This week on The Awareness Angle, attackers ditch malware and pick up the phone. Optimizely confirms a breach after a vishing attack, proving again that the helpdesk is now the attack surface.
We’ve got fake QR codes stuck on real parking meters, Samsung’s weather app quietly fingerprinting devices, and the UK fining Reddit over children’s data.
Plus mental health apps with serious security flaws, a researcher accidentally taking control of 7,000 robot vacuums, and a brilliant example of using AI to build interactive awareness training in minutes.
The Awareness Angle makes more sense in full. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. If you prefer your cyber news with context, challenge and a bit of straight talking, this one’s worth your time.
Listen on your favourite podcast platform - Spotify, Apple Podcasts and YouTube
Listen Now
Podcast · Risky Creative
This week's stories...
Optimizely confirms breach after vishing attack
This wasn’t some cutting edge exploit. It was a phone call.
Attackers impersonated IT support, convinced staff to hand over SSO and MFA details, and got access to internal systems and CRM records. Optimizely says they didn’t escalate privileges or deploy backdoors, but the real story is how they got in.
We keep talking about this. MFA isn’t failing. People are being redirected around it.
If someone sounds credible, creates urgency, and claims to be internal support, most people don’t switch into “threat actor” mode. They switch into “helpful colleague” mode and that’s the gap.
For awareness teams, this is a great reminder about verification scripts, call back policies, and a chance to emphasise that support staff have permission to challenge authority.
The Awareness Angle
- Authority Is a Shortcut – When someone claims to be internal IT, most people default to cooperation. Attackers know that.
- MFA Can Be Socially Engineered – The control works, until someone convinces you to approve or share it.
- Support Teams Need Different Training – Helpdesks and IT aren’t just defenders. They are targets. Treat them that way in your awareness strategy.
Fake QR codes stuck on real parking meters
Cybercriminals placed fake QR stickers on 75 parking meters. Drivers scanned, landed on a convincing payment page, and almost handed over their details. No inbox. No malware. Just a sticker and a bit of time pressure.
When you’re paying for parking, you’re not thinking about threat modelling. You’re thinking about not getting a fine.
This is a brilliant story to use internally because it shows that the risk of QR codes hasn't gone away and must be bringing results or the cybercriminals wouldn't continue with it!
The takeaway is simple. Slow down. Check the URL. Use the official app or go to the web page instead of scanning whatever is in front of you.
The Awareness Angle
- Context Changes Behaviour – People don’t apply the same caution in a car park as they do in their inbox.
- Convenience Is the Bait – Quick pay shortcuts are designed to reduce friction. Attackers ride that same instinct.
- Teach Verification, Not Fear – The behaviour to reinforce is simple. Check the URL. Use official apps. Slow down before entering details.
Mental health apps with millions of installs and hundreds of flaws
Researchers found over 1,500 vulnerabilities across ten Android mental health apps, including AI therapy companions and CBT trackers. Collectively, they’ve been installed 14.7 million times.
People are using these apps at their lowest points. Logging thoughts. Sharing deeply personal struggles. And behind the scenes, insecure storage, weak session handling, and other issues are sitting there waiting to be abused.
This is not a “delete all apps” panic story. It’s a reminder that popularity isn’t the same as security. It's also not laying blame at the developer's door. Maybe, with all of the AI coding tools available, it's just become too easy to build something that isn't secure.
If you’re in awareness, this opens up a bigger conversation with some important things to check. App permissions. Update frequency. Who built this thing. When was it last maintained.
The Awareness Angle
- Sensitivity Should Raise Standards – The more personal the data, the higher the security bar should be.
- Install Numbers Mean Nothing – Millions of downloads create false confidence.
- Awareness Goes Beyond Email – App hygiene, updates, permissions and developer credibility are part of modern security literacy.
This Week's Discussion Points...
Ad Tech Firm Optimizely Confirms Data Breach After Vishing Attack Watch | Read
Fraudulent QR Codes Found on 75 Kelowna Parking Meters Watch | Read
Your Samsung Weather App Is a Fingerprint Watch | Read
UK Fines Reddit £14.47M for Using Children’s Data Unlawfully Watch | Read
Android Mental Health Apps With 14.7M Installs Found With Security Flaws Watch | Read
Instagram to Alert Parents if Teens Search for Self-Harm and Suicide Content Watch | Read
Security Flaw Allows Man to Accidentally Gain Control of 7,000 Robot Vacuums Watch | Read
Building Interactive Security Training With Gemini Watch
We Invented the Dacia Sandman and the Internet Fell for It Watch | Read
ClickFix Pop-Ups in the Wild Watch | Read
Samsung Privacy Display Feature Watch
Protect Yourself From This Latest Ahrefs Phishing Attack Watch
And finally...Building Interactive Security Training With Gemini
Luke shows how he used Google Gemini to build an interactive security awareness module in minutes.
With a simple prompt, Gemini generated a ClickFix training page in HTML, complete with explanations, red flags, and a knowledge check. He then refined the look and even built a retro-style phishing game with multiple levels and feedback.
No specialist tools. No complex setup. Just prompts and iteration.
The big takeaway is this. The barrier to creating engaging, customised awareness content is lower than ever. You still need to sense check, validate, and tidy things up, but as a rapid prototyping tool, it is seriously powerful.
This episode is packed with leaked customer data, another employee phishing story that turned into a full blown breach, and some awkward questions about how much we really trust our password managers.
This week on The Awareness Angle, ShinyHunters are back with more stolen data, Canada Goose is investigating after hundreds of thousands of customer records were leaked, and Eurail has confirmed traveller information is now up for sale on the dark web. Different brands. Same story. Collect loads of data. Store it. Hope it never gets out.
We also talk about a fintech firm that disclosed a breach after a single employee was phished. One inbox. One click. Real consequences. The human layer is still where this starts.
Then we get into password managers. What do they actually see? Where are the weak spots? And are we a bit too comfortable assuming the vault is untouchable?
All of that, and a few opinions from us along the way, in this week’s edition of The Awareness Angle.
The Awareness Angle is best served in full. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. If you like your cyber news with context, challenge, and a few raised eyebrows, this one’s for you.
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
This Week's Stories...
Phishing Led Breach at Figure
Fintech firm Figure has disclosed a data breach after an employee fell victim to a phishing email.
According to the company’s filing, the attack began with a successful phishing email that compromised an employee account. From there, the attacker gained access to internal systems and certain customer files.
Figure says there is currently no evidence that financial account credentials or customer funds were accessed. However, names, contact details and other personal information linked to customer accounts were exposed. Impacted individuals are now being notified.
ShinyHunters has reportedly claimed responsibility and says the breach is linked to a wider campaign targeting organisations using single sign on providers.
No zero day. No nation state. Just one convincing email.
The Awareness Angle
- Phishing still works – Even in fintech, even with mature security teams, one well crafted email can open the door.
- Access pathways matter – Inbox compromise is only step one. The real question is what that account can reach once inside.
- Human risk is business risk – This started with a person. Controls, monitoring, and response speed determine how far it spreads.
