Hacking Humans

Latest Episodes:

Objection! That's a scam. Aug 20, 2026

Show notes

This week, while Dave is out, hosts ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of the show ⁠Michele Kellerman⁠. We start with some follow-up from Michele on efforts in the Philippines to crack down on online fraud centers and the ongoing fight against scam operations. Joe explores WhatsApp's new on-device scam detection feature and whether it can actually spot suspicious conversations without compromising privacy. Michele covers an elaborate jury-duty scam that kept a Florida woman on the phone for more than 10 hours, using fake law enforcement, cryptocurrency payments, and stolen personal information to steal more than $25,000. Maria looks at a new wave of back-to-school scams using fake websites, phishing attempts, and AI-generated content to target parents and students. Our Catch of the Day comes from Ami, who discovered that even paying by check isn't foolproof after a mailed check was intercepted, altered, and cashed by someone else.

Resources and links to stories:

attribution (noun) [Word Notes] Aug 18, 2026

Show notes

Please enjoy this encore of Word Notes.

Definition one: The recognition of a set of repeatable attack patterns across the intrusion kill chain.

Definition two: Determining the responsibility for offensive cyber operations.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/attribution⁠

Audio reference link: Nunnikhoven, M., 2018. Cybersecurity Basics #9 - Attack Attribution [Video]. YouTube. URL ⁠www.youtube.com/watch?v=rlyMz5jN_Vs

A golden opportunity...for fraud. Aug 13, 2026

Show notes

This week, while Dave is out, hosts ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of the show Michele Kellerman. We start with some follow-up on the chicken coop, where the big news is that the chicks have officially hatched. Maria covers how AI is fueling a growing share of cybercrime in Africa as scammers use increasingly sophisticated digital tools to target victims. Michele looks at a multi-step gold bar scam targeting older New Yorkers, where criminals first compromise victims' devices and information before posing as government or law enforcement officials to steal their money. Joe breaks down the Fun Coffee crypto investment scam, which promised enormous returns before the platform suddenly shut down, leaving victims with more than HK$104 million in reported losses. Our Catch of the Day comes from Reddit, with another scam that proves if an offer sounds too good to be true, it probably comes with a very suspicious backstory.

Resources and links to stories:

spearphishing (noun) [Word Notes] Aug 11, 2026

Show notes

Please enjoy this encore of Word Notes.

A type of cyber attack where an attacker sends a targeted and personalized email or other form of communication to a specific individual or a small group of individuals with the intention of tricking them into divulging sensitive information, such as a password, or convincing them to click a malicious link that will enable the attacker to take control of the victim's machine.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/spearphishing⁠

Audio reference link: Richardson, T., 2014. What is the difference between phishing and spear-phishing? [Video]. YouTube. URL ⁠www.youtube.com/watch?v=Wpx5IMduWX4⁠.

Cosmic brownie crimes. Aug 06, 2026

Show notes

This week, hosts of N2K CyberWire ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ alongside ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up after a listener asks Joe to finally reveal the backpack that's become a recurring character on the show—and whether it's really as airport-infeding as everyone says. Joe covers Myanmar's approval of the death penalty for convicted scammers and shares a real-world fraud case involving forged Little Debbie snack deliveries that shows scams don't always happen online. Maria explores the rise in foreclosure rescue and equity-stripping scams, where fraudsters target financially vulnerable homeowners and attempt to steal their money—or even their homes. Dave breaks down new research showing how AI-powered phone farms are making it easier than ever for scammers to automate fraud, manage hundreds of fake accounts, and scale their operations with minimal technical skill. Our Catch of the Day is on a scam-baiting exchange featuring an unforgettable tale of a supposed two-timing "Barb Johnson" that quickly spirals into absurdity.

Resources and links to stories:

resiliency (noun) [Word Notes] Aug 04, 2026

Show notes

Please enjoy this encore of Word Notes.

The ability to continuously deliver the intended outcome despite adverse cyber events.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/resiliency⁠

Audio reference link: Cameron, J., 1984. The Terminator [Movie]. IMDb. URL ⁠www.imdb.com/title/tt0088247/⁠.

Clip Nation, 2012. The Arnold Schwarzenegger “I’ll Be Back” Supercut [Video]. YouTube. URL ⁠www.youtube.com/watch?v=-YEG9DgRHhA⁠.

Coops, C., 2013. Terminator 2 Theme [Video]. YouTube. URL ⁠www.youtube.com/watch?v=pVZ2NShfCE8⁠.

Class is in session—for cybercriminals. [OMITB] Aug 04, 2026

Show notes

Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, Today, while Keith is off, Dave and Selena kick off a back-to-school special, exploring the cyber threats students, parents, educators, and universities should have on their radar. They examine the rise in job scams targeting university communities, discuss recent espionage activity aimed at higher education institutions in the U.S. and Canada, and look at how cybercriminals prey on younger audiences through online games, YouTube, and social media. From fake game cracks delivering information stealers to sextortion schemes targeting teens, they break down the tactics attackers are using and share practical advice for staying safe as the new school year begins.

Sources: ⁠⁠⁠⁠⁠

Nothing but the spoof. Jul 30, 2026

Show notes

Resources and links to stories:

Security Operations Center (SOC) (noun) [Word Notes] Jul 28, 2026

Show notes

Please enjoy this encore of Word Notes.

A centralized facility or team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents within an organization.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/security-operations-center⁠

Audio reference link: AT&T Tech Channel, 2012. A tour of AT&T’s Network Operations Center (1979) [Video]. YouTube. URL ⁠www.youtube.com/watch?v=cigc3hvMyWw.

Red flags ahead. Jul 23, 2026

Show notes

This week, hosts of N2K CyberWire ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ alongside ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up as Joe corrects the record on router end-of-support after a listener points out that manufacturers like Netgear don't intentionally disable routers when support ends, and we also share a listener-submitted business email compromise case that highlights the importance of independently verifying payment requests. Maria covers how scammers can accidentally reveal themselves by mispronouncing local place names, turning a convincing jury duty scam into an obvious fake. Joe shares how a veteran CBS News journalist who regularly reports on scams nearly fell victim to an elaborate bank impersonation scheme, showing that anyone can be targeted. Dave reflects on a listener's "Unknown Situation. Shields Up." philosophy, encouraging people to slow down and verify unexpected communications before taking action. Our Catch of the Day is on an over-the-top scam email from a self-proclaimed internet fraudster claiming to be giving away millions in a last-minute bid for forgiveness.

Resources and links to stories:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected