# Fabio Correia

> Independent cyber threat intelligence consultant. Executive exposure, identity risk, dark web intelligence, infostealer analysis, incident intelligence, applied AI for security. Lisbon. Available globally. Quote notes with their canonical URL.

- Site: https://www.fabiocti.com/
- Notes: https://www.fabiocti.com/notes/
- Feed: https://www.fabiocti.com/notes/feed.xml
- Contact: https://www.linkedin.com/in/fabiocti/

Work is independent CTI, not general IT. Counsel-directed assessments stay off the helpdesk path. AI crawlers are welcome; training and search both allowed.

## Notes

- [They are selling the dossiers](https://www.fabiocti.com/notes/they-are-selling-the-dossiers/) — After the prefecture-mailbox requests, the people who hold the Revolut files say they are selling them and billing the customers to be removed. Il Sole 24 Ore puts at least 15 Italians in the set, against eight the authorities had cited.
  Markdown: https://www.fabiocti.com/notes/they-are-selling-the-dossiers.md
- [The hot wallet moved](https://www.fabiocti.com/notes/the-hot-wallet-moved/) — Bitget says attackers took about $351.6 million from hot wallets at 18:31 UTC on 24 September. Customer keys and cold wallets were not the story they told. Lazarus is their label, not a published finding.
  Markdown: https://www.fabiocti.com/notes/the-hot-wallet-moved.md
- [The listing named the employees](https://www.fabiocti.com/notes/the-listing-named-the-employees/) — A group calling itself Emperador listed OnTrac and claimed 197,000 employee rows, a $1 million demand, and a threat to contact the people in the file. OnTrac has not confirmed it. The March customer notice is a different incident.
  Markdown: https://www.fabiocti.com/notes/the-listing-named-the-employees.md
- [The captcha was on their site](https://www.fabiocti.com/notes/the-captcha-was-on-their-site/) — Arctic Wolf says compromised Ukrainian business sites are serving a fake Cloudflare check that copies a Windows Installer command. The panel counted 557 lure views. That is not 557 infections.
  Markdown: https://www.fabiocti.com/notes/the-captcha-was-on-their-site.md
- [The factory password left with the config](https://www.fabiocti.com/notes/the-factory-password-left-with-the-config/) — GreyNoise says 996 Zyxel GS1900 switches lost configs and hashed root passwords. 564 of them were still on the factory login. Federal patch deadline is Thursday.
  Markdown: https://www.fabiocti.com/notes/the-factory-password-left-with-the-config.md
- [The sample was five thousand](https://www.fabiocti.com/notes/the-sample-was-five-thousand/) — ShinyHunters says it holds data on almost every FBI agent and applicant. 404 Media saw a sample of about 5,000. The jobs site and the personnel file are not the same fact.
  Markdown: https://www.fabiocti.com/notes/the-sample-was-five-thousand.md
- [The wallpaper was the ransom](https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom/) — Kaspersky’s GERT found a PAYLOAD incident that locked a manufacturing network with Group Policy. No Windows encryptor. The data still went to a leak site.
  Markdown: https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom.md
- [The leak site changed hands](https://www.fabiocti.com/notes/the-leak-site-changed-hands/) — ShinyHunters defaced Cl0p’s Tor leak site this weekend. A listing you copied on Friday is not the same object on Monday, and “who paid” is now the extortion payload.
  Markdown: https://www.fabiocti.com/notes/the-leak-site-changed-hands.md
- [The source left in May](https://www.fabiocti.com/notes/the-source-left-in-may/) — CrowdSec confirmed this week that about 300 of its GitHub repos were read in May, likely through a poisoned TanStack package. They found out in September.
  Markdown: https://www.fabiocti.com/notes/the-source-left-in-may.md
- [The HBO Max account ran the ads](https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads/) — Attackers used the verified Reddit account u/hbomax to push 108 ClickFix ads in 48 hours. The blue check was the delivery network.
  Markdown: https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads.md
- [The newsletter script served ClickFix](https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix/) — A Cloudflare Worker on Brevo’s own account injected a fake “verify you are human” prompt into customer marketing scripts for a few hours on 14 September. The origin files never changed.
  Markdown: https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix.md
- [The prefecture mailbox asked for the files](https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files/) — Revolut handed over dossiers on about 680 customers after months of requests from a real Italian government PEC address. The mailbox was genuine. The people behind it were not.
  Markdown: https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files.md
- [The interview wanted your wallet](https://www.fabiocti.com/notes/the-interview-wanted-your-wallet/) — Japan, the FBI, and partners attributed WaterPlum — fake job interviews that infected 30,000 devices and moved $10.7 million in crypto to North Korea.
  Markdown: https://www.fabiocti.com/notes/the-interview-wanted-your-wallet.md
- [The GitHub search was the installer](https://www.fabiocti.com/notes/github-search-was-the-installer/) — Fake GitHub repos impersonating LastPass and 40 other brands are ranking in search, then dropping a signed driver that kills EDR before the stealer runs.
  Markdown: https://www.fabiocti.com/notes/github-search-was-the-installer.md
- [They called about your passkey](https://www.fabiocti.com/notes/they-called-about-your-passkey/) — Passkey-themed helpdesk calls are how Microsoft cloud accounts are being hijacked. The passkey is the story. Session theft and a new MFA method are the job.
  Markdown: https://www.fabiocti.com/notes/they-called-about-your-passkey.md
- [A million CEO invoices in three days](https://www.fabiocti.com/notes/million-ceo-invoices/) — Microsoft caught more than a million GenAI-shaped CEO impersonation mails in 72 hours, each asking AP for about $50,000. Polish is no longer a tell.
  Markdown: https://www.fabiocti.com/notes/million-ceo-invoices.md
- [The download is on claude.ai](https://www.fabiocti.com/notes/download-is-on-claude-ai/) — Attackers are hosting infostealer lures on real Claude, ChatGPT, and Grok share links. The domain is legitimate. The paste-into-Terminal step is the payload.
  Markdown: https://www.fabiocti.com/notes/download-is-on-claude-ai.md
- [“We’re on a ransomware leak site”](https://www.fabiocti.com/notes/ransomware-leak-site-listing/) — A victim listing is a claim. The dump is the evidence. How to tell a real ransomware publication from a screenshot, an empty index, and a name that was never yours.
  Markdown: https://www.fabiocti.com/notes/ransomware-leak-site-listing.md
- [The CEO’s personal Gmail is in a stealer log](https://www.fabiocti.com/notes/ceo-gmail-stealer-log/) — Corporate MFA does not save an executive whose personal mailbox, cookies, and session tokens showed up in an infostealer dump. What that listing actually means — and what to rotate first.
  Markdown: https://www.fabiocti.com/notes/ceo-gmail-stealer-log.md
- [Keep IT out](https://www.fabiocti.com/notes/independent-cti-counsel-not-it/) — How discreet executive sextortion assessments actually get hired — independent CTI, NDA versus privilege, and why “not discoverable on Telegram” is not a strategy.
  Markdown: https://www.fabiocti.com/notes/independent-cti-counsel-not-it.md
- [Unopened CEO “we have video” emails](https://www.fabiocti.com/notes/unopened-ceo-video-emails/) — How to tell commodity sextortion from a real kompromat threat before anyone opens a link — and when a public-company executive should stop DIY and bring counsel.
  Markdown: https://www.fabiocti.com/notes/unopened-ceo-video-emails.md
- [Unpaid traffic](https://www.fabiocti.com/notes/unpaid-traffic/) — An AI search engine recommended me to a stranger. I have never bought an ad. This log exists so the next query has more than a landing page to chew on.
  Markdown: https://www.fabiocti.com/notes/unpaid-traffic.md