AI Generated Passwords Might Not Be as Smart as You Think
There’s been a bit of noise this week around AI generated passwords, and it’s worth paying attention to.
Researchers looked at passwords created by tools like ChatGPT, Claude and Gemini and found something interesting. They looked strong. They had symbols, numbers, upper and lower case. They passed basic strength tests. But they weren’t truly random.
Because large language models generate likely patterns, not true entropy, some passwords followed very similar structures. In some cases, near identical formats were repeated across tests. That means an attacker who understands how these models tend to construct strings could reduce the guesswork significantly.
It’s not that AI is useless. It’s just not built to be a cryptographic random number generator. So, if you’ve ever asked a chatbot to “give me a strong password”, it might be worth changing it.
The Awareness Angle
- Complex looking isn’t the same as secure – If something follows a pattern, attackers can learn that pattern.
- AI generates probability, not randomness – That works brilliantly for language. Not so brilliantly for passwords.
- Don’t outsource security decisions to convenience – Use a password manager, a long passphrase, or passkeys. Let tools designed for randomness handle randomness.
Infostealer Malware Now Targeting OpenClaw Secrets
We spoke more than once over the past few weeks about OpenClaw and the rise of agent based AI tools. This week, that story moved on yet again.
Security researchers have identified the first real world case of infostealer malware specifically harvesting OpenClaw configuration files. Not just browser passwords. Not just cookies. But API keys, authentication tokens and private cryptographic material tied to AI agents.
The important bit here is this.
People are wiring these agents into email, apps, local files and workflows. They are giving them memory. They are giving them access. And that means a single malware infection can now expose not just accounts, but the operational identity of someone’s AI assistant.
This is not a futuristic attack. It is infostealer malware doing what infostealers do. It just found a new goldmine of data sitting locally on machines.
AI agents are quickly becoming high value identity hubs.
The Awareness Angle
- AI agents centralise access – Email, tokens, apps and history all in one place makes them incredibly powerful, and incredibly attractive to attackers.
- Malware evolves fast – Infostealers are not targeting “AI” as a concept. They are simply harvesting files that contain keys and secrets. AI tools just happen to store lots of them.
- Experimentation needs guardrails – Curiosity is good. But when employees plug new tools into core systems without visibility, risk expands quietly.
Eurail and Canada Goose – Contact Data Still Has Teeth
Two very different brands this week, same underlying issue.
Eurail has confirmed that stolen traveller data is now being offered for sale online. The data includes names, email addresses, country of residence and booking details. Around the same time, Canada Goose began investigating claims that roughly 600,000 customer records were leaked, including names, email addresses, phone numbers and mailing addresses.
In both cases, you see the familiar reassurance. No payment data accessed. But if you know someone recently booked travel or bought something expensive, you do not need their card number. You just need enough context to send a believable message. “Problem with your booking.” “Issue with your delivery.” “Click here to avoid cancellation.”
That is where the real risk sits. Follow on phishing, smishing and impersonation campaigns that feel legitimate because they are built on real events.
The Awareness Angle
- Context is leverage – Real booking or purchase data makes phishing dramatically more convincing.
- Contact data is currency – Names, emails and phone numbers are more than enough to fuel targeted fraud.
- The second wave matters – The breach itself is often only the start of the story.
This week's discussion points...
Main Stories
73,000+ Patients Hit in Arizona Urology Data Breach Watch | Read
Eurail Says Stolen Traveller Data Is Now for Sale Watch | Read
Figure Discloses Breach After Employee Phishing Attack Watch | Read
Canada Goose Investigates 600,000 Customer Record Leak Watch | Read
ShinyHunters Claims CarGurus Breach Watch | Read
US Plans Portal to Bypass Content Bans Watch | Read
Vulnerabilities Found in Popular Password Managers Watch | Read | Read (Reddit discussion)
Infostealer Malware Targeting OpenClaw Secrets Watch | Read
AI Generated Passwords May Be Predictable Watch | Read
Extras
TikTok – Review Scam News Clip Watch | Watch on TikTok
And Finally...Online Review Blackmail Scam Hits Small Business
An ITV News clip highlighted a small business owner who was targeted with a different kind of scam. Criminals demanded payment, threatening to flood his company with fake one star reviews if he refused. They followed through.
Dozens of negative reviews appeared online, damaging his rating and threatening his livelihood. Instead of paying, he worked with Google to challenge the fake reviews. Eventually, the attackers stopped and moved on.
It is a reminder that not all cyber attacks involve malware or data theft. Sometimes the weapon is reputation.
The Awareness Angle
- Reputation is attack surface – Reviews, ratings and search results can be manipulated and weaponised. Your digital presence is part of your security footprint.
- Panic is the pressure point – Scammers rely on urgency and fear. The goal is to trigger a quick payment before you think clearly.
- Do not reward the behaviour – When there is no financial return, attackers often move on to easier targets. Reporting and persistence matter.
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
This week on The Awareness Angle, 70,000 government ID images are exposed in a Discord age verification breach, staff data is hit at the European Commission, and supplier fallout ripples out to Volvo Group after a third party incident. More data. More dependency. More risk.
We also cover Apple’s emergency zero day patch already being exploited in the wild, a devastating AI deepfake investment scam that cost an 82 year old nearly £200,000, and fresh concerns around autonomous AI agents expanding enterprise attack surfaces faster than governance can keep up.
On top of that, we get into the backlash around Ring’s Super Bowl advert and surveillance partnerships, why some organisations are banning Notepad++ instead of simply patching it, and how email bombing is still being used to quietly bury real account compromise in a flood of noise.
All of that, and a few strong opinions along the way, in this week’s edition of The Awareness Angle.
The Awareness Angle is best served in full. Watch on YouTube, listen on Spotify, Apple Podcasts, or wherever you get your podcasts. If you like your cyber news with context, challenge, and the occasional raised eyebrow, this one’s for you.
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
This Week's Stories...
Discord Faces Backlash After Age Verification Breach
Around 70,000 government issued ID images were exposed after a third party provider used for age verification was compromised. These were not usernames. Not email addresses. Actual passport and driving licence images.
This is where the age verification debate gets uncomfortable.
We said on the podcast that this is the trade off problem in real time. If platforms require more sensitive data to prove age, the impact of failure increases massively. And crucially, it is not just about trusting the platform. It is about trusting who they trust.
This was not Discord’s core infrastructure being breached. It was a supplier in the chain. But to the user whose passport is now exposed, that distinction does not matter.
Searches for Discord alternatives reportedly spiked after the story broke. That is what trust erosion looks like.
The Awareness Angle
- More Data, More Risk – The more sensitive the data collected, the higher the impact if breached.
- Third Parties Matter – Your risk extends to every supplier in the chain.
- Trust Has a Cost – Safety controls must not create bigger privacy problems.European Commission Discloses Staff Data Breach
European Commission Discloses Staff Data Breach
The European Commission confirmed a breach affecting a system used to manage staff mobile devices. Personal data such as names and contact details may have been accessed. There is currently no indication that classified systems were compromised.
The bigger issue is what happens next.
Internal directories and HR data are high value targets. Once exposed, they fuel phishing, impersonation and social engineering.
