
Insights from recent episode analysis
Audience Interest
Podcast Focus
Publishing Consistency
Platform Reach
Insights are generated by CastFox AI using publicly available data, episode content, and proprietary models.
Most discussed topics
Brands & references
Total monthly reach
Estimated from 1 chart position in 1 market.
By chart position
- 🇳🇿NZ · Technology#104500 to 3K
- Per-Episode Audience
Est. listeners per new episode within ~30 days
150 to 900🎙 Daily cadence·444 episodes·Last published 6d ago - Monthly Reach
Unique listeners across all episodes (30 days)
500 to 3K🇳🇿100% - Active Followers
Loyal subscribers who consistently listen
200 to 1.2K
Market Insights
Platform Distribution
Reach across major podcast platforms, updated hourly
Total Followers
—
Total Plays
—
Total Reviews
—
* Data sourced directly from platform APIs and aggregated hourly across all major podcast directories.
On the show
From 15 epsHosts
Not detected.
Recent guests
Recent episodes
Peeling back Banana RAT.
Jun 20, 2026
28m 59s
This Sparrow doesn't migrate.
Jun 13, 2026
22m 48s
You've been muted...permanently.
Jun 6, 2026
21m 02s
The skills pay the bills.
May 30, 2026
24m 06s
Ghosted by Grafana
May 23, 2026
25m 58s
Social Links & Contact
Official channels & resources
Official Website
Login
RSS Feed
Login
| Date | Episode | Topics | Guests | Brands | Places | Keywords | Sponsor | Length | |
|---|---|---|---|---|---|---|---|---|---|
| 6/20/26 | ![]() Peeling back Banana RAT. | This week, we are joined by Tom Kellermann, TrendAI's VP of AI Security and Threat Research, discussing their work on "Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud." Researchers from TrendAI's MDR team uncovered the full operation behind Banana RAT, a sophisticated banking trojan they track as SHADOW-WATER-063, by analyzing both attacker infrastructure and infected victim systems. The malware uses fileless PowerShell execution, layered obfuscation, and remote-control capabilities to steal credentials, manipulate banking sessions, intercept Pix QR code payments, and facilitate financial fraud targeting Brazilian banks. The campaign appears to be operated by a Brazilian Portuguese-speaking cybercriminal group with ties to the broader Tetrade banking malware ecosystem and may be evolving toward a malware-as-a-service model. The research and executive brief can be found here: Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud Learn more about your ad choices. Visit megaphone.fm/adchoices | 28m 59s | ||||||
| 6/13/26 | ![]() This Sparrow doesn't migrate. | Martin Zugec, Technical Solutions Director at Bitdefender, discussing their work on "FamousSparrow APT Targets Azerbaijani Oil and Gas Industry." Bitdefender researchers uncovered a sustained cyber espionage campaign by the China-linked FamousSparrow group targeting an Azerbaijani oil and gas company, highlighting the growing focus on critical energy infrastructure in the South Caucasus. The attackers repeatedly exploited the same vulnerable Microsoft Exchange server over multiple months, deploying evolving versions of Deed RAT and Terndoor malware through sophisticated DLL sideloading techniques designed to evade detection and maintain persistence. The operation underscores FamousSparrow's adaptability and persistence, demonstrating how advanced threat actors continually refine their tooling and return to compromised environments until vulnerabilities are fully remediated and access is cut off. The research and executive brief can be found here: FamousSparrow APT Targets Azerbaijani Oil and Gas Industry Learn more about your ad choices. Visit megaphone.fm/adchoices | 22m 48s | ||||||
| 6/6/26 | ![]() You've been muted...permanently. | Ismael Valenzuela, Arctic Wolf’s VP of Labs, Threat Research and Intelligence, discusses their work on "BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector." Arctic Wolf researchers uncovered a sophisticated campaign by North Korean threat group Lazarus Group subgroup BlueNoroff that targets cryptocurrency and Web3 executives through fake Zoom and Microsoft Teams meetings, using typo-squatted links, ClickFix-style attacks, and AI-generated deepfakes to steal credentials and cryptocurrency-related data. The attackers built a self-reinforcing operation that captures victims’ webcam footage and Telegram sessions, then repurposes those assets alongside AI-generated images to create increasingly convincing fake meeting participants for future attacks. Researchers identified more than 100 victims across 20 countries, with the campaign primarily targeting CEOs, founders, investors, and senior leaders in the cryptocurrency, blockchain, and financial sectors as part of a long-running effort to steal digital assets and gain access to high-value networks. The research and executive brief can be found here: BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector Learn more about your ad choices. Visit megaphone.fm/adchoices | 21m 02s | ||||||