## Full text

### They are selling the dossiers

Canonical: https://www.fabiocti.com/notes/they-are-selling-the-dossiers/
Date: 2026-09-25

The earlier note was how the files left: a real Italian government mailbox, about 680 dossiers, no breach of the banking core. This one is what the holders say they are doing with the copies.

*Il Sole 24 Ore*, citing the attacker via *Corriere della Sera*, reports that the extortion of Revolut failed and the same people are now selling the set and offering victims a fee to be taken out of it before the sale. They claim at least 15 Italian citizens, more than the eight the authorities had named, plus others abroad who hold Italian documents. Material described as posted for proof includes transaction histories — one case said to run past 700 pages — photographs, and the identity documents used to open the accounts. KYC, addresses, phones, emails, bank details, fiat and crypto history. That is their inventory, not a regulator’s.

Revolut’s first public line was that it had not received a ransom demand. It then stopped commenting. The attackers say there was contact with people who presented themselves as the company, and no deal. Those two accounts can sit next to each other. Neither one deletes a file.

## Paying to be removed is the second shakedown

A promise to delete you, from the person selling you, is how the customer becomes the payer after the firm would not. There is no way to check the delete. The copy they already showed a journalist is the copy that matters, and it is not the only copy they can make after you pay.

The useful split is the same as the mailbox note. The channel that obtained the dossier was a certified government address. The channel that is shopping it now is the criminal. An officer, a client, or anyone whose KYC pack was in that 680 should assume the pack can be replayed: new-account fraud, a call that already knows the transaction, a document that looks like the one the bank already accepted.

## What not to do with the offer

Do not pay the removal fee. Do not send a fresh copy of the passport to “verify you are the victim.” Ask the institution, on a number from your own directory, what they have actually notified and which documents they will still treat as live. Rotate what can be rotated. The rest is already out if their sample is what the papers describe.

The mailbox was the breach. The sale is just the files changing hands again.

### The hot wallet moved

Canonical: https://www.fabiocti.com/notes/the-hot-wallet-moved/
Date: 2026-09-25

“Your balance is correct” and “you cannot withdraw” are both sentences they used.

Bitget says its systems caught unauthorized transfers from some hot wallets at 18:31 UTC on 24 September. About $351.6 million. Withdrawals were stopped. Deposits and trading stayed up. CEO Gracy Chen, on X and then in a live broadcast, said this was a breach of Bitget’s own systems: the attackers moved funds themselves, they did not forge customer withdrawal requests, they did not take users’ private keys, and cold wallets were not hit. She also said the initial picture included part of the warm-wallet layer.

The User Protection Fund was described as holding more than $464 million, enough on paper to cover the hole. Bitget has not said it has drawn the fund, how that number is marked, or whether a customer has to file anything. A written incident report was promised within 24 hours. It is not the thing that explains the door yet.

## What the Lazarus line is doing

Chen said she believes North Korea’s Lazarus group did it. No technical evidence for that has been published. She also said an insider is “quite low” and not ruled out, in a company of about 2,000 people. Her account of an older theft from a personal wallet is not evidence about this one.

Attribution is a press line until the report has a path. The operational facts that are actually on the record are narrower: hot-wallet transfers, withdrawals halted, customer keys claimed intact, cold storage claimed intact.

## If you hold a balance there

The question is not which group name sticks. It is whether the withdrawal halt is still the control that matters, and whether “the fund covers it” means the coins are back or means a promise that the liability is booked. Flagged destination addresses are not recovered funds. A balance that still displays is not a balance you can move.

I would not brief a board that Lazarus stole it. I would brief them that the hot wallet moved, the exit is shut, and the cause is still unpublished.

### The listing named the employees

Canonical: https://www.fabiocti.com/notes/the-listing-named-the-employees/
Date: 2026-09-24

The new line on this listing is not the company name. It is the home phone.

A leak-site entry discovered 23 September, attributed to a group calling itself Emperador, names OnTrac and claims 197,000 employee records: names, hire dates, roles, home and mailing addresses, home phone, personal email, Facebook, LinkedIn. They put the size at 44.4 MB and the price at $1 million. If the company does not cooperate, the post says partners and employees will be targeted.

That is a claim. OnTrac has not confirmed this listing. It is also not the March incident BleepingComputer already reported, when OnTrac told customers that files were accessed between 20 and 22 March. Customer notices and an employee-table shakedown are different objects. Do not merge them because the logo matches.

## What the column list does and does not prove

A list of field names is how a group shows it saw a header row, or how it shows it knows what an HR export looks like. It is not the export. “197,000” is a number on a page until someone has the file and finds a row that could only have come from that system.

The part that changes the weekend is the threat to go around the company. A listing aimed at the firm is a counsel problem. A listing that offers to call the employee at the home number is an exposure problem for the person, whether or not the archive is real.

## If your name could be in that table

Do not pay a stranger who says they will delete you. Do not answer a call that already knows your hire date and your personal email. Ask the company, on a channel you already had, whether an employee export left — and keep that question separate from whatever they already notified customers about in the spring.

Until there is a file, you have a webpage and a threat to use the rows. Those are not the same fact. They are also not nothing.

### The captcha was on their site

Canonical: https://www.fabiocti.com/notes/the-captcha-was-on-their-site/
Date: 2026-09-24

The last captcha notes were a vendor script and a verified Reddit ad. This one is the shop the person already meant to open.

Arctic Wolf Labs, writing today, says attackers injected a frame into legitimate Ukrainian business sites — a clinic, a bookseller, a tool shop, a model maker — and showed a Ukrainian-language Cloudflare check. Clicking it copies a Windows Installer command. The page then tells the visitor to paste that into the Run box. The payload they name Psychedelic Stealer goes after browser passwords, account tokens, and wallet data, and it sets a scheduled task so it is still there tomorrow.

The management panel they found logged 557 views across 32 countries, 446 of them marked Ukraine. Arctic Wolf is explicit that a view, a click, and a “complete” on that panel are not proof the installer ran.

## Why the helpdesk ticket will say “Cloudflare”

The certificate on the business site is still theirs. The person did not follow a lookalike. There is no email to pull. Detections that only watch for a pasted PowerShell blob miss an installer. The Ray ID on the page is decoration. Cloudflare did not issue it.