Containment reportedly happened within hours. But the exposure still matters.
The Awareness Angle
- Staff Data Is High Value – Internal directories and HR data are prime targeting fuel.
- Breaches Enable Follow On Attacks – Exposure often leads to phishing and impersonation.
- Compliance Is Not Immunity – Even major institutions remain attractive targets.
Volvo Group Impacted by Conduent Supplier Breach
Volvo Group has been named among organisations impacted by a cyberattack at IT services provider Conduent.
This is another reminder that your organisation’s risk surface is bigger than your own firewall.
Conduent provides back office services such as document processing and administrative support. When a service provider like that is breached, the impact cascades outward. One breach can affect dozens, sometimes hundreds, of downstream organisations.
We have said it before, but this is third party concentration risk in action. If one supplier services many large brands, the blast radius expands dramatically.
Volvo is not alone here. And that is the point.
The Awareness Angle
- Third Party Risk Is Shared Risk – Your exposure includes your suppliers.
- One Breach, Many Victims – Service providers create amplified blast radius.
- Supply Chain Visibility Matters – Know who holds your data, and how it is protected.
Apple Fixes Actively Exploited Zero Day
Apple released emergency updates to patch a zero day vulnerability described as being used in “extremely sophisticated” attacks.
When a vendor confirms exploitation is already happening, patching becomes urgent.
These flaws are rarely theoretical. They are used in targeted campaigns. Targeted does not mean rare. It means deliberate.
The Awareness Angle
- Zero Days Are Real World – These are not theoretical flaws. They are exploited.
- Targeted Does Not Mean Safe – Sophisticated attacks still affect everyday users.
- Update Culture Matters – Fast patching is still one of the strongest defences.
82 Year Old Loses £200k in AI Deepfake Investment Scam
An 82 year old grandmother lost nearly £200,000 after seeing what appeared to be a trusted doctor promoting an investment opportunity in a professional looking video.
It was AI generated.
The scam did not rely on broken English or obvious red flags. It relied on authority bias, emotional manipulation, and realism. Conversations continued over Messenger. Funds were moved into cryptocurrency. The emotional driver was securing care for her autistic grandson.
We said this on the show. This is not clumsy phishing. This is AI realism combined with psychology.
One comment we discussed summed it up well. It is easy to look at stories like this and think gullible old people. But the speed at which AI is improving should make all of us pause. The bar for deception is rising quickly.
The Awareness Angle
- Trust Can Be Faked – Familiar faces are no longer proof.
- Crypto Is Hard to Reverse – Once funds move, recovery is unlikely.
- Emotion Drives Decisions – Scammers exploit care, not just greed.
This Week's Discussion Points...
🔎 Breach Watch
Discord Age Verification Breach Exposes 70,000 Government IDs Watch | Read
European Commission Discloses Staff Data Breach Watch | Read
Volvo Group Impacted by Conduent Data Breach Watch | Read
Apple Fixes Zero Day Used in Highly Sophisticated Attacks Watch | Read
Our Org Is Banning Notepad++ After Supply Chain Concerns Watch | Read
📰 News
82 Year Old Loses £200k in AI Deepfake Doctor Investment Scam Watch | Read
Reddit discussion: Read
Amazon Distances Itself From Flock Safety After Ring Super Bowl Backlash Watch | Read
How to Recognise a Deepfake, and Why It Is Getting Harder Watch | Read
OpenClaw Integrates VirusTotal After Enterprise Risk Warnings Watch | Read
💬 Discussion & Extras
Cloudflare “ClickFix” Style Fake Verification Page Watch | Read
Email Bomb Used to Hide a Real Security Alert Watch | Read
The CivDiv No.1 TikTok Account Recommendation Watch | TikTok
Most Common 4 Digit PIN Numbers Visualised Watch
QR Code Binder for Child Safe YouTube Access Watch
And finally...LinkedIn AI Caricature Trend Raises Oversharing Questions
See content credentials
A new trend circulating on LinkedIn has people using AI to generate caricature style action figure versions of themselves. These posts often include job titles, hobbies, favourite sports teams, pets, cities, personality traits and sometimes even family details.
The trend itself feels creative and harmless. But a post this week from Matthew Jary highlighted something worth pausing on. When you scroll through a feed full of these, you start learning a surprising amount about complete strangers.
Individually, each detail seems insignificant. Collectively, they form a profile.
Many of the attributes being shared mirror the kinds of prompts commonly used in password reset questions and social engineering attempts. First pet. Favourite team. Hometown. Employer.
But here’s the alternative view.
Is this actually an issue?
Most of us openly share our job titles, employers, locations and interests on LinkedIn every day. That is the whole point of the platform. So is this genuinely risky, or is this just the latest “security people hate fun” moment? Is this simply anti bandwagon commentary?
Maybe.
The difference might not be the individual data point. It might be the packaging. When everything is neatly summarised in one visual snapshot, it lowers the effort required to profile someone.
This is not about banning fun. It is about understanding aggregation. Attackers do not always need a breach when information is voluntarily shared and easily searchable.
The risk is rarely one post. It is the accumulation.
The Awareness Angle
- Small Data Adds Up – Individual facts feel harmless. Combined, they become profile building fuel.
- OSINT Is Powerful – Attackers do not need a database leak if the information is public.
- Aggregation Changes Context – One detail is normal. A curated snapshot lowers the barrier for profiling.
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
Supply Chain Hacks. Fake Encryption. Phones That Track You
This week on The Awareness Angle, a developer tool update chain gets quietly hijacked, ransomware actors claim access to airport systems, and law enforcement moves in on a major hacking forum, with questions over how much impact that will really have.
We also look at how phones can be tracked at the network level without apps or permission, why McDonald’s felt the need to call out terrible password habits, and how a chaotic extortion group is turning data breaches into deeply personal harassment campaigns. On top of that, Spain is moving to ban social media for under 16s, and questions are resurfacing about whether end to end encryption really means what people think it does.
All of that, and more, in this week’s edition of The Awareness Angle.
The Awareness Angle is best served in full. Watch on YouTube, or listen on Spotify or your favourite podcast platform to get the complete discussion and context.
🎧 Listen on your favourite podcast platform - Spotify, Apple Podcasts and YouTube
Listen Now
Podcast · Risky Creative
This week's stories...
Notepad++ update chain compromised
Notepad++, a tool a lot of developers use without a second thought, was caught up in a supply chain attack that didn’t touch the code at all. Instead, attackers went after the update process. Between June and December 2025, a small number of users were redirected to malicious update files through the hosting infrastructure.
This wasn’t random. It looks deliberate and targeted, likely aimed at developers or organisations working on sensitive projects. The software itself was fine, but the trust people place in automatic updates was the weak point. Notepad++ has since moved hosting providers, tightened up how updates are verified, and confirmed that versions 8.8.9 and above are safe.
It’s one of those stories that feels uncomfortable because it hits a blind spot. We trust tools like this precisely because they are familiar and boring.
The Awareness Angle
- The risk lived outside the app - The problem wasn’t what people installed, it was what they never see, the update mechanism.
