Talos Takes

The VOLTA infostealer: Outsourcing cybercrime grunt work to AI

Attackers have always had a bottleneck. Stealing massive amounts of data is easy, but identifying which victims are truly worth the effort can be slow, tedious work. That changed with the discovery of the VOLTA-AUTODOXER. In this episode, Amy chats with Ryan Fetterman, creator of the CAIRN research framework, to break down a newly discovered infostealer. Unlike traditional stealers, VOLTA integrates LLMs to analyze stolen credentials in real-time, effectively turning raw data into a prioritized, high-value dossier for the attacker. We discuss: How VOLTA uses session replay to go beyond simple password theft and into your personal Gmail inbox and DoorDash order histories The unsettling way attackers are outsourcing analytical work to AI to rank victims by their potential monetization value The multi-model resilience that allows this stealer to bypass AI safety refusals Practical steps for defenders and individuals to harden their defenses Resources: Read the full research blog: https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer WIRED coverage: https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/ Learn more about CAIRN: https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/

• Transcript

Hardening your environment: From segmentation to AI kill switches

Network segmentation is a fundamental security practice, yet many organizations struggle to move past the conceptual stage. Craig Jackson from Talos IR joins Amy to explain how to build a segmentation strategy that serves both as a preventative barrier and a functional tool for incident response. We also cover the rising industry interest in AI kill switches, looking at how security teams can plan to stop erratic AI applications or AI-augmented malware before they cause widespread operational damage. The Fine Art of Frustrating the Adversary: https://blog.talosintelligence.com/the-fine-art-of-frustrating-the-adversary/

• Transcript

Honey, I Trapped the Adversary

It’s time to start having fun and messing with your attackers. For Cybersecurity Awareness Month, Martin Lee joins Amy to discuss the fine art of making life on your network a complete nightmare for adversaries. Simple, low-maintenance decoys — like fake credentials, empty honeypots, and ghost systems — can turn your infrastructure into a minefield that keeps attackers guessing and wastes their resources. Join us to learn how to turn the tables, gain threat intel on who is trying to get into your network, and have a bit of a laugh at their expense. (And trust us, you don't want to miss Martin's Winston Churchill impression.)

• Transcript

ClickFix, EtherHiding, and the rise of malicious code in the blockchain

In this episode of Talos Takes, Amy sits down with researcher Vanja Svajcer to break down a sophisticated, multi-stage infection chain that leverages a combination of ClickFix social engineering, WebDAV, and decentralized infrastructure. Vanja walks us through how threat actors are repurposing legitimate user behaviors — like solving CAPTCHAs — to gain unauthorized access, and how they utilize blockchain smart contracts as bulletproof storage for malicious code. We also explore the divergence in final payloads, ranging from remote access tools to crypto-stealing malware. Tune in for actionable behavioral patterns that your security teams can monitor to detect these incidents before they progress. Vanja's blog: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/

• Transcript

Browser betrayal: When your tabs turn against you

Ah, the crisp fall air, brand-new books and backpacks, and the quiet irony of cybercriminals turning on each other to steal a few extra bucks. Security Engineer Sean Gallagher joins Amy to break down a scam where threat actors are weaponizing greed to turn amateur cybercriminals against themselves. This browser-based attack tricks targets into injecting malicious code into their own sessions under the guise of exploiting a fictional vulnerability to earn crypto-profits. While this current operation mostly targets the amateur dark-web circuit, the underlying use of the Google Visualization API as a command-and-control channel is a red flag for the future of web security. Tune in to hear why it’s only a matter of time before these techniques turn from petty crypto-scams toward our enterprise supply chains, and how to protect your organization. Blog: https://blog.talosintelligence.com/clickfix-moves-into-the-browser/

• Transcript

Back-to-school cybersecurity: Protecting education networks from ransomware and threats

As the new academic year begins, school districts face a surge in cybersecurity threats, from phishing attacks and ransomware to student experimentation with network devices. In this episode, Amy sits down with Cisco Talos expert Pierre Cadieux to discuss practical strategies for IT practitioners. How do you strengthen your defenses while managing the delicate balance between security and classroom usability? Here are the most high-priority steps to keep your district safe this semester. Prioritizing patches episode: https://www.buzzsprout.com/2018149/episodes/19360999

• Transcript

Don't scan that! QR code phishing and cloud-native threats

What happens when a QR code leads to a major security incident? In this episode, Amy sits down with Senior Incident Response Consultant Terryn Valikodath to break down a recent, high-stakes breach at an Australian medical center. Attackers are ditching traditional malware for "cloud-native" tactics — using personalized QR code phishing to bypass corporate defenses and operate entirely within the cloud. Beyond the technical details, Amy and Terryn chat about the pressure of defending environments where patient care is on the line and why a blameless culture is a great defense. Take a listen for some practical, down-to-earth advice on how to audit your own logs and keep your team prepared for when things go sideways. Talos IR Trends Q2 2026: https://blog.talosintelligence.com/ir-trends-q2-2026/