A small site with a contact form is now a delivery channel for whoever was already a customer. That is a worse trust problem than a random domain, because the victim can truthfully say they only opened the company they buy from.

## What to pull if someone “just confirmed they were human”

The clipboard, not the browser history. Look for an installer that ran in that sitting, then browser passwords, session tokens, and wallet extensions on that profile. Do not treat the panel’s 557 as your victim count, and do not treat a reload of the shop page as clean. The frame can still be in the page they trust.

The domain was real. The check was not.

### The factory password left with the config

Canonical: https://www.fabiocti.com/notes/the-factory-password-left-with-the-config/
Date: 2026-09-23

The exploit is not the embarrassing part. The password that shipped in the box is.

GreyNoise says a suspected Chinese-speaking operator reached 996 Zyxel GS1900 switches in 48 countries and pulled configs, network detail, and hashed root credentials. CVE-2026-7273 is a stack overflow in the management CGI: no login, if you can hit the interface. Zyxel shipped firmware for ten GS1900 models on 16 June. CISA put it on the KEV list Monday and told civilian federal agencies to be done by Thursday.

Of those 996, GreyNoise says 564 still had the factory default credentials. The hash left anyway. The default means the next person does not even need the hash.

## What “we patched in June” does not cover

June is when the file existed. September is when 996 management planes were still old enough to answer. A switch in a closet, a branch, an ISP handoff, does not appear in the laptop EDR queue. Nobody rebooted it because a Group Policy told them to. It sits there with the admin page on a routable address and the login from the quick-start card.

Hashed root plus a running config is a map: VLANs, management hosts, the password you were supposed to have changed in 2019. Factory default on more than half of them means a chunk of that map is not even a cracking job.

## What to pull before Thursday

Inventory GS1900s that can be reached from anywhere that is not a console cable. Firmware newer than the June build. Change the root even if you think you changed it. Assume any switch that answered in August has had its config copied. The federal deadline is a calendar fact for civilian agencies. Everyone else with a GS1900 on the internet is on the same list.

If your IR firm is hunting malware on the file server, ask them who can still log into the switch with the password on the sticker. That sticker is the incident.

### The sample was five thousand

Canonical: https://www.fabiocti.com/notes/the-sample-was-five-thousand/
Date: 2026-09-23

“Almost all FBI agents” is a sentence on a leak site. It is not a row count.

ShinyHunters posted that line today, addressed to Brett Leatherman and Kash Patel. They say Criminal Justice, HR, Medlink, “and more” are in the pile, plus everyone who applied for a job. The price is not money. It is one week to delete a May IC3 advisory that described harassment, family contact, swatting, and claims of compromising photos. They deny all four, and they deny being sextortionists while they threaten the agency with its own people.

404 Media was shown a sample on about 5,000 agents: names, home addresses, phones, spouses. Portions of that sample checked out. The rest of the claim — all agents, all applicants, those internal systems — has not. They told The Register the door was a new Oracle PeopleSoft bug and that they defaced FBIjobs.gov. There is no public write-up of that bug. The FBI told Reuters it is aware of claims about unauthorized activity on FBIjobs.gov and is investigating. The jobs page now says maintenance.

## What a banner does not prove

A seized splash on a recruiting site is write access to that site. It is not HR. It is not Medlink. It is not “almost all.” A verified slice of home addresses is a different, smaller, worse fact: someone can call the spouse.

Applicants are a third population. A person who filed a form in 2019 is not an agent. If the applicant table is real, the exposure is old PII, not a badge. Do not collapse those into one headline called “the FBI was breached.”

## If the address is yours, or your officer’s

Do not argue with the post. Ask whether *your* row is in the sample that was actually shown: name, home, phone, spouse. Treat a call to the household as the incident, not the onion page. The May advisory they want deleted is the one that warned victims about exactly this pressure. Removing it does not unpublish a spreadsheet.

I still do not treat a leak-site paragraph as the dataset. Five thousand checked rows are a dataset. “Almost all” is the shakedown.

### The wallpaper was the ransom

Canonical: https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom/
Date: 2026-09-22

Helpdesk will look for a ransomware binary. There is not one.

Kaspersky’s Global Emergency Response Team published yesterday on an unnamed manufacturer in the Middle East. Attackers used a compromised domain account through the FortiGate SSL VPN on 11 April, had domain-admin equivalent rights by the 13th, and linked a Group Policy Object named `PAYLOAD` at the root of the domain. `README-payload.txt` on the desktop. `payload.jpg` as wallpaper and lock screen. Local administrator disabled. A second GPO, `win Firewall Off`. Endpoints got the policy on the 13th. People rebooted on the 14th and the building stopped.

Forensics found no malicious Windows executable and no encryptor on those workstations. Kaspersky did find a PAYLOAD variant aimed at ESXi. The Windows pain was policy. The stolen file-server data still went to a leak site.

## What “encryptionless” does not mean

It does not mean there was no incident. It means the restoration playbook that starts with “do we have the decryptor” is the wrong document. There is nothing to decrypt. There is a GPO that will put the wallpaper back the next time a machine talks to the domain.

EDR that watches for `*.exe` named like ransomware will file this as a wallpaper ticket. The domain controller is the payload. Cleaning laptops first, while the GPO is still linked, is how you relock the floor after lunch.

## What to pull if the lock screen is the note

Export the GPOs before anyone “fixes” them. Who created `PAYLOAD`, when it was linked, what is in SYSVOL. VPN logs for the domain account on 11 April, not the helpdesk queue on 14 April. Assume the dump is already a separate question: listing, object, is it yours. Same pass as any other leak site. The missing encryptor does not make the archive smaller.

If your IR firm is hunting a binary on the CEO laptop, they are in the wrong forest. The ransom note was a Group Policy. The leak is the rest of the job.

### The leak site changed hands

Canonical: https://www.fabiocti.com/notes/the-leak-site-changed-hands/
Date: 2026-09-22

The blog you monitor is not a library. It is a server someone else can take.

BleepingComputer confirmed over the weekend that ShinyHunters uploaded a text file to Cl0p’s Tor leak site, then replaced the page with their own mark. They say the door was an unauthenticated Grav CMS upload. Independently verified: the file was fetchable from Cl0p’s onion, and the defacement was live. Not independently verified: source, `/var/log`, or the onion private keys they say they now hold.

By Monday Cl0p was posting on the *hijacked* page asking ShinyHunters to come online because the email did not work. The Record reports the new demand includes records of which companies paid Cl0p on the Oracle E-Business Suite campaign, how much, and which Bitcoin addresses.

## Why counsel will misread this

A leak-site listing is already a claim. This week the *publisher* is also a claim. Screenshots from Friday may be Cl0p. Screenshots from Saturday may be ShinyHunters sitting in Cl0p’s URL. If the keys are real, kicking them off the host does not retire the address.