- Targeted still counts - You don’t need to hit everyone, just the right few people.
- Choice brings exposure - Every extra tool adds convenience and risk, which is why organisations try to limit what gets installed.
Ransomware group claims access to airport systems
A ransomware group is claiming it breached systems linked to Tulsa International Airport and has begun dumping internal files online as proof. The attackers say the data includes internal emails, employee IDs, passports, and financial documents. At the time of reporting, the airport has not publicly confirmed the breach and the leaked material has not been independently verified.
That uncertainty is part of the tactic. Modern ransomware groups do not just rely on encryption or extortion notes. They use public claims and data leaks to create pressure, force attention, and shape the narrative before facts are fully known. Airports are particularly exposed to this kind of pressure because disruption, even perceived disruption, carries immediate reputational and operational weight.
Verified or not, once claims and files are public, the human impact starts straight away.
The Awareness Angle
- Pressure starts before proof - Publishing claims and documents is designed to trigger panic and rushed decisions.
- Visibility increases impact - Highly visible organisations feel the reputational damage faster, even when details are unclear.
- Pause is a defence - Calm, verification, and controlled communication matter more than speed in moments like this.
Your phone can be tracked without your permission, and most people do not realise it
Most people think they understand how location tracking works. If an app does not have permission, or GPS is turned off, they assume their phone is no longer sharing where they are. This story shows that is not how it actually works.
Mobile networks can locate phones at the carrier level using systems originally built for emergency services. This sits below iOS and Android, which means your phone never asks you, and you never see it happening. It is not malware and it is not a bug. It is how mobile infrastructure has worked for years.
When we talked about this on the podcast, the bit that really landed was how normal this feels once you realise it has been there the whole time. The technology did not change. Our assumptions did.
The Awareness Angle
- Permissions feel reassuring - Turning things off gives a sense of control, even when it does not change the outcome.
- The real risk is invisible - Tracking can happen below apps and operating systems people interact with.
- Assumptions shape behaviour - When beliefs are wrong, people take risks without realising it.
This Week's Discussion Points...
Notepad++ supply chain attack Watch | Read
Ransomware group claims access to airport systems Watch | Read
FBI seizes RAMP hacking forum Watch | Read
Lawsuit claims WhatsApp encryption is a lie Watch | Read
Spain announces social media ban for under 16s Watch | Read
Your phone can be tracked without your permission Watch | Read
Scattered Lapsus ShinyHunters extortion tactics Watch | Read
Ransomware attacks up 30 percent Watch | Read
Ant's mum targeted by follow up scam call Watch
McDonald’s calling out weak passwords Watch | Read
Getting your first job in cybersecurity Watch | Read
Real or phishing, shockingly bad campaign emails Watch | Read
And finally...McDonald’s calling out weak passwords, and it lands because it’s honest
McDonald’s Netherlands used Change Your Password Day to highlight something security teams have been saying for years. People choose passwords based on things they like, recognise, or can remember. BigMac, HappyMeal, McNuggets, and endless variations of them showed up tens of thousands of times in breached password data.
As we said on the show, this works because it doesn’t pretend people are suddenly going to behave like security professionals. It accepts reality and designs around it.
Predictability is the real problem. Swapping letters for numbers or adding a symbol feels clever, but attackers expect it. Tools try those combinations automatically. The habit hasn’t changed, even though the threat has.
What’s interesting is how transferable this idea is. Almost any organisation could do a version of this with their own language, products, acronyms, or in jokes. When people see themselves reflected in the message, it lands very differently.
The Awareness Angle
- Familiar beats secure - People choose passwords that feel personal and memorable, not resilient.
- Old advice lingers - Leetspeak and small tweaks still feel protective, even though they stopped working years ago.
- Make it local - Campaigns are more effective when people recognise their own habits and language in the message.
Would you try this in your organisation? Let us know by getting in touch at hello@riskycreative.com
This week on The Awareness Angle, we cover hundreds of exposed Clawdbot and Moltbot AI agent gateways leaking credentials and private chats, a new malware service selling guaranteed phishing extensions through the Chrome Web Store, and sensitive government documents uploaded to ChatGPT by the acting head of the US cybersecurity agency.
We also look at Google rolling out stronger ransomware protections in Drive, France accelerating plans to ban social media for under 15s, and what recent incidents involving AI powered toys reveal about data exposure risks for children.
All of that, and more, in this week’s episode of The Awareness Angle.
The Awareness Angle is best served in full. Watch on YouTube, or listen on Spotify or your favourite podcast platform to get the complete discussion and context.
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
Support the show with all new Awareness Angle merch. Stickers, notebooks, mugs, and bits that quietly say you care about people, not just passwords. Click here to visit the shop.
This week's stories...
Hundreds of exposed Clawdbot gateways leave credentials and private chats exposed
Security researchers have identified more than 900 exposed Clawdbot gateways online, caused by poor setup and insecure default settings. These exposed systems allowed access to private conversations, API keys, and other sensitive information.
Clawdbot, also known as Moltbot, is an AI agent designed to make work easier by remembering information and acting on a user’s behalf inside messaging apps. Because it runs continuously and stores context over time, mistakes in setup can quietly expose far more than people realise.
Incidents like this often happen without malicious intent. Tools are adopted quickly to save time, experiments move into daily use, and security steps are skipped under pressure. The result is exposure created by normal human behaviour, not bad actors.
The Awareness Angle
- People prioritise speed and convenience – Security steps are often skipped to get work done
- Assumptions replace checks – If a tool feels helpful and familiar, risk is easily overlooked
- Psychological safety matters – People need to feel safe admitting mistakes before exposure grows
New malware service pushes phishing extensions into the Chrome Web Store
Researchers have uncovered a new malware service called Stanley that allows criminals to create phishing browser extensions and successfully publish them to the Chrome Web Store. These extensions are designed to overlay legitimate websites with fake content while keeping the real web address visible, making them difficult to spot.
The service is sold in tiers, offering features such as silent installation, custom branding, and a management panel for attackers. Because the extensions pass official store checks, users are more likely to trust them, install them, and continue using them without suspicion.
This type of attack relies less on technical exploitation and more on habit. People install extensions to save time, solve small problems, or boost productivity, often without revisiting what access those extensions still have later on.
The Awareness Angle
- Trust is built on familiarity – Official stores and recognisable browsers lower people’s guard
- Convenience drives behaviour – Small productivity gains can outweigh perceived risk
- Unused access is rarely questioned – Extensions often stay installed long after they are needed
France moves to fast track a social media ban for under 15s
France has announced plans to fast track a ban on social media use for children under 15, with the aim of having new rules in place before the next school year. The proposal includes stricter age verification and builds on existing restrictions around mobile phone use in schools.
The move follows similar action in Australia, where millions of under 16 social media accounts have already been removed. French officials have acknowledged that age limits can be bypassed, but see this as an important first step in reducing exposure to online harm and emotional manipulation.
Rather than focusing on individual behaviour, the approach shifts responsibility toward platforms and regulation, recognising that expecting children to self regulate in highly persuasive online environments has not worked.
