Identity & Phishing

KnowBe4 vs a Fake North Korean IT Worker: The AI-Era Insider Case Study

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI & Agent Security Identity & Phishing Security

In July 2024, security-awareness firm KnowBe4 hired a remote principal software engineer who turned out to be a North Korean IT worker using an AI-groomed persona, a US PPPoE front, and a stolen identity. Detected within 32 minutes of suspicious activity and fully rigged with granular session logging, the case became the definitive inside look at DPRK pension applicantFraud — from laptop farms to paycheck revenue streams funding weapons programs. This piece reconstructs the fraud chain, the detection story, and the hiring controls that failed.

MGM, Caesars, and Scattered Spider: The Vishing Fall of 2023

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In September 2023 Scattered Spider vished the MGM helpdesk, pivoted through Okta to ESXi, and detonated ALPHV ransomware — a $100M quarter for MGM while Caesars paid up. The reference incident for helpdesk verification, MFA fatigue, and pay-vs-rebuild economics.

Discord.io Breach: When Brand Adjacency Becomes Attack Surface

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security

Roughly 100,000 Discord.io user accounts were dumped for sale in August 2023 — and the confusion with Discord itself proved that brand-adjacent third parties are breach surface for your users even when your systems are never touched.

Storm-0558 Forged-Token Breach: The Stolen Key That Read Government Email

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

China-linked Storm-0558 forged Azure AD tokens with a stolen Microsoft consumer signing key and read email at ~25 organizations including the State and Commerce departments — exposing vendor key hygiene, token scope validation, and log-tiering as board-level security questions.

InfraGard Portal Breach: Account Takeover Inside the Vetted

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security

USDoD hijacked a chapter president’s InfraGard account and listed 87,000 members’ PII for sale. Identity lessons for trusted-community portals.

Namecheap/SendGrid Hijack: Phishing With Perfect DMARC

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security Supply Chain Security

Phishers compromised a SendGrid supplier account and sent MetaMask-themed mail through Namecheap’s legitimate pipeline — SPF, DKIM, and DMARC all passed.

Uber’s 2022 Hack: A Bought Password, a Flood of Pushes, and vSphere

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

An 18-year-old bought a contractor’s Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.

Twitch Leak: 125GB of Source Code and Payouts on 4chan

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security Supply Chain Security

No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.

Facebook 533M Leak: Old Scraped Data Never Stops Burning

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Emerging Tech & Architecture Identity & Phishing Security

A 2019 contact-import scrape of 533M users hit every phone number to profile, free-dumped in 2021 and still fueling vishing and SIM-swaps today. Why data age barely dents attacker value.

T-Mobile API Scraping 2023: 37M Accounts, One Credential

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security Web & API Security

A single compromised API credential let an actor scrape ~37 million T-Mobile accounts over six weeks. Machine-identity governance lessons from a repeat offender.

KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Identity & Phishing Security

CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?

LAPSUS$ Convictions: Teenagers, Helpdesks, and the GTA VI Leak

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Emerging Tech & Architecture Identity & Phishing Security

A London jury convicted the teenage LAPSUS$ hackers whose SIM swaps, MFA-fatigue pushes, and helpdesk manipulation breached Nvidia, Microsoft, Okta, Uber, and Rockstar — closing the criminal case that proved identity is the real perimeter.