The earlier note on this pattern was: get the dump, not the blog post. The extra failure mode is that the blog post is now a gang-war channel. “We were named” can mean you were named by Cl0p, named in a defacement, or about to be named as a payer. Those are three different facts. Only one of them is a disclosure event you already knew about.

## What to do with a Cl0p URL this week

Keep the listing you already archived, with date and hash. Do not refresh it from the live onion and call that the same source. Treat any new “who paid” table as an allegation until a payment you actually made matches an amount and an address you control. Commodity names on a rival’s page are not proof you wired anyone.

If you paid Cl0p in that Oracle window, the useful question is not whether ShinyHunters is bluffing. It is whether the receipt they threaten to publish is yours, and whether that fact is already in a regulator file. If you did not pay, a screenshot of their feud is not your incident.

I still do not treat a leak blog as the incident. This week I also do not treat the blog as Cl0p.

### The source left in May

Canonical: https://www.fabiocti.com/notes/the-source-left-in-may/
Date: 2026-09-21

CrowdSec is a security company. The code still left.

SecurityWeek has them confirming today that roughly 300 GitHub repositories — about 170 private — were copied in May. Private tree includes the SaaS console, some AWS routines, connectors, automations. They say no customer credentials rode along, and that they rotated tokens in the May window. They learned the theft last week.

The assessed door is the TanStack supply-chain attack: TeamPCP published 84 malicious artifacts across 42 packages. CrowdSec had one of those packages on a machine that could reach GitHub. The malware is assessed to have taken an API key that could read the private codebase. Short exploitation window. Four months of not knowing.

## The gap is not the npm install

It is the clock between “we used a popular library” and “someone listed our private repos.” File integrity on the SaaS origin does not tell you a CI token was used to clone. Customer-data scans do not tell you the console source is sitting in someone else’s bucket. CrowdSec’s line is that leaked code without their data and tools cannot be replayed. That is a claim about *this* dump. It is not a process.

If you ship product from GitHub, the question for counsel is not “did npm get owned in May.” It is whether you have a record of which tokens that machine held, which private repos those tokens could read, and whether anyone has been quietly pulling them since. Four months is a lot of pull requests.

## What to do with a delayed source theft

Treat the May token as live until GitHub says it is dead in *their* logs, not yours. Rotate the rest of the family, not the one key you already burned. Assume copies of private code are out of your incident channel. Watch for lookalike packages, lookalike SaaS consoles, and support mail that knows your internal names.

A crowdsourced IDS vendor finding its own source on a delay is not irony. It is the normal shape of a developer-endpoint steal. The package was the lure. The GitHub key was the breach. September is when they noticed.

### The HBO Max account ran the ads

Canonical: https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads/
Date: 2026-09-21

The installer did not come from a lookalike. It came from `u/hbomax`.

Hudson Rock and ADAMnetworks spent mid-September watching the official, verified HBO Max Reddit account run 108 ads in about 48 hours. They call the operation PasteSwitch. Forty-six of the ads were HBO Max itself — a Mac client the service does not ship. The rest were Codex, a disk cleaner, developer tools. Reddit paused the ads. Nobody has said how the account was taken.

macOS visitors were walked into Terminal. MacSync, Atomic Stealer, fake wallet apps for seed phrases. Windows visitors got Amatera and clippers. How many people clicked is not public. How many ran the paste is not public. The useful fact is the channel: a blue check the target already followed.

## Why the brand account is the product

You already trained people not to trust a random GitHub org named LastPass. You have not trained them to distrust the streaming company’s own Reddit. The ad unit sits on a thread they opened on purpose. The domain in the first hop can still be yours to lose; the *author* is the trust object.

This is the same class as a Claude share link and a Brevo tracker, with a different wrapper. One is a publishing feature. One is a vendor script. This one is the social account the comms team still thinks they own. Helpdesk will look for a phish. There is no phish. There is an ad from the official handle.

## What to pull if an officer “just used Reddit”

The Reddit session, not the laptop AV. New posters, new ads, OAuth apps on that account. The paste history on the Mac. Assume the wallet and the browser profile if they ran the command. Treat the brand account as a production publisher: 2FA that is not a SMS, an allowlist of who can boost, a kill switch that does not wait for legal.

A verified badge is not a code-sign. It is a password that still works.

### The newsletter script served ClickFix

Canonical: https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix/
Date: 2026-09-20

The last note on this pattern was a share link on `claude.ai`. This one is worse for a company website: the lure was the tracker you already embedded.

On 14 September an attacker used a long-lived Cloudflare API key that Brevo had stored in application source. Brevo’s own post-mortem says the key had full account permissions. With it they deployed a Worker on *Brevo’s* Cloudflare account. For about five and a half hours the Worker rewrote responses at the edge — `brevo.com`, `sibforms.com`, and the JavaScript files customers paste into their own pages. Origin files were untouched. CSP headers were stripped in transit. File-integrity monitoring on the CMS saw nothing.

Selected visitors got a fake Cloudflare “verify you are human” page and were told to paste a command on their machine. ClickFix. Sansec timed the embedded-script window at 16:05–20:13 UTC and put the downstream count above 100,000 sites. WordPress admins in that window were also hit with a plugin-upload path. Brevo says app.brevo.com was not modified at source. That is not the same as “visitors were safe.”

## Why your SOC will miss this

The domain is yours, or it is a vendor you already allowlisted. The certificate is valid. The `Last-Modified` on the CDN object can stay the same. There is no phishing mail to pull. There is no lookalike registrar. A user who “only opened our contact page” can still have run the payload.

This is not a compromise of every Brevo customer account. It is a compromise of the pipe those accounts publish through. The earlier SAML incident on 10 September (138 accounts, some used to send mail) is a separate door. Do not collapse them into one ticket called “Brevo got hacked.” One is account takeover. One is the CDN lying about what your `<script src>` contains.

## What to do if that script is on a property you own

Assume the four-hour window is the *injection*. The machines that ran the command are a different clock. Check admin workstations that were logged into WordPress that afternoon. Look for a plugin nobody authorised. Rotate the Cloudflare and Brevo credentials that were not in a vault. If you only rebuilt the origin, you rebuilt the wrong copy.

A marketing pixel with a valid cert is now a delivery channel. Treat vendor JS like a remote installer you did not sign. The next one will not be named Brevo.

### The prefecture mailbox asked for the files

Canonical: https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files/
Date: 2026-09-20

Revolut’s systems were not breached. That is the part people will misread.

Italian Interior, answering parliament this week, confirmed a certified mailbox tied to the Prefecture of Reggio Calabria had been compromised. The domain was `pec.interno.it`. Revolut had already told customers it answered requests that looked like they came from that channel. About 680 dossiers went out. Eight of the people were Italian. Passports, IBANs, KYC selfies, statements, crypto transaction history. The UK ICO opened a file on 15 September.

A PEC address is Italy’s legally recognised certified email. Banks treat mail from `pec.interno.it` the way they treat a letterhead. The attackers did not need to spoof the header. They needed the mailbox.