The Awareness Angle
- Children are not the problem – Platforms are designed to capture attention, not protect wellbeing
- Rules fill the gaps left by design – Regulation steps in where controls and safeguards fall short
- Adults set the environment – Safety improves when responsibility moves away from the user
US cybersecurity chief uploaded sensitive government documents to ChatGPT
The acting head of Cybersecurity and Infrastructure Security Agency uploaded internal government documents marked “for official use only” into ChatGPT. The uploads triggered automated warnings, and an internal review is now assessing any potential impact.
The documents were described as internal but unclassified, and the use of ChatGPT was said to be short term and previously approved as an exception. Following the incident, multiple staff members were suspended from accessing classified systems while investigations continue.
The story highlights how quickly everyday tools can blur boundaries at work, especially when people are under pressure to move fast or solve problems efficiently.
The Awareness Angle
- People default to familiar tools – Convenience often overrides caution
- Exceptions create confusion – One off permissions weaken shared understanding of risk
- Hierarchy does not prevent mistakes – Senior roles are not immune to everyday human error
Discussion Points...
ShinyHunters swipes right on 10M records in alleged dating app data grab Watch | Read
US cybersecurity chief uploaded sensitive documents to ChatGPT Watch | Read
What is Clawdbot and why it matters Watch | Read
Hundreds of exposed Clawdbot gateways leave data vulnerable Watch | Read
The AI agent craze is turning into a security nightmare Watch | Read
Phishing malware sold as Chrome extensions Watch | Read
Google Drive adds better ransomware protection Watch | Read
France moves to ban social media for under 15s Watch | Read
Exposed admin panel found in AI toy Watch | Read
Awareness, spotting phishing and AI content Watch | Read
Misleading breach headlines and fake panic Watch | Read
Reverse image search exposing fake profiles Watch | Read
Gift card scam warnings appearing in stores Watch | Read
Covering phone cameras as a security habit Watch | Read
Free WiFi on flight QR code prank Watch | Read
TikTok Argos MacBook discount scam Watch | Read
Real world phishing and family account compromise Watch
And finally...This Week I Messed Up!
This week, the story that hit closest to home wasn’t a breach headline or an AI scare. It was my mum.
Her email account was compromised, no two factor authentication, a password she’d used for years, and attackers quietly sending gift card scam emails to people she trusts. I only spotted it once messages started disappearing from her inbox.
When I got proper access, the reason was obvious. The attackers had set up inbox rules to automatically mark messages as read, move them into hidden folders, and silently redirect copies to a Gmail account they controlled. From the outside, everything looked normal.
I spend my life talking about security awareness, and I still hadn’t locked down the person closest to me.
The Awareness Angle
- Inbox rules are a red flag – attackers often use filters and redirects to hide their activity and stay undetected
- No 2FA is still a big risk – even “quiet” email compromises can run for days without being noticed
- Check your family, not just your workplace – the people closest to you are often the least protected
It’s a reminder that security isn’t just an organisational problem. It’s personal. Take five minutes this week to check in on someone you care about.
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
This week on The Awareness Angle, we cover a ransomware attack at Ingram Micro that disrupted a major part of the global IT supply chain, alongside a breach at Grubhub where customer, driver, and merchant data was accessed through a third party support system. We also look at a data breach at the Minnesota Department of Human Services affecting nearly 304,000 people, and a UK secondary school forced to close after a cyber attack knocked critical systems offline.
In the news, Microsoft issued emergency out of band Windows updates after Patch Tuesday caused shutdown and Cloud PC issues, while researchers uncovered malicious browser extensions designed to crash browsers and push fake fixes. We also discuss reports of criminals selling ready made voice phishing kits, a new EU vulnerability database launched as an alternative to CVE, and a phishing campaign targeting LastPass users with fake security alerts.
We round out the episode with policy and platform updates, including the UK government consulting on banning social media for under 16s, and TikTok finalising a deal to split its US operations into a new joint venture.
The Awareness Angle is best served in full. Watch on YouTube, or listen on Spotify or your favourite podcast platform to get the complete discussion and context.
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
Support the show with all new Awareness Angle merch. Stickers, notebooks, mugs, and bits that quietly say you care about people, not just passwords.
This week's stories...
Voice phishing kits sold as a service
Cybercriminals are now selling ready made voice phishing kits that let almost anyone run convincing phone scams. These kits bundle scripts, call flows, dashboards, and in some cases AI generated voices that sound like banks or internal IT teams. This is not someone freelancing a scam call. This is packaged, repeatable, and designed to scale.
The kits guide attackers through the entire interaction. Who to call. What to say. When to apply pressure. Victims are coached into handing over credentials, one time passcodes, or approving actions that lead to account access. It is phishing, just delivered over the phone instead of email.
The problem is that phone calls still get a free pass. Many organisations have trained people to be cautious with links and emails, but far fewer have clear rules for handling unexpected calls. Attackers are leaning into that gap hard.
This is social engineering getting easier and more normal. And it is aimed squarely at busy humans.
The Awareness Angle
- Vishing is now off the shelf – Anyone can buy the tooling
- Calls still bypass suspicion – The channel carries trust
- Call back breaks the scam – Verification beats confidence
CrashFix browser attacks push fake fixes
CrashFix is a browser based attack where a malicious extension deliberately crashes the browser, then tells the user they need to install a fix. That fix is malware. Nothing is broken. The crash is the whole point.
After the browser fails, users are shown clear, step by step instructions telling them what to do next. Run this. Install that. It works because this is exactly how people normally deal with software problems. Get it working and carry on.
This is not a clever technical exploit. It is frustration as a delivery mechanism. When something breaks, people stop thinking about risk and start thinking about recovery. CrashFix is designed to catch people in that moment.
The Awareness Angle
- The crash is intentional – Failure is the lure
- Fixing mode bypasses caution – Urgency beats scepticism
- Running commands is a red flag – Pause before you actWatch | Read
UK secondary school forced to close after cyber attack
A secondary school in England was forced to close after a cyber attack took out its IT systems. There was no big data breach story and no suggestion that grades were tampered with. The school closed because it could not function safely without its systems.
Security, made human.Too much failed at once. Attendance, communications, access control, and safety related systems were all affected. That only happens when everything is tied together. Systems that should be dull, isolated, and resilient were clearly part of the same environment, so when one thing went down, everything followed.
This is what happens when convenience drives design. Things get connected because it is easier, cheaper, or sold as “modern”, not because it makes sense. Then something breaks, and suddenly the impact is far bigger than anyone expected.
The Awareness Angle
- Not everything should be connected – Convenience quietly increases risk
- Availability is a safety issue – Offline systems force closure
- Design decisions matter – Architecture shapes impact
This week's discussion points...