• Transcript

Q2 Talos IR Trends: Phishing and authentication abuse spike

In this episode, Amy and analyst Lexi DiScola unpack the trends Talos IR saw on the frontlines in Q2 2026. From creative phishing lures that slip past email gateways to the weaponization of legitimate remote management tools, we explore why traditional defenses are falling short and the practical things you can do to reclaim the advantage. What configuration changes and visibility gaps could be the difference between a minor incident and a full-scale breach? How can you harden your environment with limited resources? Tune into this episode to stay one step ahead of an evolving threat landscape. Talos IR Quarterly Trends Report: https://blog.talosintelligence.com/ir-trends-q2-2026 Find Talos at Black Hat: https://blog.talosintelligence.com/preview-cisco-talos-at-black-hat-usa-2026/

• Transcript

ARToken: How attackers are bypassing MFA and maintaining access

MFA and password resets aren't always enough. That’s terrifying for security teams today. In this episode of Talos Takes, we dive deep into ARToken, a sophisticated phishing/BEC-as-a-service platform that steals credentials, bypasses MFA entirely, and leverages primary refresh tokens (PRTs) to maintain persistence in your environment long after a password reset. This turns a simple phishing click into a long-term breach. It’s time to rethink your defenses. Join us as Cisco Talos Threat Researcher Michael Kelley breaks down how this new breed of automated attack works and, more importantly, how you can spot it. From hunting for suspicious device authorization grants to securing your cloud infrastructure, don't miss this critical look at the new frontier of business email compromise. Blog: https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/

• Transcript

From evasion to detection: A guide to analyzing COM-based threats

While the Component Object Model (COM) is a fundamental Windows technology that allows software to communicate and function, it's also a powerful tool for threat actors looking to move laterally, maintain persistence, and evade traditional security measures. Joining us is Vanya Svajcer, who shares his expertise on how to cut through the noise and identify malicious signals within COM-based binaries. Whether you are a seasoned researcher or just starting your journey into reverse engineering and malware analysis, here's some practical advice on how to start hunting for COM-based threats and making your next investigation a little more effective. Vanja's blog: https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-threats

• Transcript

Patching in the dark: Managing unknown threats in complex environments

If you're tired of being told to "just patch," we understand. The threat landscape is evolving at breakneck speed, with AI-driven tools enabling adversaries to uncover and exploit vulnerabilities before defenders even know they exist. In this episode of Talos Takes, Amy sits down with Threat Intelligence Lead Pierre Cadieux to discuss how to defend against these unknown threats. We move past the simplified advice of "just patch everything" to explore the logistical, technical, and business realities that make patching a complex, high-stakes operation rather than a simple button click. From the necessity of testing your patches to the importance of building strong partnerships between security teams and business leadership, this episode breaks down the things defenders often miss that build true resilience in organizations.

• Transcript

When synthetic logs don’t lie: Generating coherent attack stories for better detection

Are your detection rules failing because your test data lacks the nuance of a real-world network? In this episode of Talos Takes, Amy sits down with David Bianco to discuss why traditional synthetic data often falls short and how his new open-source project, EvidenceForge, is changing the game. Synthetic datasets often look like telemetry but lack the critical causal links and realistic background noise that define actual adversary activity. EvidenceForge solves this by creating data that tells a coherent, causal story. From simulating complex attack chains to modeling realistic, "bursty" human behavior, this tool helps threat hunters and detection engineers to sharpen their skills with reproducible, high-quality telemetry. EvidenceForge blog: https://blog.talosintelligence.com/introducing-evidenceforge-synthetic-security-logs-that-dont-look-as-fake/ PEAK Threat Hunting Assistant episode: https://www.buzzsprout.com/2018149/episodes/18825324

• Transcript

The trust paradox: How attackers weaponize legitimate SaaS platforms

In this episode of Talos Takes, Amy Ciminnisi sits down with researcher Diana Brown to discuss the rise of "platform-as-a-proxy" (PAP) attacks. We explore how threat actors are weaponizing legitimate SaaS platforms like GitHub and Jira to deliver phishing campaigns that bypass traditional security filters. By leveraging the platforms' own infrastructure to send authenticated emails, attackers are exploiting the inherent trust employees place in these essential business tools. We break down the mechanics of these campaigns and provide actionable strategies for security teams to move beyond binary trust and implement contextual awareness to better protect their organizations. Blog: https://blog.talosintelligence.com/weaponizing-saas-notification-pipelines/