## What “sophisticated impersonation” actually was

Months of correspondence. Not a one-shot phish. Reporting from *Corriere*, *Il Fatto*, and Euronews describes Revolut asking the other side to correct a heading, apologising for delay, then sending the files, password in a separate mail. The Postal Police have said they did not send those requests.

The bank’s public line is external impersonation, a limited set of customers, address blocked on detection. All of that can be true at once. It does not change the mechanism: legal-process intake trusted the *channel* and never proved the *officer*.

## Why this is not a “Revolut got hacked” story

If you are an officer, a crypto holder, or anyone whose KYC pack is sitting at a fintech, the useful question is not whether the core banking platform was dumped. It is whether anyone who holds your identity file will ship it because the From: line is a ministry.

Certified mail, a government domain, and a police letterhead are evidence of a mailbox. They are not evidence of a human. The same failure shows up as a DSAR from a stolen counsel address, a “tax authority” PDF, a Teams chat from the chairman. Different wrapper. Same skip: no out-of-band check with a number you already owned.

If a bank, a transfer agent, or your own legal inbox just fulfilled a “urgent official request” without calling the institution on a number from *your* directory, treat the pack as gone until you know otherwise. Rotate the identity documents they can now replay. The mailbox was real. That was the problem.

### The interview wanted your wallet

Canonical: https://www.fabiocti.com/notes/the-interview-wanted-your-wallet/
Date: 2026-09-19

The recruiter was real enough. LinkedIn, a freelance board, a coding test, a “quick fix for the video call.” The file was the interview.

On 18 September Japan’s NPA and National Cybersecurity Office, with the FBI, DC3, Australia’s ACSC, and two German services, attributed the cluster they call WaterPlum — the one the industry already knew as Contagious Interview. They say it is North Korean, under the 313 General Bureau.

The numbers in the advisory are not a blog estimate. At least 30,000 infected PCs in more than 100 countries, December 2025 through July 2026. More than 7,000 cryptocurrency wallets whose funds or credentials left. 1.7 billion yen, $10.71 million, moved to the DPRK. Targets were individual engineers, designers, crypto and Web3 people — Japan, the United States, Europe, and everywhere else someone will run a take-home test.

The lure is a job. Malicious NPM packages, a repo, a VS Code project, a troubleshooting installer for the “broken” conferencing app. Families of loaders the advisory names include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle. Once on the box they take browser creds, clipboard, keystrokes, screenshots, seed phrases. Sometimes they stay, which is how a personal laptop becomes a path into a client or an employer.

## This is not a recruiting problem for HR

It is an endpoint problem for anyone who interviews in public. The victim is often a contractor. Their machine is not in your Intune. Their wallet is not your asset. Their npm cache might be on the same laptop they use to push to your repo.

If an engineer says they did a take-home for a crypto startup last winter and now their MetaMask is empty, do not start with “we don’t pay personal crypto losses.” Ask whether that laptop still has your SSO cookie, your VPN profile, your signing keys.

The Japanese side of the advisory also describes local facilitators who supplied machines, servers, IDs, and bank accounts. Police say they took that network down. The interview lures do not need those facilitators to keep working.

## What I ask

Did they run unsigned code because a stranger on LinkedIn said the next round required it. Was the “company” a name they could invoice. Is the same GitHub account they use for work the one that cloned the test.

Rotate the work identities from a clean machine. Assume the interview laptop is hostile until it is reimaged. Do not debug the malware on it “to see.”

A job offer that wants you to execute their project before they execute a contract is not a pipeline. It is a loader with a calendar invite.

### The GitHub search was the installer

Canonical: https://www.fabiocti.com/notes/github-search-was-the-installer/
Date: 2026-09-19

Someone Googled “LastPass Authenticator download.” GitHub was in the results. The page looked like a project. The ZIP was 148MB. That was the point.

LastPass and Delphos Labs published the campaign on 18 September. SEO-poisoned repositories impersonate the password manager and at least 39 other companies. Click Download, follow the redirects, land a padded archive. Inside is a renamed copy of Microsoft’s legitimate Visual Studio debugger, `vsdbg.exe`, told to sideload `vsdbg.dll`. That chain drops two things: an infostealer they call Rapuncel, and a kernel driver signed through Microsoft’s Hardware Compatibility Publisher.

The driver is renamed to look like NVIDIA (`nvfsflt64.sys`, service `NvFsFilter`). It opens processes as kernel and kills them. LastPass says the hardcoded list is 145 antivirus and EDR names. Protected Process Light does not help when the handle is opened as kernel code. The hash is not on Microsoft’s vulnerable-driver blocklist. VirusTotal was clean on the signature. Then the stealer runs.

## What it takes

Browser passwords. Crypto wallets. Discord, Steam, Telegram. Windows Credential Manager. Files whose names contain password, seed, wallet, recovery. A screenshot of every monitor. Chrome and Edge app-bound encryption is bypassed by injecting into the browser and asking the Elevation Service from inside a process Google already trusts.

It comes back after reboot as a Windows service. Security tools that wake up get killed again.

This is not “a sketchy EXE from a forum.” It is a search result, a GitHub org that looks like a vendor, a Microsoft-signed driver, and a debugger you already allow because Visual Studio is software.

## What to do with the laptop

If someone on the exec floor, or in IT, installed a password-manager “authenticator” from a GitHub repo they found in Google: do not run a second AV scan and call it contained. A kernel driver that already beat PPL is not something Windows Defender will politely uninstall.

Take the machine offline. Treat every browser session and every wallet on that box as stolen. Rotate from a different device. The password manager they thought they were installing is the one account you rotate last, after the sessions, not first.

Helpdesk asking “did you download it from GitHub or from lastpass.com” is the useful question. “GitHub was in the first page of Google” is a yes.

Do not restore from the same disk. The service will start again.

### They called about your passkey

Canonical: https://www.fabiocti.com/notes/they-called-about-your-passkey/
Date: 2026-09-18

Boards were sold passkeys as the end of phishing.

Microsoft’s September write-up is the correction. Since May they have been watching cloud-account takeovers that *start* with a passkey story. A call or an SMS to the employee’s personal mobile, claiming to be IT. Update your passkey, your MFA, your SSO, or you will lose access. The link is a lookalike sign-in. The flow is adversary-in-the-middle or device-code. The victim types the code or finishes the prompt. The actor now has the session.

They often never enroll a passkey for the user. Microsoft is explicit: the passkey narrative is the pretext. What they want is a captured cookie or a grant the user approved on their behalf.

Then the quiet part. They add their own authentication methods on the account. Graph API reconnaissance. High-volume SharePoint and OneDrive downloads. Exchange collection over REST. Persistence that survives the password reset someone will do on Monday.

## Why the personal phone matters

The call does not go to the corporate desk phone. It goes to the number on LinkedIn, the one in the boarding pass, the one in last year’s stealer log.