| 5/30/26 | ![]() The skills pay the bills.✨ | cybersecurityAI+4 | Marco Giuliani | GachiLoaderOpenClaw+3 | — | GachiLoaderAI skill lure+5 | — | 24m 06s | |
| 5/23/26 | ![]() Ghosted by Grafana✨ | vulnerabilitydata exfiltration+4 | Sasi Levi | Noma SecurityGrafana+1 | — | Grafanavulnerability+5 | — | 25m 58s | |
| 5/16/26 | ![]() Scam papers served.✨ | phishing campaignscybersecurity+4 | Thomas Elkins | Casbaneiro banking trojanHorabot malware framework+3 | Latin AmericaEurope | phishingcybersecurity+5 | — | 26m 44s | |
| 5/9/26 | ![]() The spy who logged me in.✨ | cybersecurityespionage+4 | Mark Kelly | ProofpointEU+2 | IranEurope+1 | TA416phishing campaigns+6 | — | 24m 03s | |
| 5/2/26 | ![]() Double-edged threat.✨ | iOS securitycyber threats+4 | Justin Albrecht | iOSLookout+1 | Ukraine | DarkSwordiOS exploit+5 | — | 30m 51s | |
| 4/25/26 | ![]() A QRazy clever scam.✨ | QR codesphishing+3 | Juliana Testa | 7AIMicrosoft Defender+1 | — | quishingphishing campaign+5 | — | 18m 53s | |
| 4/18/26 | ![]() A new breed of RAT.✨ | cybersecurityremote access trojans+3 | Dr. Darren Williams | Steaelite RATBlackFog | — | Steaelite RATdouble extortion+3 | — | 21m 52s | |
Want analysis for the episodes below?Free for Pro Submit a request, we'll have your selected episodes analyzed within an hour. Free, at no cost to you, for Pro users. | |||||||||
| 4/11/26 | ![]() A wolf in admin clothing.✨ | malwarecybersecurity+3 | Selena Larson | Microsoft TeamsZoom+2 | — | TrustConnectmalware+6 | — | 24m 44s | |
| 4/4/26 | ![]() Startup surge sparks spy interest.✨ | cybersecurityespionage+4 | Santiago Pontiroli | Crimson RATAcronis TRU team+2 | India | Transparent TribeAcronis+5 | — | 19m 15s | |
| 3/28/26 | ![]() When “safe” documents aren’t.✨ | PDF vulnerabilitiescybersecurity+3 | Omer Ninburg | Novee SecurityFrom PDF to Pwn: Scalable 0day Discovery in PDF Engines and Services Using Multi-Agent LLMs | — | PDFvulnerabilities+5 | — | 21m 03s | |
| 3/21/26 | ![]() A subtle flaw, a massive blast radius.✨ | AWS vulnerabilitiessupply chain security+3 | Yuval Avrahami | AWS JavaScript SDKWiz+2 | — | CodeBreachAWS CodeBuild+5 | — | 17m 18s | |
| 3/14/26 | ![]() Your AI sidekick might be a spy.✨ | AI securitymalicious extensions+4 | Or Eshed | ChatGPTLayerX Security+2 | — | malicious extensionsChatGPT accounts+5 | — | 22m 47s | |
| 3/7/26 | ![]() The scareware rabbit hole.✨ | cybersecurityscareware+4 | Marcelle Lee | GoogleCensys+5 | — | scarewarecybersecurity+5 | — | 27m 53s | |
| 2/28/26 | ![]() The parking lot of digital danger.✨ | cybersecuritymalware+3 | Dr. Renée Burton | InfobloxCybersecurity and Infrastructure Security Agency | — | parked domainsdirect search+3 | — | 21m 13s | |
| 2/21/26 | ![]() Telegram for the throne.✨ | Iranian cyber operationsAPT campaigns+3 | Tomer Bar | SafeBreach LabsPalo Alto Networks+2 | — | IranAPT+7 | — | 21m 21s | |
| 2/14/26 | ![]() Stealer in the status bar. | Today we have Ziv Mador, VP of Security Research from LevelBlue SpiderLabs discussing their work on "SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp." Researchers at LevelBlue SpiderLabs have identified a new Brazilian banking Trojan dubbed Eternidade Stealer, spread through WhatsApp hijacking and social engineering campaigns that use a Python-based worm to steal contacts and distribute malicious MSI installers. The Delphi-compiled malware targets Brazilian victims, profiles infected systems, dynamically retrieves its command-and-control server via IMAP email, and deploys banking overlays to harvest credentials from financial institutions and cryptocurrency platforms. The campaign reflects the continued evolution of Brazil’s cybercrime ecosystem, combining WhatsApp propagation, geofencing, encrypted C2 communications, and process injection to maintain stealth and persistence. The research can be found here: SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp Learn more about your ad choices. Visit megaphone.fm/adchoices | 15m 34s | ||||||
| 2/7/26 | ![]() The phishing kit that thinks like a human. | Piotr Wojtyla, Head of Threat Intel and Platform at Abnormal AI, is discussing their work on "InboxPrime AI: New Phishing Kit Fueling Scalable, AI-Powered Cybercrime." A new AI-powered phishing kit called InboxPrime AI is rapidly gaining traction in underground forums, automating the creation and delivery of highly believable phishing emails that mimic legitimate business communications and leverage Gmail’s web interface to evade detection. First spotted in October 2025, the kit combines AI-generated content, template variation, sender identity spoofing, and built-in spam checks to maximize inbox placement and dramatically lower the barrier to running large-scale phishing campaigns. Its shift to a one-time $1,000 purchase and growing user base underscore the industrialization of phishing and highlight how quickly AI-driven attack tools are outpacing legacy email defenses. The research can be found here: InboxPrime AI: New Phishing Kit Fueling Scalable, AI-Powered Cybercrime Learn more about your ad choices. Visit megaphone.fm/adchoices | 25m 52s | ||||||
