OnlyFans Models Are Accidental Blue Team Defenders - 2026-07-13

This week, the team unpacks a wide range of cybersecurity news, including a fraudulent offensive security startup tied to cybercriminals, how leaked OnlyFans content is inadvertently helping defenders identify compromised government websites, and new vishing attacks targeting Microsoft Entra passkey enrollment. They also examine AI prompt injection risks in GitHub workflows, malware campaigns abusing hundreds of GitHub repositories and Go packages, Microsoft's latest identity security developments, and the growing push for online age verification through government-issued IDs and selfies.

Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! - https://discord.gg/bhis🔴live-event-chat

Chapters

• (00:00) - PreShow Banter™ — The New Mainframes
• (05:24) - OnlyFans Models are Accidental Blue Team Defenders - 2026-07-13
• (06:23) - Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup
• (15:37) - Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
• (20:37) - Story #3 - Vishing actors target Entra passkey enrollment
• (32:44) - Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
• (46:32) - Story #5 - Network of 200 GitHub Repositories Used for Malware Infection
• (48:13) - Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
• (53:53) - Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie
• (59:39) - Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver's face

LinksStory #1 - Felons, Fraudsters Flog Offensive Cybersecurity StartupStory #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites DisappearStory #3 - Vishing actors target Entra passkey enrollmentStory #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private ReposStory #5 - Network of 200 GitHub Repositories Used for Malware InfectionStory #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaintStory #7 - EU Reddit Users Must Verify Age With Government ID or SelfieStory #8 - Risky Bulletin: All new cars to include a camera aimed at the driver’s face

Creators & Guests

• John Strand - Host
• Mishaal Khan - Guest
• Ralph May - Host