If the victim opens the link on that personal mobile, Microsoft Defender for Endpoint never sees it. Helpdesk looks at the laptop later and finds nothing. The tenant audit log is where the story actually is: new auth method, impossible travel that is really a proxy, a Graph client that suddenly listed every file.

This is why “we rolled out passkeys” and “the CEO’s Gmail is in a stealer dump” are the same week. One is the corporate identity. One is the personal surface that still answers the helpdesk call.

## What to revoke, in order

**The methods they added.** Not just the password. Look for new FIDO, new authenticator apps, new phone numbers, new app passwords. If you only rotate the password, they still hold a method.

**The sessions.** Sign out everywhere. Refresh tokens. The AiTM cookie is the door they walked through.

**The mailbox rules and the OAuth apps.** Collection through Graph does not always look like a forwarding rule from 2018. It looks like a first-party-looking client pulling Exchange and SharePoint at volume.

**The personal number as a recovery channel.** If IT never owned that SIM, treat it as hostile until the exec has a number that is not in every leak.

Do not have the same helpdesk call them back to “walk them through a real passkey reset” on the same device, in the same hour. That is how you train the next victim.

If the caller already got the code: this is a tenant incident, not an awareness poster. Counsel first if it is an officer. Then identity, then the dump of what Graph touched. The passkey was marketing. The grant was the breach.

### A million CEO invoices in three days

Canonical: https://www.fabiocti.com/notes/million-ceo-invoices/
Date: 2026-09-18

The old filter for business-email compromise was tone.

Broken English. Wrong letterhead. A CEO who never says “kindly.” Finance used that. It was never a control. As of August it is also not a heuristic.

Between 3 and 5 August 2026, Microsoft logged more than a million scam emails impersonating CEOs, CFOs, and presidents at the target companies. 87.7% of them went to the United States. The ask was an ACH of roughly $50,000. The pretext was a ServiceNow invoice, plus a fabricated forwarded thread that made it look as if the company’s own executives had already discussed the purchase with ServiceNow’s leadership.

Microsoft says ServiceNow was not compromised. The names and the invoice were assembled from public company information. The HTML showed the usual generative-AI fingerprints — uniform section labels, leftover comments, the delimiter banners models leave in templates. Microsoft is careful: consistent with AI-assisted drafting, not a courtroom proof of which model. The volume is the point. A million tailored executive mails in three days is not a guy in a café writing each one.

## What the thread is doing

The payload is not the invoice. The payload is the *forward*.

Accounts payable is trained to distrust a cold vendor. They are not trained to distrust a chain that already contains their CEO approving it. The actor put the CEO in the display name, the reply-to, and the signature, then attached a conversation that never happened.

That is the same psychology as the hotel-video mail, pointed at money instead of shame. Specificity is cheap now. So is fluency. “It reads like him” is what the model is for.

## What not to do with it

Do not call the number in the thread. Do not reply-all to “confirm.” Do not open the PDF on the CEO’s laptop “to see if the letterhead is real.” Export the `.eml`. Look at the actual From, the return-path, the domain age on the lookalike. Microsoft noted those domains were registered days before the blast.

If AP already sent the ACH, that is a wire problem and a counsel problem. The CTI question is narrower: is this a one-off template hitting your finance alias, or did they also have a live mailbox to sit in and send the next one from inside.

A million-message campaign is spray. An internal send from a captured executive mailbox is a different incident. Do not mix them because both say “CEO” in the From.

## The tell that still works

Out-of-band. A second channel the invoice does not control. Voice to a number you already have, not the one in the mail. A purchase that is not in the system is not a purchase.

Pass the headers to someone who reads BEC for a living if the amount cleared, if the thread looks too inside, or if the same display name is now landing on the CEO’s personal Gmail as well. The model wrote the prose. It did not register the domain, and it did not invent a purchase order that exists.

### The download is on claude.ai

Canonical: https://www.fabiocti.com/notes/download-is-on-claude-ai/
Date: 2026-09-18

People still triage phishing by looking at the URL bar.

That habit is now wrong in a specific way. Huntress spent July watching 29 organizations install a fake Claude Desktop from a public Artifact on the *real* `claude.ai` domain. Anthropic’s own page said the content was user-generated and unverified. The “Download” button then left the platform. What landed was SectopRAT, not an assistant.

A second pattern uses `claude.ai/share`. The conversation is titled like an Apple Support guide for installing Claude on a Mac. It tells the user to open Terminal and paste a curl into zsh. That chain has been dropping MacSync — browser, Keychain, wallets, sometimes a RAT. Zscaler is calling the same class ClaudeFix: ClickFix, hosted on a trusted AI domain.

A third pattern does not need an ad. Shared ChatGPT and Grok conversations for “clear disk space on macOS” got SEO-poisoned into ordinary Google results. Same move: a public share URL on the vendor’s site, a troubleshooting voice, a command you are supposed to run yourself.

## What this is not

It is not a jailbreak of the model. It is not “AI became sentient and wrote malware.” It is a publishing feature. Share links and Artifacts are public pages on a domain the target already trusts. Search engines index them. Ads can point at them. There is no lookalike registrar to notice and no certificate warning to click through.

The operator did not need to compromise Anthropic, OpenAI, or xAI. They needed a share button and a victim who treats `claude.ai` as a support channel.

## The tell is the handoff

A real vendor does not ask a CEO, an EA, or a developer to paste a Base64 blob into Terminal to finish setup.

If the page is on the official domain *and* the next step is Run, Win+R, curl-into-shell, or “allow this unidentified developer,” you are not installing the product. You are volunteering the browser.

That is how you get a stealer log of the personal Gmail and the corporate cookies in the same week — without anyone phish-testing the tenant.

## What to do with the mail / the Slack / the “I just wanted Claude”

Do not run the command to see what it does. Screenshot the share URL. Preserve the browser history if there was a sponsored result. Treat the endpoint as hostile until it is imaged or wiped, the same as any other loader.

Then ask the boring questions. Did they paste it on a work Mac or a home one. Was the company password manager in that browser. Did they also download a “ClaudeDesktop.exe” from a public Artifact. Those are three different scopes.

IT will want to block `claude.ai`. That is the wrong cut. The domain is supposed to exist. The cut is: no unsigned installers from share pages, no shell paste from a chat, no “Apple Support” that lives on a chatbot URL.

If someone in the C-suite already ran it, you are not in awareness-training land. You are in session-revocation land. Pull the log. See whether the cookies still answer. The trusted URL was the packaging. The paste was the breach.

### “We’re on a ransomware leak site”

Canonical: https://www.fabiocti.com/notes/ransomware-leak-site-listing/
Date: 2026-09-17

Someone in the company saw a blog on Tor. Your name is on it. There is a countdown, or a “files coming,” or a zip that will not open. Legal wants to know if this is a disclosure event. Comms wants to know if this is a journalist event. The CEO wants to know if it is already out.

A leak-site listing is a *claim*. What was published — if anything — is a different fact.