Ingram Micro ransomware attack knocks global IT supply chain offline – Watch | Read
Grubhub breach exposes customer, driver, and merchant data via third party support system – Watch | Read
Minnesota Department of Human Services breach exposes demographic records of nearly 304,000 people – Watch | Read
UK secondary school forced to close after cyber attack disrupts systems – Watch | Read
Microsoft releases emergency Windows updates after Cloud PCs fail to shut down properly – Watch | Read
Criminals are now selling ready made voice phishing kits – Watch | Read
Malicious Chrome extension crashes browsers to push fake “fix” in ClickFix variant – Watch | Read
EU launches new vulnerability database as alternative to CVE – Watch | Read
Phishing campaign targets LastPass users with fake security alerts – Watch | Read
Government consults on banning social media for under-16s in the UK – Watch | Read
TikTok seals deal to split US app into new joint venture, keeps platform running in America – Watch | Read
AI snowstorm videos show the current state of the internet – Watch
Five ways to spot AI generated accounts on social media – Watch
And finally...Action Fraud becomes “Report Fraud”, but the experience still breaks trust
The UK’s fraud reporting service has been rebranded from Action Fraud to Report Fraud. The new name is clearer and does exactly what it says. The problem is what happens next.
When users try to sign in or create an account, they are redirected to a completely different domain to complete the process. For some people, antivirus tools flag that page as suspicious or phishing. That puts users in an impossible position. They are doing the right thing by reporting fraud, and the experience immediately tells them not to trust it.
This is how trust gets damaged. Not by attackers, but by confusing design. People are told to be cautious about links and domains, then asked to ignore their own instincts when it really matters. Many will simply abandon the report.
If we want people to report scams and cybercrime, the process has to feel safe and consistent all the way through.
The Awareness Angle
- Trust is fragile – Mixed signals stop people acting
- Design shapes behaviour – Confusion leads to drop off
- Security advice must align – We cannot teach one thing and do another
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
This week on The Awareness Angle, we cover a busy mix of breaches, claims, and security moments that blurred the line between what happened and what people thought happened. Instagram password reset emails caused widespread confusion, ransomware groups made high-profile breach claims without releasing data, and a well-known hacking forum found itself dealing with a leak of its own.
We also look at cyber incidents with real-world impact, including attacks linked to drug smuggling at major European ports and attempted intrusions targeting national energy infrastructure. On the technology side, we discuss Microsoft’s latest Patch Tuesday, growing control over AI tools on work devices, and why some organisations want clearer choices around when those tools appear.
The episode also explores emerging questions about identity and trust, from reused passwords and long-lived leaked data to eye-scanning technology promoted as a way to prove you are human online.
The Awareness Angle is best served in full. Watch on YouTube, or listen on Spotify or your favourite podcast platform to get the complete discussion and context.
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
This week's stories...
Instagram password reset emails and data leak claims
A large number of Instagram users reported receiving password reset emails they did not request. Meta confirmed it fixed an issue that allowed an external party to trigger legitimate password reset emails at scale and said there was no breach of Instagram systems. According to Meta, user accounts were not compromised, and the emails were caused by abuse of a feature rather than a hack.
At the same time, security firm Malwarebytes reported that data linked to around 17.5 million Instagram accounts was being advertised online. The dataset is said to include usernames, email addresses, phone numbers, and, in some cases, physical addresses. Meta has denied any link between the password reset emails and the data, stating that it likely came from older scraping activity rather than a new Instagram breach.
While there is no public evidence tying the two events together, the timing created widespread confusion. Unexpected security emails combined with reports of leaked data looked and felt like a breach to many users, regardless of the technical explanation.
The Awareness Angle
- Timing shapes perception - When alerts and leak claims land together, people assume the worst
- Users see impact, not root cause - Bug or breach matters less than how it feels
- Old data still circulates - Historic scraping can resurface and fuel new scams
Ports hacked to support drug smuggling, hacker jailed
A hacker has been sentenced to 7 years in prison for cyberattacks that disrupted operations at the Port of Rotterdam and the Port of Antwerp. The attacks took place between 2021 and 2023 and involved unauthorised access to container logistics systems.
Prosecutors said the access was used to manipulate the release and movement of shipping containers, enabling organised crime groups to collect drug shipments without detection. The case highlights how cyber access can directly enable real-world criminal activity rather than just data theft.
Authorities said the sentence reflects the seriousness of targeting critical infrastructure and the wider risks posed to safety, trade, and national security.
The Awareness Angle
- Cyber enables physical crime - Access to systems can unlock real-world harm
- Logins are high-value targets - Human access often matters more than malware
- Impact goes beyond IT - Disruption affects supply chains and public safety
Microsoft may allow Copilot to be uninstalled on managed devices
Microsoft is planning to give IT administrators the option to uninstall Copilot from managed Windows devices, rather than just hide or disable it. The change would apply to enterprise-managed devices and address concerns about control, data handling, and readiness.
The move gives organisations more choice over when and how AI tools appear on work devices, particularly as teams continue to work through policies, training, and acceptable use. Copilot remains positioned as a productivity feature, but many organisations are still deciding how to introduce it safely.
The Awareness Angle
- Control matters - IT teams want clear choices, not forced rollouts
- AI affects behaviour - Tools change how people work, not just systems
- Readiness comes first - Introducing AI before guidance creates risk
AI is not selling, is interest waning?
Despite heavy investment in AI-powered PCs and tools, some manufacturers are reporting weaker-than-expected demand. Executives at Dell said consumers are not buying devices for AI features, and that AI-focused messaging often creates confusion rather than clarity.
The comments suggest a gap between how vendors promote AI and how everyday users understand its value. While AI continues to be embedded across products, its presence alone does not appear to be driving purchasing decisions.
This comes as organisations continue to balance innovation with concerns about data use, trust, and whether people actually want AI involved in their daily work.
The Awareness Angle
- AI does not automatically sell - Features need clear, practical value
- Confusion slows adoption - Unclear benefits create hesitation
- Trust still matters - Data questions shape acceptance
This week's discussion points...
Everest Ransomware Claims Nissan Data Breach – Watch | Read
Spanish Energy Giant Endesa Reports Major Customer Data Breach – Watch | Read
Instagram Password Reset Emails – Watch | Read
Breachforums Data Leak – Watch | Read
Microsoft Patch Tuesday – Watch | Read
Microsoft Copilot Removal Option – Watch | Read
AI PCs Not Selling – Watch | Read
Hacker Jailed for Attacks on Rotterdam and Antwerp Ports – Watch | Read
Poland Cyber Attack on Energy Infrastructure Stopped – Watch | Read
Scam Email Knows My Password – Watch | Read
Worldcoin and Eye Scans for Human Verification – Watch | Read
And finally...Scanning your eyes to prove you are human, Sam Altman’s Orb
This one is proper Black Mirror territory, because it takes a real problem, bot spam, fake accounts, AI-generated nonsense everywhere, and answers it with something that feels way too permanent. Worldcoin’s Orb scans your iris to create a unique digital identifier, a World ID, basically a way to prove you are a real human online. In some places, they even pay you in crypto to do it.
The pitch is “we do not store your eye images, we just turn it into a cryptographic code”, but the bit that makes my skin crawl is the direction of travel. Once you normalise scanning bodies to access digital services, it is hard to un-invent that. Passwords can be changed, devices can be replaced, but biometrics are forever. If a system like this ever gets abused, breached, repurposed, or linked up with other data sources, you do not get to rotate your eyeballs and start again.