• Transcript

It's not you, it's your printer: State-sponsored and phishing threats in 2025

In this episode, we unpack state-sponsored and phishing trends from the 2025 Talos Year in Review. Amy and Martin Lee explore the alarming rise of internal phishing campaigns that bypass traditional perimeter defenses, including the widespread weaponization of Microsoft 365's Direct Send feature. Beyond simple phishing, we analyze the aggressive, blended operations of state-sponsored actors from China and North Korea who are combining high-level zero-day exploits with sophisticated social engineering. From the "Dear Leader" interview test to the reality of fake developer personas, we break down exactly how these adversaries are infiltrating modern organizations. 2025 Year in Review report: https://blog.talosintelligence.com/2025yearinreview/

• Transcript

2025's ransomware trends and zombie vulnerabilities

In this episode, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025. From the persistent ransomware threats targeting the manufacturing sector to the rise of stealthy "living off the land" tactics, we break down what these shifts mean for your defense strategy. Why are attackers are increasingly targeting your management infrastructure? How do you spot the difference between a system admin and a threat actor? Tune in to hear Talos' insights on how to move beyond reacting to threats and start building a more resilient, proactive security posture for the year ahead. View the 2025 Year in Review here: https://blog.talosintelligence.com/2025yearinreview/

• Transcript

Cybersecurity’s double-header: 2025 insights from Talos and Splunk

In this episode of Talos Takes, Amy is joined by William Largent (Cisco Talos) and Lou Stella (Splunk) for a "double-header" discussion. With the recent release of the Cisco Talos 2025 Year in Review and the Splunk Top 50 Cybersecurity Threats report, we’re breaking down the most critical trends that shaped the security landscape last year — all based on Cisco telemetry, Talos' original research, and Talos Incident Response engagements. From the professionalization of ransomware-as-a-service to the persistent challenge of decade-old vulnerabilities, this episode moves beyond the headlines to provide a practical roadmap for defenders. You’ll get tips on how to prioritize your defenses and reduce your attack surface for the year ahead. Talos 2025 Year in Review: https://blog.talosintelligence.com/2025yearinreview/ Splunk Top 50 Cybersecurity Threats: https://www.splunk.com/en_us/campaigns/top-50-security-threats.html

• Transcript

Modernizing your threat hunt

In this episode of Talos Takes, David Bianco from Cisco Foundation AI joins Amy to demystify the world of proactive cyber defense. We explore the evolution of the PEAK Threat Hunting framework and talk through how security teams can modernize their approach to identifying risks before they escalate. David also provides an exclusive look at a new open-source tool designed to help hunters navigate the "prepare" phase of PEAK with ease. Whether you are building a new program from scratch or looking to refine your existing strategy, take a listen for actionable advice to help you take that next step in your security journey. PEAK Threat Hunting Assistant: https://blogs.cisco.com/security/introducing-peak-threat-hunting-assistant GitHub: https://github.com/cisco-foundation-ai/PEAK-Assistant

• Transcript

Holding the line: Service provider security

Service providers are the backbone of modern connectivity — but why are they such attractive targets for cyber actors, and what happens when critical networks go down? In this episode, Martin Lee joins Amy to explore the shifting threat landscape for service providers, asking how defenders can spot silent intrusions, what trade-offs must be considered when patching, and how industry collaboration helps prevent widespread disruptions. Join us as we unpack real-world examples and offer practical insights into protecting the infrastructure that keeps our world connected. Video: Footholds in Infrastructure: Protecting Service Providers

• Transcript

IR Trends Q4 2025: Ransomware chills and phishing heats up

What separates organizations that successfully fend off ransomware from those that don’t? What were the top threats facing organizations? Can we (pretty please) get a sneak peek into the 2025 Year in Review? Amy is joined by Dave Liebenberg, Strategic Analysis Team Lead, to break down key findings from Q4 2025's Cisco Talos Incident Response Quarterly Trends Report. From the top threats facing organizations — like the persistent exploitation of public-facing applications and the rise of new vulnerabilities such as Oracle EBS and React2Shell — to the unexpected drop in ransomware cases, this episode is packed with useful info. Episode resources: Q4 2025 Quarterly Trends Report: https://blog.talosintelligence.com/ir-trends-q4-2025/ Qilin blog: https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/ Cybersecurity on a Budget blog: https://blog.talosintelligence.com/cybersecurity-on-a-budget-strategies-for-an-economic-downturn/

Cracking the code: What encryption can (and can’t) do for you

Step into the fascinating world of cryptography. Host Amy Ciminnisi sits down with Yuri Kramarz from Cisco Talos Incident Response and Tim Wadhwa-Brown from Cisco Customer Experience to learn what encryption really accomplishes, where it leaves gaps, and when defenders need to take proactive measures. Whether you’re picturing classic codebreakers or the latest quantum-proof ciphers, this episode unpacks the essentials: what encryption and hashing actually mean, why key management is a make-or-break factor, and how even the best algorithms can fall short if the basics aren’t handled right. G7's "Coordinating the Transition to Post-Quantum Cryptography in the Financial Sector" roadmap: https://home.treasury.gov/news/press-releases/sb0355