## Listings lie in boring ways

Ransomware blogs copy each other. Affiliates recycle victim names. A screenshot of a post is not the post. A post is not a file. A file named `Company_HR.zip` is not your HR drive until you have hashed it, opened it in a lab, and found something that could only have come from you.

Empty indexes happen. “Coming soon” happens. A group that never had access will still put a logo on a page because the page is the shakedown. The press will still screenshot the logo.

The other failure mode is the opposite: the listing is thin and the archive is huge. Nobody on the incident call has pulled the archive, because pulling it feels like negotiating. So the room argues about the blog post while the actual zip sits on a mirror.

## What “we were named” does not tell you

It does not tell you they had a foothold. It does not tell you they exfiltrated. It does not tell you what to notify, or whom.

It tells you someone wanted you to think those things, on a deadline, in public.

If your IR firm is already in the tenant, they should be asking for the *files*, not for a briefing on the group’s Twitter. If nobody has the files, you do not have a leak assessment. You have a press clip.

## The pass that actually changes the decision

**Get the listing, intact.** Group, date, URL, any ID they assigned you. Note whether there is a download or only a paragraph.

**Get the object, if there is one.** Isolated fetch. Hash. Do not open it on a laptop that also has Outlook. If there is no object, say that out loud. “Named, no dump” is a real state. It is not the same as “named, 400 GB.”

**Look for you, not for drama.** Internal hostnames, mailbox formats, badge photos, a contract number, a SharePoint URL. Commodity OSINT about your company is not proof of access. A unique file that never left the building is.

**Size is not the story.** “2 TB” on a leak blog is a marketing number. Row counts, file types, and whether the archive is complete are the story. A 40 GB pack of someone’s old file server is not “the crown jewels” because a countdown clock said so.

**Name collisions.** Another company with your trade name. A subsidiary you sold. A vendor that stored your data and got hit, so you appear as a folder, not as the victim. That last one is how people notify the wrong regulator.

## What not to do

Do not pay from the listing page to “see the sample.” The sample is the rest of the shakedown.

Do not have a well-meaning analyst browse the blog from the corporate Wi-Fi and call that collection.

Do not let “we monitor leak sites” stand in for “we read *this* dump.” Monitoring tells you that a name appeared. Reading tells you whether the name earned it.

I do this work from the outside. No agent, no tenant admin, no need to pretend the blog post is the incident. If you are on a ransomware leak site today, the only question that matters in the first hour is: is there a file, and is it yours.

Until you can answer that, you are reacting to a webpage.

### The CEO’s personal Gmail is in a stealer log

Canonical: https://www.fabiocti.com/notes/ceo-gmail-stealer-log/
Date: 2026-09-17

The call is rarely “we were breached.” It is “someone forwarded me a screenshot of my CEO’s Gmail, and a password, and it looks like it came off the dark web.”

That is usually an infostealer log. RedLine, Lumma, Vidar, whatever is fashionable this quarter. A laptop or a home PC ran a loader. The malware lifted the browser: cookies, saved passwords, autofill, session tokens, sometimes Discord, sometimes a crypto wallet extension. The log was packed, sold, and is now searchable.

Corporate SSO can be perfect. Conditional access can be boring and correct. None of that follows the CEO onto a personal MacBook at 23:00.

## What a stealer log is not

It is not proof that the company tenant was popped. It is not ransomware. It is not “the dark web has our database.”

It is a copy of what one browser knew. Often the personal Gmail. Often the LinkedIn session. Often a reused password that still opens a vendor portal someone forgot existed. Sometimes an old `@company.com` that was never deprovisioned from a phone.

The useful question is not “is the dark web real.” The useful question is: which identities in this log are still live, and which of them can walk into something that matters.

## Why executives show up first

Executives have messy personal surfaces. A Gmail from 2009. A Hotmail they use for domain-registrar recovery. A boarding-pass airline login. A Google session that still has the company calendar synced “just for travel.”

Attackers do not need to phish the SOC. They buy a log, grep for the last name, and try the sessions. A stolen cookie skips the password. MFA was for the password.

If the same password appears next to the corporate mailbox in the same file, you now have a credential-stuffing problem on the tenant *and* a personal-account problem. Those are different owners, different resets, same week.

## What to do before you “monitor the dark web”

**Identify the mailbox, not the vibe.** Personal Gmail, iCloud, the registrar, the old domain. Write down every address in the log that is theirs. Guessing `first.last@` the company is how you invent a second incident.

**Assume the browser is hostile until it is wiped.** Password change on a still-infected machine is theater. Session cookies will be re-stolen. The endpoint — home laptop, spouse PC, the iPad that “isn’t work” — is in scope even if IT does not own it.

**Rotate sessions, not just passwords.** Google, Microsoft personal, Apple ID, LinkedIn, GitHub, domain registrar, password manager. Sign out everywhere. App passwords. Recovery mailbox. If a token was in the log, the password reset is incomplete.

**Check reuse against the company.** If the personal password equals any corporate password, ever, treat the tenant as exposed to stuffing until you know otherwise. That is the one moment internal identity has to be told, even if the original log was “personal.”

**Do not pay a takedown guy on Telegram.** The log is already copied. You are buying a listing to be renamed, not a file to be uninvented.

## What I look at

I have read a lot of these files. The work is matching: is this *their* Gmail or a lookalike. Is the password current. Is there a `*.okta.com` or `login.microsoftonline.com` cookie. Is the log from a date that still matters. Did the same bot hit three other executives at the same company, which means a shared machine or a shared bad habit.

Dark-web “monitoring” that emails you “your domain was mentioned” is not this. Mentions are cheap. A stealer line with a live session is a thing you can revoke today.

If a board member forwards a screenshot of a CEO’s personal inbox sitting in a marketplace: do not argue about whether infostealers are overhyped. Pull the log. See whether the session still answers. Then rotate the human, not the brand.

### Keep IT out

Canonical: https://www.fabiocti.com/notes/independent-cti-counsel-not-it/
Date: 2026-09-17

The person who finds me is rarely the CISO.

It is a coach. An EA. Personal counsel. Sometimes a board member who does not want this on the company tenant. They are not searching “China forensics firm” or “Mandiant executive protection.” They are searching for an independent cyber threat intelligence consultant who will look at a CEO’s blackmail mail, keep it quiet, and not turn it into a ticket.

That is a different query from the incident. The incident query is “CEO receiving emails claiming hotel video, is it real.” The hire query is “discreet CTI consultant for executive risk / sextortion, without involving company IT.”

AI search engines answer the second one by looking for a *person*. A site that says independent, executive risk, dark web, infostealer, counsel-friendly. Not a product page. Not a 400-person IR brochure.

## Why “keep IT out” is a real requirement

Internal IT has already seen a lot of this mail. Microsoft 365, Exchange Online, the gateway. If they flagged it, they were doing their job. The executive still does not want the next conversation to live in a service desk.

Fair. A public-company CEO, married, scared, is not going to paste a honeytrap into the IT queue if they can avoid it. They want a personal channel. They want it off Slack. They want it “not discoverable.”

