The Cyber Threat Perspective

What happens when your entire security investment means nothing? In this episode, Brad and Spencer break down how ShinyHunters and related groups like Scattered Spider and Lapsus$ keep getting in through social engineering, no exploit required. They call your users posing as real IT staff, sometimes with AI voices tuned to sound local, and walk them into handing over session tokens and cookies. The attackers already have a session, so MFA and conditional access don’t stop them.
Spencer shares a lab test where a compliant device conditional access policy was bypassed by replaying cookies from an exported HAR file. Brad explains why the SSO handoff to third-party SaaS apps like Salesforce and document management systems leaves you relying on weaker session security. The hosts also cover why these intrusions are so hard to see in logs and what defenders can do about it.
In this episode:
Who ShinyHunters are and why they focus on data extortion, not ransomware
How vishing and AI voice masking make these calls convincing
Why attackers are after session tokens, not credentials
How the SSO handoff to third-party SaaS apps sidesteps Microsoft protections
Why law firm DMS platforms are a top target for bulk data theft
Why stolen sessions rarely show up in Entra sign-in logs or SaaS login records
Using deception assets as high-fidelity, low-cost detection
Authentication brokers and named locations as a mitigation
Why tenant reviews and purple teaming beat assumptions
Need help testing whether your environment can withstand session token theft? SecurIT360 offers penetration testing, purple teaming, and offensive security services. Visit securit360.com to learn more.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

One dangerous permission in Active Directory can be all it takes for an attacker to turn a single compromised account into full control of your domain. On our internal pen tests, that one misconfiguration is often the first domino. Everything after it is blast radius.
In this episode, Spencer and Brad explain why dangerous permissions pile up in the first place, why they stay hidden for years, and what happens downstream when nobody finds them. They also cover where to start cleaning things up without buying a single new tool.
In this episode:
Why permissions accumulate through decommissions, upgrades, vendor installs, and “temporary” fixes that never get undone
How a Citrix install wizard that needed domain admin left behind an over-permissioned mess
How employee turnover and lost tribal knowledge make old access riskier to touch
Why inherited permissions, nested groups, and object ownership keep risk out of sight
Why BloodHound can surface tens of thousands of attack paths in one environment
Active Directory vs. Entra, and why the size of your attack surface is the better question
The downstream risks: privilege escalation, unauthorized access, lateral movement, and service account abuse
How attackers cause serious damage without ever reaching domain admin
Where to start: audit what broad groups like Domain Users, Authenticated Users, and Everyone can reach, beginning with your Tier 0 assets
Free tools to get started, including ADeleginator, PingCastle, Purple Knight, and BloodHound
Worried about what’s hiding in your Active Directory? SecurIT360’s internal penetration testing finds the dangerous permissions and attack paths before threat actors do. Reach out at securit360.com.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

200 episodes! Thank you to everyone who has listened, watched, and shared The Cyber Threat Perspective along the way. To mark the milestone, Brad Causey and Jordan Natter are back with Part 6 of our OWASP Top 10 series, breaking down A06: Insecure Design. These flaws show up when an application does exactly what it was designed to do, but nobody stopped to ask how that functionality could be abused. Brad and Jordan walk through what insecure design looks like in practice, share real-world war stories from pen tests and beyond, and explain how to catch these flaws before they ever reach production.
In this episode:
Why insecure design fell from #4 to #6 in the OWASP Top 10, and why that isn’t good news
Rate limiting, user enumeration, and why secret questions are a no go
How a teenager’s AOL trial CD experiment turned into a career
Abusing rewards programs, group bookings, and first-purchase coupons
Taking over insurance accounts using publicly available census data
Prevention through misuse cases, threat modeling, and DevSecOps
Why a flaw caught in the design phase costs a fraction of one found in a pen test
Need web app pen testing? Visit https://securit360.com
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

We’re halfway through the OWASP Top 10, and this one is a favorite. Brad Causey is joined by Jordan Natter, SecurIT360’s resident web app pen tester, to cover A05: Injection. They explain how injection flaws work, why it slipped two spots on the list but is no less dangerous, and what developers can do to shut it down.
Along the way, they share real stories from the field. There’s a first-ever pen test that turned a blood drive gift card app into $25,000 in gift cards and a destroyed production database. There’s a harmless-looking hub status dropdown that became a reverse shell. And there’s a username field that handed over session cookies.
In this episode:
What injection is and why it can happen anywhere from the browser to the data layer
Reflected, stored, and DOM-based cross-site scripting, and how they differ
SQL, NoSQL, LDAP, and why no data layer is immune to injection
Why injection moving to #5 doesn’t make it a lower priority
How CSP, HttpOnly cookies, CSRF tokens, and SameSite attributes break attack chains
Why client-side validation is a usability feature, not a security control
Whitelisting vs. blacklisting, parameterized queries, and output encoding
The case for never testing in production, and backing up your staging data too
Resources mentioned: OWASP Input Validation Cheat Sheet and the OWASP Cheat Sheet Series
Need a web app pen test or have questions about application security? Reach out to the SecurIT360 team.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

It’s Cybersecurity Awareness Month, so we’re bringing back one of the most practical episodes in our catalog. Strong passwords are one of the basics of good security, but weak and reused credentials are still a common way attackers get in.
In this episode, Brad and Spencer look at why weak passwords keep showing up in real-world compromises. They cover the habits and identity management gaps that cause them and what organizations can do to close those gaps.
In this episode:
Why weak passwords are still a painfully persistent problem
How poor password habits and identity gaps expose organizations to compromise
Common mistakes attackers take advantage of
Practical defensive measures you can put in place
Originally released November 2024.
Sources:
Verizon 2023 Data Breach Investigations Report: https://www.verizon.com/about/news/2023-data-breach-investigations-report
1Password, Challenges of Shadow IT: https://blog.1password.com/challenges-of-shadow-it/
Microsoft Digital Defense Report 2024: https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024
Links:
Work with us: https://securit360.com
Blog: https://offsec.blog/
YouTube: https://www.youtube.com/@cyberthreatpov
X/Twitter: https://x.com/cyberthreatpov
Spencer Alessi: https://spenceralessi.co
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com