GTA 6 scams launched within hours of pre-orders going live. Scattered Spider's teenage hackers pleaded guilty for the TfL attack, and one of them was hacking US hospitals while on bail. And a fake AI plugin passed every security scanner because the malware only switched on after the check was done.

This week on The Awareness Angle: why attackers are borrowing your trust instead of breaking it, what the TfL case tells us about where the real hacking talent is, and why a clean security scan no longer means what it used to.

Also this week: 630GB of Apple and Tesla manufacturing secrets stolen from their supplier, three million Texans had driving licence numbers taken from a hunting licence database, fake receipts appearing in the Shop app for purchases you never made, ClickFix malware hitting Gizmodo readers through a compromised account, the White House app federal workers can't delete from their phones, and the cybersecurity firms including Huntress and HackerOne who got hacked through a marketing tool.

00:00 Intro
01:35 This week on The Awareness Angle
02:52 Breach of the Week: Apple and Tesla supplier hacked, 630GB leaked
07:43 Breach of the Week: 3 million Texans' driving licences stolen
11:01 Fake receipts in the Shop app
18:29 Scattered Spider guilty plea: TfL hack and US hospital attacks
23:00 GTA 6 scams
29:06 The AI plugin that passed every security scan
36:46 Gizmodo ClickFix attack
43:25 White House app on government phones
48:57 Cybersecurity firms hacked through Klue
54:09 Topic: Hosting malware on ChatGPT's own domain
57:37 Topic: The TikTok inheritance scam DM
1:02:13 Topic: Your address on the floor of a corner shop
1:05:28 Topic: Google AI gets it wrong
1:08:14 Topic: Luke's email from the US Defence Counterintelligence Agency

Subscribe for weekly cybersecurity news made for humans, not just IT teams.

The Awareness Angle is an independent podcast by Risky Creative, hosted by Ant Davis and Luke Pettigrew.

Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/
Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6
Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196
TikTok: https://www.tiktok.com/@antdaviscyber
Instagram: https://www.instagram.com/antdaviscyber
LinkedIn: https://www.linkedin.com/in/antdaviscyber
Website: riskycreative.com

Our Intro and Outro Song © 16 by Falling Forever
https://fallingforever.bandcamp.com/track/16
Licence: Creative Commons CC BY 4.0

This week the threats are getting bigger and the defences are getting stranger. A criminal gang hit a school system that holds records for eleven million kids, Americans lost a record three and a half billion dollars to imposter scams, and the FBI built an entire fake town just to train agents to fight cybercrime. Plus earbuds that could be listening in, malware hiding in Steam wallpapers, a nasty new Android banking trojan, your cheap streaming box secretly working for criminals, and Google quietly deciding to use your IP address for ads.

Chapters
00:00 Intro
03:01 Breach of the Week — Infinite Campus / ShinyHunters
07:56 Imposter Scams — $3.5 Billion Record
13:45 The FBI's Fake Town — Kinetic Cyber Range
18:50 Bluetooth Flaw — Beats Studio Buds
24:20 Steam Wallpaper Malware
28:17 Android Banking Trojan — Rokarolla
35:14 Popa Botnet — Cheap Streaming Boxes
39:11 Google — IP Address Ad Targeting
42:24 Security Socials — Fake iOS Virus Pop-up
46:10 Security Socials — Claude Age Verification
56:05 And Finally — Whale Song Captcha, Cloudflare Lava Lamps & SETI@home

The Awareness Angle is an independent podcast by Risky Creative. Subscribe for weekly cybersecurity news made for humans, not just IT teams.

Find us
Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/
Website: riskycreative.com
TikTok: https://www.tiktok.com/@antdaviscyber
Instagram: https://www.instagram.com/antdaviscyber
LinkedIn: https://www.linkedin.com/in/antdaviscyber

Our Intro and Outro Song © 16 by Falling Forever
https://fallingforever.bandcamp.com/track/16
Licence: Creative Commons CC BY 4.0

ShinyHunters breached the University of Nottingham using a critical Oracle PeopleSoft zero-day, leaking passport numbers, National Insurance numbers, disability data and financial records for 455,000 students. If you studied at Nottingham, check haveibeenpwned.com now.

A hidden camera was found in a ceiling tile at 2 Marsham Street, London, the Home Office building that approved China's controversial new mega-embassy. Nobody knows who put it there or how long it was recording.

Someone filed fake data breach notices on Maine's official breach portal, which publishes filings instantly with no verification. The Register reported one as fact before readers flagged it.

Also this week: ServiceNow admits a security incident months after allegedly being warned. 10,000 malicious domains registered ahead of the FIFA World Cup. A disgruntled researcher bypasses BitLocker because Microsoft made him homeless. Google Chrome permanently kills uBlock Origin. The Met Police gives Apple and Samsung an ultimatum over stolen phones.

