OnlyFans Models Are Accidental Blue Team Defenders - 2026-07-13 - Video

This week, the team unpacks a wide range of cybersecurity news, including a fraudulent offensive security startup tied to cybercriminals, how leaked OnlyFans content is inadvertently helping defenders identify compromised government websites, and new vishing attacks targeting Microsoft Entra passkey enrollment. They also examine AI prompt injection risks in GitHub workflows, malware campaigns abusing hundreds of GitHub repositories and Go packages, Microsoft's latest identity security developments, and the growing push for online age verification through government-issued IDs and selfies.


Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity


Chat with us on Discord! -
https://discord.gg/bhis
????live-event-chat



Chapters


• (00:00) - PreShow Banter™ — The New Mainframes


• (05:24) - OnlyFans Models are Accidental Blue Team Defenders - 2026-07-13


• (06:23) - Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup


• (15:37) - Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear


• (20:37) - Story #3 - Vishing actors target Entra passkey enrollment


• (32:44) - Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos


• (46:32) - Story #5 - Network of 200 GitHub Repositories Used for Malware Infection


• (48:13) - Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint


• (53:53) - Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie


• (59:39) - Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver's face


Links
Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup (https://blog.otterpwn.com/projects/heavenerhttps://krebsonsecurity.com/2026/07/felons-fraudsters-flog-offensive-cybersecurity-startup/)
Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear (https://www.wired.com/story/onlyfans-creators-dmca-hacked-government-websites/)
Story #3 - Vishing actors target Entra passkey enrollment (https://www.okta.com/en-au/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/)
Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/)
Story #5 - Network of 200 GitHub Repositories Used for Malware Infection (https://www.securityweek.com/network-of-200-github-repositories-used-for-malware-infection/)
Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint (https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/)
Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie (https://reclaimthenet.org/eu-reddit-users-must-verify-age-with-government-id-or-selfie)
Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver’s face
(https://news.risky.biz/risky-bulletin-all-new-cars-to-include-a-camera-aimed-at-the-drivers-face/)

Creators & Guests




• John Strand (https://bhisnews.transistor.fm/people/john-strand-8c127856-b150-4e33-af6d-5b9f7f041a37) - Host


• Mishaal Khan (https://bhisnews.transistor.fm/people/mishaal-khan) - Guest


• Ralph May (https://bhisnews.transistor.fm/people/ralph-may) - Host


• Meagan Bentley (https://bhisnews.transistor.fm/people/meagan-bentley) - Producer


• Bronwen Aker (https://bhisnews.transistor.fm/people/bronwen-aker) - Host


• Wade Wells (https://bhisnews.transistor.fm/people/wade-wells) - Host


• Doc Blackburn (https://bhisnews.transistor.fm/people/doc-blackburn) - Guest


• Jake Hildreth (https://bhisnews.transistor.fm/people/jake-hildreth) - Guest


Click here to watch this episode on YouTube. (https://www.youtube.com/watch?v=nd_rXeyzm8g)






Click here to view the episode transcript. (https://share.transistor.fm/s/08b8b47f/transcript)




???? Register for FREE Infosec Webcasts, Anti-casts & Summits 


https://poweredbybhis.com (https://poweredbybhis.com/)



Brought to you by:


Black Hills Information Security 


https://www.blackhillsinfosec.com (https://www.blackhillsinfosec.com/)



☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/


Antisyphon Training


https://www.antisyphontraining.com/






Active Countermeasures


https://www.activecountermeasures.com (https://www.activecoun...