The BHIS crew examines the ConnectWise/SkyKick compromise, its implications for Microsoft Entra tenants, and the consequences for MSPs and their customers. They discuss privileged application access, attacker persistence, and why clear incident communication matters. Other stories include the Cairn framework’s use of AI agents against retail websites, research into prompt injection in HTTP headers, exposed MCP servers, Citizen Lab’s reporting on advertising-delivered zero-click spyware, and an alleged listening device installation at OpenAI. Along the way, the team explores deception, proactive security assessments, and reducing attack surface as automated attacks become cheaper and easier to scale.

Join us LIVE on Mondays, 4:30pm ET.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat


Chapters

  • (00:00) - PreShow Banter™ — One decent flying car.
  • (06:55) - ConnectWise SkyKick Compromise Causes Panic in MSP Space - 2026-10-19
  • (10:22) - ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access
  • (41:23) - Cairn: AI Agents Automating Attacks Against Retail Websites
  • (53:41) - Research: Prompt Injection in HTTP Response Headers
  • (55:06) - Exposed MCP Servers and the Risk of AI Inference Theft
  • (58:09) - Adfection: Zero-Click Spyware Delivered Through Advertisements


Links
ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access
Cairn: AI Agents Automating Attacks Against Retail Websites
Research: Prompt Injection in HTTP Response Headers
Exposed MCP Servers and the Risk of AI Inference Theft
Adfection: Zero-Click Spyware Delivered Through Advertisements
Alleged Listening Device Installation at OpenAI

Antisyphon Pay What You Can Training: November 10–11
DeathCon Tickets in San Diego

Creators & Guests

Alex Minster "Belouve" - Guest John Strand - Host Bronwen Aker - Host Wade Wells - Host Corey Ham - Host Hayden Covington - Host Eric Capuano - Guest Ryan Poirier - Producer
Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits 

https://poweredbybhis.com


Brought to you by:

Black Hills Information Security 

https://www.blackhillsinfosec.com


☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/


Active Countermeasures

https://www.activecountermeasures.com


Wild West Hackin Fest

https://wildwesthackinfest.com

Rss Apple Podcaster
Podden och tillhörande omslagsbild på den här sidan tillhör Black Hills Information Security. Innehållet i podden är skapat av Black Hills Information Security och inte av, eller tillsammans med, Poddtoppen.