Third-Party Assurance & Frontline Education 41:00 Reducing Breach Impact & Incident Response Cybersecurity #InfoSec #Phishing #SupplyChainSecurity #K12Cybersecurity #EmailSecurity #DataBreach #IncidentResponse

Welcome back to the Scinary Information Nexus! This week, Richard, Joseph, and Brazos are joined by Sebastian Barron, Vice President of Technology Services at Paris Junior College, to talk about what happens when IT stops being just a ticket-clearing help desk and steps into executive strategy. Sebastian walks us through how PJC overhauled its campus infrastructure, fiber backbone, and security posture in a two-year sprint alongside a brand-new leadership cabinet. We break down the reality of shadow IT and why blanket AI bans never work. Instead of locking down tools, Sebastian shares PJC's "paving the road" approach: deploying sanctioned enterprise AI tools, running local models, and enabling campus staff to build custom software that solves real bottlenecks. We also tackle new AI compliance rules under Texas Administrative Code (TAC) 219, look at how AI fits into security operations without cutting out human oversight, and debate whether alumni email accounts are ticking time bombs in our "Hot Take or Hard Truth" segment. In this episode, we discuss: Moving IT from reactive help desk ticketing to core executive strategy Why banning AI fails and how "paving the road" beats shadow IT Replacing clunky spreadsheets with AI-built apps (and the risks of vibe coding) Navigating TAC 219 AI governance and compliance in higher education Keeping humans in the loop for incident response and security operations Hot Take or Hard Truth: Why dormant alumni accounts are a security nightmare Hands-on technical skills vs. purely academic theory in IT careers How is your organization handling shadow IT and AI adoption? Are you banning it or paving the road? Let us know in the comments below! Connect with Us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 06:30 Paving the Road for Campus AI 17:15 Vibe Coding & Rapid App Development 25:45 AI Governance & TAC 219 Compliance 39:45 AI in SecOps & Help Desk Automation 46:00 Hot Takes: Alumni Accounts & Hands-On Tech Cybersecurity #InfoSec #NetworkSecurity #VibeCoding

Welcome back to the Scinary Information Nexus! This week, the crew had to toss their planned agenda out the window. Richard, Joseph, Mario, and Brazos jump in for an emergency breakdown of an aggressive phishing wave battering K-12 school districts and higher ed institutions. Attackers are weaponizing legitimate Google Docs and using Adversary-in-the-Middle (AiTM) proxies to harvest credentials and bypass traditional MFA. Because the phishing notifications originate straight from Google's own servers, they breeze past standard SPF, DKIM, and DMARC checks. Once inside, threat actors hijack internal distribution lists to spread laterally, creating a virtual denial of service for IT teams through sheer operational attrition. Even worse, standard password resets aren't cutting it. Attackers are locking in persistent cloud access with rogue OAuth application grants, hidden MFA enrollments, and rogue device keys. We break down how this campaign works, examine the CAPTCHA fatigue driving users straight toward ClickFix social engineering lures, and share concrete hardening tactics you can implement inside Google Admin right now to lock down your domain. In this episode: Anatomy of the breach: How weaponized Google Docs bypass email authentication filters. AiTM in action: Why traditional MFA fails against adversary-in-the-middle session theft. Cloud persistence traps: How rogue OAuth permissions and device keys survive password resets. Denial of service by attrition: The hidden toll of high-velocity account takeovers on IT teams. CAPTCHA fatigue: How flagged outbound IPs prime users for ClickFix social engineering. Hardening Google Admin: Disabling student directory lookups and ditching formulaic passwords. The Google Workspace dilemma: Free EDU tiers and gated security features. Has your organization noticed a spike in AiTM phishing or Google Docs lures lately? Let us know in the comments how your team is responding! Connect with Us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 01:45 Google Docs Phishing & AiTM MFA Bypass 07:00 Cloud Persistence: Rogue OAuth & Device Keys 11:45 IT Attrition & CAPTCHA Fatigue Risks 21:15 Hardening Google Admin & Zero Trust 33:45 Google Ecosystem & Prompt Injections Cybersecurity #InfoSec #Phishing

Welcome back to the Scinary Information Nexus! Texas is teasing us with a little "false fall" weather, and the crew is back in the studio to talk through brand-new state AI mandates, sneaky phishing tricks, and some classic hacker trivia. This week, Richard, Joseph, Mario, and Brazos break down the newly released Texas Administrative Code TAC 219. If you work in Texas local government, a state agency, or a K-12 public school district, big changes are heading your way. From naming an official AI Risk Officer and adopting the state AI code of ethics published by DIR to inventorying AI systems and handling "heightened scrutiny" assessments, we walk through what IT teams actually need to do right now. We also look at a new ransomware-as-a-service strain hitting edge devices, plus compromised Google accounts sharing docs that trigger real Google CAPTCHAs to fool users. To wrap things up on a fun note, the guys face off in a retro cyber trivia showdown featuring phreakers, Cap'n Crunch whistles, the Morris Worm, and Janet Jackson crashing hard drives. In this episode: TAC 219 explained: What Texas's new AI governance rules mean for local government and public schools Designating an internal AI Risk Officer and adopting DIR's AI code of ethics What counts as a "heightened scrutiny" AI system and how impact assessments work The compliance headaches of commercial software with built-in AI features A new Rust and C++ ransomware-as-a-service strain targeting edge devices and SSL VPNs Compromised Google accounts abusing shared docs and CAPTCHAs for phishing Cyber history trivia: Blue boxes, Cap'n Crunch, the Morris Worm, and who really coined "EDR" Is your organization prepared to inventory every AI tool you use, or does TAC 219 feel overwhelming? Let us know in the comments! Connect with us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 04:50 Cyber News & Google Docs Phishing 11:15 TAC 219: Texas AI Governance Breakdown 37:45 Retro Hacking & Cybersecurity Trivia 48:30 Road to 500 Subscribers & Wrap-Up Cybersecurity #InfoSec #Phishing #Ransomware #TechNews #Compliance