A London jury convicted the teenage LAPSUS$ hackers whose SIM swaps, MFA-fatigue pushes, and helpdesk manipulation breached Nvidia, Microsoft, Okta, Uber, and Rockstar — closing the criminal case that proved identity is the real perimeter.
A Lapsus$-linked teenager allegedly reached Rockstar’s Slack via helpdesk social engineering and posted 90+ GTA VI dev clips. The collaboration suite was the vault.
On September 5, 2024, Transport for London detected an intrusion begun days earlier through social engineering of staff — and within a week a 17-year-old was arrested, then charged under the Computer Misuse Act, for a breach that exposed contact details and the bank details of roughly 3,000 Oyster refund customers. This account reconstructs the phishing entry, the lateral movement, the containment that took status boards and the refund portal offline, the NCSC-NCA response, and the municipal-security lessons that outlasted the headlines.
37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.
780 GB of Frostbite engine and FIFA code left EA through a purchased Slack cookie and one help-desk MFA reset. The breach that proved sessions, not passwords, are the modern front door.
A fake CAPTCHA says press Windows-R, paste the verification code, hit Enter. The code is a PowerShell download cradle, and it runs with your full user authority, past every browser sandbox. Why this trick works, the variant families, and the one rule users can memorise that kills the whole class.