Claude Chat Invites and a Backdoored Coding Extension

In this episode of ShadowTalk, Brandon Tirado and John Dilgen look at two recent initial access campaigns that used Anthropic's Claude to gain trust. In the first, attackers turned Claude's real chat-sharing notifications into callback phishing lures. In the second, a tampered Claude Code extension in Cursor's marketplace planted a persistent SSH backdoor on developer machines.Learn what defenders can do now, from hunting for both attacks and reimaging affected hosts to governing developer extensions and training employees.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Brandon Tirado: Director of GreyMatter Operations for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

In this episode of ShadowTalk, John Dilgen and Dylan Deane examine ARTEX, an AI-powered penetration-testing framework that was openly available on GitHub and is now appearing in real-world intrusions.Learn what defenders can do now—from rotating exposed credentials and treating application records as security telemetry to using AI-enabled red-team tools and exposure management to find viable attack paths before adversaries do.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Dylan Deane: Technical Product Marketing Manager at ReliaQuest who prior to joining the product marketing team, spent four years in our threat research department as a Threat Hunter where his primary focus was intrusion response and hunting for advanced TTPs.  

In this episode of ShadowTalk, John Dilgen and Alexandra Moore break down PHP2Shell, two critical vulnerabilities in PHP that sent the security community scrambling. With PHP powering roughly 70% of the web, the blast radius is unlike most vulnerability disclosures.The discussion pulls directly from ReliaQuest's own lab research:How AI tools compressed exploit development to under an hourWhy the initial attack sequence looks more like an application crash than a compromiseWhy a single PHP error message could be a defender's most important clueLearn what organizations need to do now, from closing dangerous logging gaps to hunting retroactively for signs of compromise that may have already happened.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.

In this episode of ShadowTalk, John Dilgen and Tehman Tariq examine QuartzLine, a malware campaign disguised as a legitimate, signed Windows PDF viewer. The application works as advertised while quietly maintaining persistence, stealing browser data, and waiting for instructions to deploy backdoors at scale. The discussion covers the campaign’s malvertising delivery chain, its evasion techniques, and why blocked C2 traffic should be treated as a confirmed compromise. Learn what defenders can do now to hunt for persistence, close software-access gaps, and automate containment before the campaign escalates.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

In this episode of ShadowTalk, John Dilgen and Alexandra Moore break down a campaign where AI carried out major parts of an intrusion. The conversation covers the attack flow, the feedback loop, and what defenders should change now. Attackers have gone agentic, gaining speed, scale, and lower skill barriers.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.

Security leaders should be asking a hard question: if a remote hire looks legitimate at every checkpoint, what would expose the operation? Security operations is the defense layer of the business, and the teams defending it need AI to move faster across the full environment.In this episode of ShadowTalk, Daxton Wirth and John Dilgen share practical guidance on what to verify, where teams miss inconsistencies, and how HR, onboarding, identity, and security can investigate together before access turns into exposure.Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Daxton Wirth: Threat Hunter at ReliaQuest specialized in DPRK research and identification for the last two years. Daxton also specializes in breach response including investigating and remediating complex intrusions. 

Security teams are contending with more tools, alerts, and vulnerabilities than ever—but volume does not necessarily equal security. Jigar Shah joins us to discuss how organizations can automate repetitive work, prioritize vulnerabilities based on business risk, build identity-driven security strategies, and connect cybersecurity investments to measurable outcomes. With two decades of leadership experience across healthcare, financial services, retail, and consulting, Jigar brings a business-focused perspective on helping security leaders communicate risk and resilience to the board and C-suite. A Question Your Organization Should Be Asking Right Now:How quickly can your organization make risk-based decisions?Resources: https://linktr.ee/ReliaQuestShadowTalkJigar Shah: Transformational IT, data, and cybersecurity executive with two decades of leadership experience across healthcare, financial services, retail, and consulting. He brings a distinctive blend of technology, business, and legal expertise to overseeing complex enterprise initiatives, including cybersecurity programs, cloud migrations, M&A integrations, and risk management for large regulated organizations. A passionate advocate for automation, identity-driven security, and business-aligned cyber strategy, Jigar excels at translating technical priorities into measurable outcomes for boards and C-suite leaders.John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

In this episode, we examine the Phantom Deal campaign, in which threat actors used publicly available details about companies’ acquisition histories, subsidiaries, executives, and employees to create convincing fake M&A scenarios. The goal: persuade employees to initiate large financial transfers while keeping conversations off corporate communication channels.We also cover a recent series of zero-day disclosures affecting major endpoint-security and Windows products. These vulnerabilities reinforce a critical operational reality: organizations must be prepared to detect and respond even when endpoint-security visibility is weakened or unavailable.Two questions your organization should be asking right now:If an employee received an urgent, confidential payment request from an apparent executive, could they independently verify the request without using the communication channel chosen by the attacker?If an endpoint-security tool went blind during an attack, what identity, network, cloud, and Windows telemetry could your team use to detect and contain the activity?Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Brandon Tirado: Director of GreyMatter Operations for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

AI is changing the economics of cyberattacks. In this episode, we examine how a suspected threat actor used AI agents to accelerate PaperCut vulnerability research, exploit development, target identification, and post-compromise activity—moving from initial access to domain administrator access in as little as seven minutes.We also explore recent reporting on large-scale AI-model distillation campaigns by China-based companies and what the increasing availability of frontier-level AI capabilities could mean for future nation-state and criminal threat operations.Two questions your organization should be asking right now:If an attacker gained initial access through an internet-facing system tomorrow, could your team detect and contain the activity in less than seven minutes?Are you evaluating vulnerabilities, exposed services, and identity privileges as connected attack paths—or as separate security issues?Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.

Organizations rely on Microsoft 365's RejectDirectSend control to block internal email spoofing—but a structural gap lets attackers walk right past it. With nothing more than a basic Python script and an empty envelope sender, threat actors are impersonating executives, IT support, and finance teams to launch Business Email Compromise, payment fraud, and follow-on account takeover.Join hosts Alexandra Moore and John Dilgen as they discuss:How an empty email header field bypasses RejectDirectSend and lands phishing in executive inboxesHow help desk impersonation combined with spoofed internal email creates a dangerous new pretextWhich controls—IP-restricted connectors, automated containment, and out-of-band verification—actually close the gap Two questions your organization should be asking right now:If someone attempted a Direct Send from an unauthorized IP into your tenant tomorrow, would it be rejected?When was the last time you tested whether your employees follow out-of-band verification procedures under pressure?Resources: https://linktr.ee/ReliaQuestShadowTalkJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.