| 1/31/26 | ![]() The link knows all. | Muhammad Danish, University of New Mexico lead author and cybersecurity researcher, discussing his team's work on "Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs". This paper examines how the push for frictionless user experiences has led many services to rely on SMS-delivered, single-click URLs—an inherently insecure channel that can be intercepted or leaked. Analyzing more than 322,000 unique URLs from 33 million messages, the researchers found widespread security failures, including exposed PII across 701 endpoints at 177 services due to weak, token-based authentication that treats possession of a link as sufficient authorization. The study also identified low-entropy tokens enabling mass URL enumeration and data overfetching issues, though disclosures prompted 18 services to fix flaws, improving privacy protections for at least 120 million users. The research can be found here: Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs Learn more about your ad choices. Visit megaphone.fm/adchoices | 21m 41s | ||||||
| 1/24/26 | ![]() Caught in the funnel. | Today we have Andrew Northern, Principal Security Researcher at Censys, discussing "From Evasion to Evidence: Exploiting the Funneling Behavior of Injects". This research explains how modern web malware campaigns use multi-stage JavaScript injections, redirects, and fake CAPTCHAs to selectively deliver payloads and evade detection. It shows that these attack chains rely on stable redirect and traffic-distribution chokepoints that can be monitored at scale. Using the SmartApe campaign as a case study, the report demonstrates how defenders can turn those chokepoints into high-confidence detection and tracking opportunities. The research can be found here: From Evasion to Evidence: Exploiting the Funneling Behavior of Injects Learn more about your ad choices. Visit megaphone.fm/adchoices | 23m 33s | ||||||
| 1/17/26 | ![]() Picture perfect deception. | Today we are joined by Ben Folland, Security Operations Analyst from Huntress, discussing their work on "ClickFix Gets Creative: Malware Buried in Images." This analysis covers a ClickFix campaign that uses fake human verification checks and a realistic Windows Update screen to trick users into manually running malicious commands. The multi-stage attack chain leverages mshta.exe, PowerShell, and .NET loaders, ultimately delivering infostealers like LummaC2 and Rhadamanthys, with payloads hidden inside PNG images using steganography. While technically sophisticated, the campaign hinges on simple user interaction, underscoring the importance of user awareness and controls around command execution. The research can be found here: ClickFix Gets Creative: Malware Buried in Images Learn more about your ad choices. Visit megaphone.fm/adchoices | 20m 17s | ||||||
| 1/10/26 | ![]() Walking on EggStremes. | This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company." Built for long-term espionage, the campaign uses DLL sideloading, in-memory execution, and abused Windows services to stay stealthy and persistent. We walk through how the multi-stage framework delivers a powerful backdoor with reconnaissance, lateral movement, data theft, and keylogging capabilities—and what this operation reveals about the evolving tactics defenders need to watch for. The research can be found here: EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company Learn more about your ad choices. Visit megaphone.fm/adchoices | 28m 01s | ||||||
| 1/3/26 | ![]() Don’t trust that app! | While our team is out on winter break, please enjoy this episode of Research Saturday. Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon. These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft’s upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks. The research can be found here: Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing Learn more about your ad choices. Visit megaphone.fm/adchoices | 20m 41s | ||||||
Showing 25 of 453
Pitch Fit is a Pro feature
See how bookable this show is for guests, which brands already advertise, the per-episode ad value, and the best-fit guest and sponsor profile. The numbers are blurred on the free plan.
How readily this show books outside guests like you.
How proven this show is for host-read sponsorships.
For Guests
ProFor Advertisers
ProUpgrade to Pro to unlock guest cadence, sponsor categories, fit scores, and per-episode ad value for this show.
Chart Positions
1 placement across 1 market.
Chart Positions
1 placement across 1 market.