Phish of the Week: Temu callback phishing using a real password reset email.

CHAPTERS
0:01 Intro
3:45 Breach of the Week: University of Nottingham data breach and Oracle PeopleSoft zero-day
8:41 Hidden camera found in Whitehall building that approved China's mega-embassy
13:54 ServiceNow security incident: customer data accessed
16:36 FIFA World Cup 2026: 10,000 malicious domains
21:33 Nightmare Eclipse drops eighth Windows zero-day, bypasses BitLocker
27:39 Fake data breach notices posted to Maine's official portal
33:19 Google Chrome permanently kills uBlock Origin
37:51 Met Police urges Apple and Samsung to make stolen phones unusable
39:40 Apple Passwords auto-change feature
42:07 Phish of the Week: Temu password reset misuse
46:19 Security Socials: Police use AI to enhance CCTV image

Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/
Music: "16" by Falling Forever. https://fallingforever.bandcamp.com/track/16. CC BY 4.0: https://creativecommons.org/licenses/by/4.0/

NHS patients are only now being notified about a breach that happened two years ago. Hackers brute-forced Dashlane's two-factor authentication. The FBI has already spotted over 30 fake FIFA websites and yes, fifa.beer is one of them.

This week Ant and Luke cover why the two-year gap between the Synnovis ransomware attack and this week's notification letters is not unusual, and what it means for the people affected. Plus why the Dashlane breach is giving everyone LastPass flashbacks, and why your master password matters more than you might think.

Also this week: UK banks locked out of Anthropic's Claude Mythos while OpenAI steps in with GPT-5.5 Cyber, Mac malware that passed Apple's own notarization checks, a new MFA bypass platform sold on Telegram, and the NCSC's warning that AI is about to surface decades of hidden software vulnerabilities all at once.

Chapters:
00:00 Intro
02:53 Breach of the Week — NHS Blood Test Results
06:03 AI Banking — Claude Mythos vs GPT-5.5 Cyber
10:38 Dashlane Password Manager Breach
16:49 Apple Mac Malware — Operation FlutterBridge
21:59 Fake FIFA Websites — The FBI List
26:37 NCSC — Patch Flood Warning
31:43 Kali365 — MFA Bypass via Microsoft 365
35:46 Phish of the Week — Claude Ads Impersonation
39:38 Security Socials — Same Ingredient Different Delivery
42:38 Security Socials — Call of Duty Vulnerabilities

The Awareness Angle is an independent weekly cybersecurity podcast for security awareness professionals, CISOs, and anyone who wants to understand the human side of security.

Newsletter | YouTube | Apple Podcasts | TikTok | Instagram | LinkedIn

Our Intro and Outro Song © 16 by Falling Forever
https://fallingforever.bandcamp.com/track/16
Licence: Creative Commons CC BY 4.0

Solo episode this week. A fake UK visa website left 100,000 passports in an open folder online. iPhone thieves in London are now threatening victims' families to get them to remove Activation Lock. California has sued the company formerly known as 23andMe, alleging they paid the hacker in secret while telling customers everything was fine. A ChatGPT vulnerability lets attackers hide phishing links inside AI responses. A criminal group called Silent Ransom Group has been physically walking into US law firm offices dressed as IT support and plugging in USB drives. And researchers demonstrate AudioHijack - inaudible commands hidden inside podcasts, Zoom calls and music that AI assistants process as real instructions while you hear nothing.

Plus: a real Amber Alert that looked exactly like a phishing scam because the URL got clipped by a character limit, and how a TikToker's phone home screen told scammers exactly which bank to impersonate when they called him.

Chapters
00:00 Intro
01:04 SANS Security Awareness Summit - Official Media Partner Announcement
02:15 Flying Solo This Week
02:45 Breach of the Week - UK Visa Portal Leaks 100,000 Passports
04:34 London iPhone Theft - Thieves Are Now Threatening Your Family
09:42 23andMe - California Sues Over the Cover-Up, Not Just the Breach
15:47 ChatGPhish - Attackers Hiding Phishing Links Inside ChatGPT
21:31 Silent Ransom Group - Criminals Walking Into Law Firm Offices
27:36 AudioHijack - The AI Commands Hidden in Sounds You Can't Hear
34:50 Amber Alert Accidental Phishing (Ant's Topic)
39:41 Tom the Tech Chap - Your Phone Screen Tells Scammers Which Bank to Impersonate (Luke's Topic)

The Awareness Angle is a weekly cybersecurity podcast and newsletter that explains the biggest cyber threats, data breaches, and online scams in plain English. No jargon. No technical background needed. New episode every week.

📧 Newsletter
🌐 riskycreative.com
🎙️ Spotify
🎙️ Apple Podcasts
▶️ YouTube: @riskycreative
📱 TikTok: @antdaviscyber
📱 Instagram: @antdaviscyber
💼 LinkedIn: antdaviscyber

Our Intro and Outro Song © 16 by Falling Forever
https://fallingforever.bandcamp.com/track/16
Licence: CC BY 4.0 https://creativecommons.org/licenses/by/4.0/

CISA left admin passwords and AWS keys on a public GitHub repo called "Private-CISA" for six months. A new macOS stealer called Reaper fakes Apple security updates to steal everything on your machine. And the 2026 Verizon DBIR lands with 22,000 breaches across 145 countries.

00:00 Intro
01:30 Breach Watch: 7-Eleven / ShinyHunters
04:20 Breach Watch: Portugal postal service leak
07:12 CISA left passwords on public GitHub
12:32 Iran-linked attacks on US fuel monitors
17:54 Reaper macOS stealer
22:43 Discord end-to-end encryption
27:01 The 2026 Verizon DBIR breakdown
33:26 Newsletter and socials
34:30 Security Socials

Subscribe to the newsletter at riskycreative.com

Follow us on TikTok | Instagram | LinkedIn

Listen on Spotify | Apple Podcasts

Our Intro and Outro Song is 16 by Falling Forever
Listen on Bandcamp
Licensed under Creative Commons Attribution 4.0

This week the Canvas story is back. Instructure has paid ShinyHunters and says the stolen student data has been destroyed, but nobody in the security industry believes them. A telehealth platform breach exposed over 700,000 patients from a company most of them have never heard of.

Twin brothers got fired on a Teams call, forgot it was still recording, and deleted 96 government databases while talking through their plan out loud. Kids are beating age verification with a drawn-on mustache. A fake Claude Code installer is stealing developer credentials through Google search ads. And Google has confirmed for the first time that hackers used AI to find and exploit a zero-day.

Plus, a stoner just recovered $400,000 in Bitcoin after losing his password while high in 2015.

Chapters
00:00 Intro
01:42 Breach Watch: Canvas Pays ShinyHunters
05:56 Breach Watch: OpenLoop Health Breach
10:20 Twin Brothers Delete 96 Government Databases
14:03 Kids Bypass Age Verification With a Fake Mustache
19:18 Fake Claude Code Installer
24:34 Hackers Used AI to Find a Zero-Day
30:20 Stoner Recovers $400K Bitcoin With AI
33:57 Audi VIN Vulnerability
40:32 Security Socials
47:24 UK Banks Storing Biometric Data
51:47 Waymo Cars Driving Into Floods

Subscribe to the weekly newsletter at riskycreative.com or find us as The Awareness Angle on LinkedIn, TikTok, Instagram, YouTube, Spotify and Apple Podcasts.

📩 Newsletter
🎧 Spotify
🎧 Apple Podcasts
📸 Instagram
🎵 TikTok: @infosecant
▶️ YouTube

🎵 Music: "16" by Falling Forever
Creative Commons Attribution 4.0

Spirit Airlines shut down on May 2nd but nobody turned anything off. A security researcher discovered the entire booking system is still running, still taking personal details, and still attempting payment transactions for flights that will never exist. Google Chrome has been silently downloading a 4GB AI model onto your computer without consent, and if you delete it, it comes back. And a $5,000 robot lawn mower can be hijacked by anyone on the internet, including overriding the emergency stop button. It phones home to TikTok's parent company.

Also this week: Zara and Cushman & Wakefield both breached by ShinyHunters, a phishing attack that bypasses MFA using Microsoft's own login flow, Instagram quietly removes encrypted DMs, Anthropic's Mythos AI finds tens of thousands of vulnerabilities, OpenAI adds a trusted contact feature after self-harm lawsuits, and a student stops four high-speed trains with a radio he bought online.

Chapters
00:00 Intro
01:43 Breach Watch: Zara Data Breach via Third-Party Vendor
03:43 Breach Watch: Cushman & Wakefield Vishing Attack
08:34 ConsentFix v3 Bypasses MFA via Microsoft OAuth
12:18 Spirit Airlines Zombie Infrastructure Still Taking Bookings
19:04 Google Chrome Secretly Installs 4GB AI Model
24:31 Instagram Drops End-to-End Encryption on DMs
29:22 Anthropic Mythos Exposes Thousands of Vulnerabilities
35:25 OpenAI Trusted Contact Feature
40:14 Student Hacks Taiwan High-Speed Rail
44:25 Yarbo Robot Lawn Mower Hack
51:20 Security Socials
1:00:00 Outro

Subscribe to the weekly newsletter at riskycreative.com for the full breakdown of every story.

📺 YouTube
🎧 Spotify
🎧 Apple Podcasts
📰 Newsletter
📸 Instagram
📱 TikTok: @infosecant
🌐 Website

🎵 Our Intro and Outro Song © 16 by Falling Forever
Licensed under CC BY 4.0