ShadowTalk: Powered by ReliaQuest

From Vulnerability Research to Domain Admin in Minutes

AI is changing the economics of cyberattacks. In this episode, we examine how a suspected threat actor used AI agents to accelerate PaperCut vulnerability research, explo

One Empty Field: The Email Security Bypass Letting Attackers Impersonate Your Executives

Organizations rely on Microsoft 365's RejectDirectSend control to block internal email spoofing—but a structural gap lets attackers walk right past it. With nothing

From Data Dumps to Critical Findings: The New Era of Data Extortion

Threat actors do not see old email archives, forgotten shared drives, and outdated CRM exports as clutter. They see them as searchable inventory. With AI-assisted analysi

Vishing at Scale: Inside the Criminal SaaS Platform Enabling Account Takeover

What if a threat actor already knew your name, your job title, your manager's name, and your direct number before they ever picked up the phone? That's not a hy

Nation-State Actors: Iran’s PLC Attacks, Russia’s Zero-Click Email Exploit, and North Korea’s Fake Employees

Three nation-states. Three distinct playbooks. Iranian actors are targeting internet-exposed industrial controllers and disabling critical safety systems. A Russian threa

When AI Escapes the Lab: The Hugging Face Breach, PyPI Malware, and What It Means for Defenders

Fully autonomous attacks are here. AI agents escape a test environment, exploit zero-days, coordinate through shared infrastructure, and breach a production company—gener

The Gentlemen, Deadlock, and Clop: The Groups Driving Ransomware & Extortion in 2026

An affiliate receives a ready-made intrusion kit — pre-compromised targets, an EDR killer, and a full deployment workflow included. No building from scratch. No long ramp

Compromised Hotel Gateways, Fake Microsoft Domains, and the APT28-Adjacent Campaign That Bypasses MFA Without a Phishing Click

An employee connects to hotel Wi-Fi, receives a familiar Microsoft 365 sign-in prompt, and authenticates. No phishing email. No malicious link. No suspicious attachment.

The Largest Patch Tuesday Ever: 622 CVEs, a 1,380% Phishing Surge, and the Two-Front War on Initial Access

Defenders aren't losing ground on one front, they're losing it on two at once. The largest Patch Tuesday in history just dropped alongside a 1,380% surge in phi

FortiBleed, 70,000 Compromised Devices, and the Credential Economy Powering Every Breach

When a 20-person team using AI, automated tools, and a list of default credentials compromised 70,000 devices across 194 countries they exposed how mature the criminal ma

Inside Conti's Leaked Chats: 300,000 Messages, a Criminal Empire, and the Ransomware Playbook Still Running Today

When 300,000 internal messages from the world's most prolific ransomware gang were leaked, they exposed more then a shadowy underground network, a full company. HR d

How Hackers Are Using AI Right Now: Faster Attacks, Smarter Malware, and a New Arms Race

AI is not replacing threat actors, instead it is making them faster, cheaper, and harder to stop. From AI powered phishing campaigns generating thousands of pages simulta

Klue, Kali365, OAuth: When the Front Door Is a Trusted Integration

In the Klue compromises threat actors walked in through a trusted integration, using legitimate credentials to quietly siphon Salesforce CRM data at scale. The challenge

ShinyHunters' Expanding Toolkit: Oracle PeopleSoft Zero-Day Exploitation and the BreachForums Defense Gaps

ShinyHunters dominated headlines this week: a zero-day, a BreachForums listing, and unverified claims all hitting at once. The problem isn't just keeping up with the

China-Linked Cyber Espionage: How OP-512 Exploited Legacy IIS Servers and Evaded Detection

Your team built defenses around known China-linked clusters. The file hashes are tracked. The behavioral patterns are documented. What those weren't built to catch i

SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access

Your team patches the device. The firmware version matches the advisory. The ticket closes. The device comes off the remediation queue. What your workflow never tracked i

Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook

Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the inte

SQLite, Mistral, OpenAI: How AI Attacks Are Reshaping the Attack Surface

What happens when an AI agent uncovers a zero-day in hours instead of weeks, and state-backed groups are already operationalizing the same tools? With self-hosted AI infr

Canvas, Trellix, Mini Shai-Hulud: How Defenders Respond When Supply Chain Attacks Become Weekly

What's driving the surge in weekly supply chain attacks, and why does the real defender problem start after the supplier gets hit? With 275 million records exposed a

Akira, ShinyHunters, and The Gentlemen: Extortion Lessons From Early 2026

What factors have driven the top ransomware and extortion groups' success in early 2026? And how should organizations structure their defenses to protect against the