And the crypto incentive matters. Paying people to hand over biometric data is not neutral as it changes the deal. It nudges adoption through cash, not through genuine understanding or informed consent. And if the goal is to build trust online, starting with “here is some money, let a shiny sphere scan your iris” is a weird way to do it.
This story is not just about one gadget in a shopping centre. It is about what comes next. If “prove you are human” becomes a standard requirement, who controls that proof, who decides when it is needed, and who gets locked out if they do not want to play along?
The Awareness Angle
- Biometrics are permanent - If something goes wrong, you cannot reset it like a password
- Incentives change consent - Paying people to sign up shifts behaviour faster than understanding
- This will not stay niche - If it works once, it will get pushed into more places
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
This week on The Awareness Angle, it is a reminder of just how much data follows us around, and how often it ends up exposed in places we barely think about. From magazine subscriptions and radio stations holding millions of records, to healthcare providers, gas stations, and even space agencies dealing with serious breaches, the theme this week is scale, and how quickly it can spiral.
We look at incidents that were first reported as small, only to grow into hundreds of thousands or millions of affected people months later. We also dig into the way modern attacks blend into normal work, fake blue screens, booking emails, sideloaded apps, and even trusted security tools being used as a way in.
There is a longer view, too, with Equifax still discussing culture years after its breach, new government cyber plans taking shape, and insurers quietly spelling out what they will not cover when cyber incidents spill into the physical world.
It is a packed episode, full of practical lessons and uncomfortable reminders about trust, habit, and the digital footprints we all leave behind.
This week's stories...
Condé Nast breach and the risk hiding in forgotten subscriptions
Condé Nast is responding to a breach claim that could affect up to 40 million users across brands, including Vogue, GQ, Wired, and The New Yorker. An attacker using the name “Lovely” shared data samples allegedly taken from subscription systems and claimed to have access across multiple Condé Nast properties. The exposed information reportedly includes names, email addresses, usernames, phone numbers, dates of birth, and location data. According to reports, the attacker alleged they attempted to flag vulnerabilities before releasing proof, though Condé Nast disputes parts of that account and says it has taken steps to disable the accounts involved in the unlawful access.
During the discussion on the show, the focus was less on the headline number and more on how ordinary this type of data feels. Subscription accounts like these are often created years earlier and then forgotten entirely. They don’t feel sensitive or important, yet the data persists long after interest fades. That long lived, low attention data is what makes incidents like this so uncomfortable, it surfaces quietly and is easy to abuse without ever feeling like a major breach at the time.
The Awareness Angles
- Subscription data is still valuable - names and email addresses alone can fuel phishing and scams
- Forgotten accounts create blind spots - users move on while data remains
- Proof leaks are rarely the end - small samples often point to wider exposure
European Space Agency breach shows even critical organisations aren’t immune
The European Space Agency confirmed a cyber incident that is now under criminal investigation, after attackers gained unauthorised access to parts of its internal IT environment. Reporting suggests a public vulnerability was exploited, with attackers claiming to have taken hundreds of gigabytes of internal files. ESA said mission-critical spacecraft operations were not affected, but the incident was serious enough to involve law enforcement and trigger a wider forensic review.
The discussion wasn’t really about whether ESA should be better protected, it was more about frustration. There was a sense that some things just shouldn’t be messed with at all. Space, like healthcare or charities, doesn’t feel like a fair game. But that feeling clashes with reality. Attackers don’t draw ethical lines. If a vulnerability exists and remains open, it becomes an opportunity, regardless of how harmless or important the organisation feels.
The Awareness Angles
- Attackers don’t respect boundaries - ethical lines don’t factor into targeting decisions
- Unpatched weaknesses still get exploited - it only takes one open door
- Sensitive data isn’t limited to operations - internal documents and partner information still carry risk
Fake blue screens are being used to trick hotel staff into installing malware
Hotels across Europe are being targeted by phishing emails that impersonate booking-related messages, often posing as reservation updates or cancellations. The emails lead staff to malicious pages that display a fake Windows blue screen and instruct users to follow recovery steps. Those steps involve running commands that install malware directly onto the system. It is a ClickFix-style attack, but disguised as a system failure rather than a security warning.
The conversation focused on how easy this is to fall into when it lands in the middle of a normal working day. Hotel staff deal with booking emails constantly, and fixing problems quickly is part of the job. When something looks technical and urgent, the instinct is to resolve it and move on, not stop and question whether it should be escalated. That pressure, combined with something that looks familiar, is what makes this technique effective.
The Awareness Angles
- Urgency drives behaviour - fake system errors push people into fast decisions
- Normal workflows lower scepticism - familiar-looking emails get less scrutiny
- ClickFix keeps evolving - attackers rely on users to run the malware for them
ChatGPT Health raises the stakes for account security
OpenAI announced ChatGPT Health, a feature that allows users to connect medical records and wellness apps to their ChatGPT account. The company says the feature is not intended for diagnosis or treatment, and that connected health data won’t be used to train models. The goal, according to OpenAI, is to make responses more useful by grounding them in a user’s own health context.
The discussion wasn’t really about whether this is a good or bad feature, it was about concentration of value. On the show, the point was made that for many people ChatGPT is already a second brain. It holds questions, ideas, work context, and personal thinking. Adding health data into that mix means a single account can now represent a very complete picture of someone. That makes the impact of account compromise much higher than it used to be, even if the feature itself is well intentioned.
The Awareness Angles
- Accounts are becoming life hubs - more context means higher impact if compromised
- Login security matters more than ever - strong MFA and recovery controls are critical
- Convenience quietly expands risk - connecting data should always be a conscious choice
This Week's Discussion Points...
Condé Nast breach claims and subscriber data risk – Watch | Read
Covenant Health breach grows to nearly half a million people – Watch | Read
Tokyo FM breach highlights how radio stations hold vast listener data – Watch | Read
US gas station operator breach exposes payment cards and ID data after delayed notification – Watch | Read
European Space Agency breach placed under criminal investigation – Watch | Read
Equifax says security culture is now built in, after one of the biggest breaches on record – Watch | Read
Fake Blue Screen of Death attacks targeting hotel staff – Watch | Read
HSBC blocks customers using sideloaded Bitwarden apps – Watch | Read
OpenAI launches ChatGPT Health and raises questions about account value – Watch | Read
UK government publishes new cyber action plan – Watch | Read
And Finally...Cybersecurity Training That Ticks Boxes but Changes Nothing
This week we talked about NCSC cybersecurity training being issued to school staff, a 36 minute video, stock slides, synthetic narration, no interaction, and no assessment. Everyone completes it, signs it off, and moves on. On paper, the risk is managed. In reality, very little of that content will be remembered when someone receives a real scam, a fake text, or a convincing phishing email. It is a familiar pattern in security awareness, training designed to satisfy a requirement rather than change behaviour. The problem is not that people do not care, it is that long, generic training delivered once a year does not reflect how threats actually show up in daily life.
The Awareness Angle
- Completion is not protection - Watching a video does not mean someone can spot a scam under pressure
- Relevance beats length - Five minutes of current, relatable examples beats 36 minutes of theory every time
- Engagement is the control - If people do not remember it, it cannot protect them
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
This week on The Awareness Angle, we are back after the Christmas break and straight into two weeks’ worth of cyber news that didn't slow down just because the calendar said it should. From phishing emails abusing real Google services and browser extensions quietly infecting millions, to Ubisoft taking Rainbow Six Siege offline after attackers started banning players live (with a little bit of Shaggy), there is plenty to unpack.
We look at airlines and retailers exposing customer data through supplier and access failures, including Korean Air and Coupang, where smashed laptops, rivers and forgotten access played a bigger role than sophisticated hacking. We also dig into ClickFix attacks being sold as a service, sleeper browser extensions stealing data months after install, and a British hacker who quite literally hacked his way into an Australian visa by doing things the right way.
Add in Meta quietly shaping how scam ads are policed, smart hacking tools being banned from a mayoral inauguration, and a growing tension between security, perception, and trust, and a clear theme starts to emerge.
All of that and more in this week’s Awareness Angle, so let’s get into it.
Watch or Listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
This Week's Stories...
Spotify scraping shows why “just metadata” is never just metadata
Claims a couple of weeks ago suggested Spotify content was scraped at massive scale, with Anna’s Archive alleging access to metadata for around 256 million tracks and audio files for roughly 86 million songs. The archive, reported to be around 300TB in size, has been distributed via torrents. Spotify said it identified and disabled accounts involved in unlawful scraping, describing the activity as a mix of public metadata access and illicit tactics, but stopped short of confirming the full scale of what is circulating.
What makes this story uncomfortable is that it doesn't look like a traditional breach. As we discussed on the show, this appears to be access working as designed, just abused at scale. It is easy to wave this away as “just metadata,” but metadata carries context. It reveals behaviour, popularity, listening patterns, and connections over time. Combined with other sources, it becomes far more revealing than most people expect. Add in the fact that torrents and unofficial archives are a common delivery mechanism for malware, and this stops being just a copyright issue.
The Awareness angles
- Metadata is not harmless – Even without names or passwords, metadata can expose behaviour, habits, and patterns when collected at scale or combined with other data sources
- Abuse accelerates quietly – When automated access or credentials work once, they can be reused rapidly, turning small gaps into mass scraping before anyone notices
- Trust the file, not the story – Archives framed as preservation or culture can still be high risk, unofficial downloads are a common place for malicious content to hide
The browser extensions you forgot about might be the riskiest thing you use
Security researchers recently uncovered a long running campaign that saw malicious browser extensions infect millions of users across Chrome, Edge, and Firefox, often without raising any suspicion. The activity, linked to a threat cluster dubbed DarkSpectre, involved extensions that appeared completely legitimate, complete with positive reviews, large install numbers, and official store badges. In some cases, these extensions sat quietly for days or weeks before activating malicious behaviour.
What makes this story so unsettling is how normal it all looks. As we talked about on the show, these were not shady downloads from obscure websites. They were tools people installed to customise tabs, improve productivity, or tweak their browsing experience. Once trusted, they were largely forgotten. That trust gave attackers ongoing access to sessions, credentials, meeting data, and in some cases crypto wallets, turning the browser into a silent surveillance tool.
This is a reminder that your browser is not just a window to the internet. It is part of your attack surface. Extensions run with deep privileges, often seeing everything you type, click, or view. When they turn malicious later, detection is hard and user suspicion is low, because nothing appears to change.
Awareness angles
- Install once does not mean safe forever – Extensions can change behaviour after updates, long after reviews and store checks have passed
- Dormant threats are deliberate – Waiting days or weeks before activating is a common way to evade detection and earn user trust
- Your browser is a security boundary – Extensions have access to sensitive data and sessions, making them a direct path into work and personal accounts
Meta knew about scam ads, and people kept getting hurt anyway
A Reuters investigation a couple of weeks ago laid out something many people already suspected. Meta, the company behind Facebook and Instagram, knew scam ads were a problem, knew how to reduce them, and still chose to manage the situation rather than fix it properly.
This is not about edge cases or clever users spotting red flags. These are the fake loan offers, investment scams, and impersonation ads that show up while people are tired, stressed, or just scrolling. Reuters reported that Meta was aware stronger advertiser checks would cut scams, but held back because of cost and potential impact on ad revenue. In other words, the scams kept running, and real people kept paying the price.
As we said on the show, this is where the blame needs to move. When the same scams appear again and again, it stops being a question of awareness or education. If a platform knows what works and delays using it, that is a choice. And when that choice leads to people losing money, confidence, or trust, it is not on the user to be more careful, it is on the platform to do better.
Awareness angles
- People are not failing here – When scams keep appearing, the problem is not judgement, it is enforcement
- Meta had options – Stronger checks would have reduced harm, and choosing not to use them has consequences
- Scams are a design issue – What platforms allow, tolerate, or profit from shapes who gets hurt
This week's discussion points...
Anna’s Archive claims massive Spotify scrape, raising questions about data access and abuse – Watch | Read (Android Authority)
Rainbow Six Siege hit by major hack, Ubisoft takes servers offline after chaos in game economy and bans – Watch | Read (Tom’s Hardware)
Korean Air discloses passenger data exposure after supplier cyberattack – Watch | Read (Security Affairs)
Coupang breach uncovered after smashed laptop data recovered by investigators – Watch | Read (The Record)
Phishing campaign abuses real Google services to look legit, then steals Microsoft logins – Watch | Read (TechRadar)
British hacker wins Australian visa after legally hacking government website – Watch | Read (Cyber News)
ErrTraffic sells “fake browser glitch” pages to push ClickFix attacks – Watch | Read (BleepingComputer)
DarkSpectre browser extension malware infected 8.8 million users across Chrome, Edge and Firefox – Watch | Read (Cybersecurity News)
Meta built “playbook” to delay crackdowns on scam ads, internal documents reveal – Watch | Read (Reuters)
NYC mayoral inauguration bans Flipper Zero and Raspberry Pi devices over security fears – Watch | Read (BleepingComputer)
And Finally...When AI Jailbreaks Get Pushed Underground
A subreddit focused on ChatGPT jailbreaks has been shut down, and on the surface that sounds like a win. Fewer prompts being shared, less obvious misuse, and fewer screenshots doing the rounds.
But that space was doing more than showing people how to break things. It was one of the few places where you could see what people were actually trying in the wild. What worked. What failed. What guardrails were being walked straight around. By removing it from Reddit, the behaviour has not stopped, it has just moved somewhere quieter.
This is the awkward bit. A lot of security learning comes from watching real behaviour, not ideal behaviour. Taking away visibility does not suddenly make AI safer, it just makes the problems easier to ignore. The jailbreaks will still exist, fewer defenders will see them.
Awareness angles
- You cannot fix what you cannot see – Removing public discussion hides problems, it does not remove them
- People will keep pushing systems – Curiosity and misuse do not disappear just because a platform closes a space
- Visibility beats comfort – Seeing how things break is uncomfortable, but it is how security actually improves
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.