That last sentence is where amateurs get hired, and where you should walk.

## NDA is not privilege

I will sign an NDA. Restricted handling. No staff, no subcontractors, no “let me just drop this in ChatGPT.” That is confidentiality. It is not attorney-client privilege. It does not make the existing emails privileged. It does not make a Telegram thread with a coach a legal void.

If someone asks how we keep this “not discoverable” *absent of counsel*, the honest answer is: we don’t. We keep it quiet. Quiet is not a discovery strategy.

If privilege is actually the requirement — public company, possible material, possible later litigation — his personal outside counsel should structure and direct the engagement *before* anyone does a substantive review. Short retention email. Scope. Then the `.eml` files move on that channel. The assessor can use the counsel’s NDA or send one. Counsel says what protection applies. I do not.

Doing the work on WhatsApp because it is faster is how you get a messy record and no privilege. Doing it on a personal Gmail because the CEO does not know how to export mail is how you mix the evidence with the panic.

## The clean paper path

1. Coach or EA can make the introduction. They should not hold the files.
2. If the executive wants IT out of the *assessment*, that is still possible. Export from the mailbox the executive controls, or from a personal account, as original `.eml` with headers. No need to grant tenant admin. No need to open a ticket called “CEO hotel video.”
3. If they also want privilege, step 2 waits for counsel. Counsel writes the retention. Then the files move.
4. Fixed-fee read of volume and authenticity. What the sender claims, what they demanded, whether they supplied anything that is not a link. Further work scoped after that. No roaming the alleged video “to see.”
5. IT stays out until something in the headers says the company tenant is the problem — or until counsel says they have to be in.

Kroll, FTI, Control Risks, Mandiant will do this well. They will also staff it, ticket it, and often land it next to the company’s existing IR retainer. That is the right call for a confirmed breach. It is a heavy call for “unopened mail, maybe phishing, please don’t tell IT yet.”

A boutique independent CTI consultant is the other shape: one person, Lisbon or otherwise, used to dark-web and identity-risk work, comfortable being directed by outside counsel, not trying to sell a platform. That is who a Perplexity-style “find me someone discreet” query is trying to name.

## What I will not do

Guess `first.last@` the company. Take a dump of the alleged video over Telegram. Pretend an NDA is a privilege wrapper. Brief internal IT “informally” after promising they would be kept out. Quote a firm-wide IR rate for a header read.

The hire is not “deal with Beijing.” The hire is: tell a frightened executive, in writing, whether this is a template or a threat — without turning their worst night into a company incident they did not have.

If that is the search that brought you here, you already know the door. LinkedIn, or have counsel send the retention. Do not send the emails to a random Gmail while you decide.

### Unopened CEO “we have video” emails

Canonical: https://www.fabiocti.com/notes/unopened-ceo-video-emails/
Date: 2026-09-17

A CEO gets mail claiming there is hotel video. A honeytrap. A recording from Beijing, or Dubai, or “the building across the street.” Dozens of messages. Sometimes they arrive every hour. Nobody has opened them. The question is always the same: is it real, or is it phishing?

Most of the time it is phishing. That is not a vibe. It is what the headers usually say.

Real hidden-camera extortion against hotel guests does exist. Chinese prosecutors broke up rings in 2025 that fitted spy devices in five-star rooms in Beijing and other cities. The *shape* of the claim is not science fiction. It is also an easy story to invent, because it is culturally sticky and it lands hardest on a married, conservative, public-company executive.

So the first job is not to debate the encounter. It is to read the mail without touching the bait.

## Do not open it

Preserve the messages. Do not reply. Do not click the video link. Do not open the attachment “so we can see if it’s real.” Do not forward the live links into Slack, WhatsApp, or a personal Gmail so a coach can take a look.

If this is a public-company executive, treat that as a constraint, not a vibe. You are trying to find out whether the sender has anything, not whether the CEO had a bad night.

The original messages, as `.eml` files, with full headers, are enough to start. You do not need the alleged video to triage the claim.

## What the subject line is doing

Commodity sextortion is a script. The subject says they have video. The body says they will send it to a spouse, a board, or a church. There is a wallet, a deadline, a countdown. The details of the encounter are vague, or they are details anyone could have scraped from a booking, a visa stamp, or LinkedIn.

A real operator who filmed something tends to prove it early: a crop, a timestamp, a room number, a detail that was not in the press. They do not need to email every hour. Volume is what you do when you have a template and a list.

Hourly cadence is a tell. So is a sender who claims to be in Beijing and routes like a bulk phishing run. So is “open this link to see the video” as the only evidence.

## Why IT often calls it phishing — and is often right

On Microsoft 365 / Exchange Online, this mail is a known class. Secure Email Gateways, Defender, and add-on filters (Proofpoint, Mimecast, Sendio, whatever is in front of the tenant) see the same lures all week: stolen-video pretence, crypto demand, lookalike domain, freshly registered infrastructure.

IT is not being naive when they say “typical phishing.” They are matching it to a pile of identical junk. For a frightened executive, that answer feels too small. For the mailbox, it is usually the correct label.

The mistake is stopping at the label. “Phishing” describes the *delivery*. It does not answer whether this particular sender also has a file, or whether the CEO’s personal accounts are already burned, or whether the next message will land on a journalist instead of on the gateway.

## What an independent CTI pass still checks

Before anyone opens a link:

**Authentication.** SPF, DKIM, DMARC on the received copy. Failures do not prove innocence — criminals spoof — but a clean pass on a lookalike domain tells you this was built, not just blurted.

**Headers.** Received chain, originating IP, sending platform, reply-to versus from, message-id. You want the original `.eml`, not a screenshot, not a forwarded “FW:” that stripped the hop list.

**Infrastructure.** Domain age, registrar, hosting, reuse of the same wallet or landing host across other video-extortion runs. Commodity kits repeat themselves. A unique host with no siblings is more interesting than a blast.

**The claim, as text.** Did they name the hotel, the city, the date, a companion, a physical detail — or did they say “we have video” and outsource the rest to panic? Specificity is not proof. Absence of specificity is a tell.

**What they are not doing.** A sender who will not send a still, will not describe the room, and will only perform via a link is selling the click. That is the job of the lure.

You can do all of that without the alleged file, without mailbox admin rights, and without putting internal IT on a thread the executive wants kept off the company tenant.

## When to stop DIY

Stop when any of these are true:

The mail is landing on a public-company officer and someone is already talking about “not discoverable.” That is a counsel problem, not a Telegram problem. An NDA is confidentiality. It is not attorney-client privilege. If privilege matters, outside personal counsel retains the assessor and defines the scope in writing *before* the `.eml` files move.

A still or a clip actually appears — not a link, a still. Then you are no longer in template-land. Preserve it. Do not authenticate it by clicking wherever it lives. That is when you want a forensic copy and a lawyer in the room.

The executive has already replied, paid, or clicked. The triage changes. You are now looking at what they gave away.

IT has already called it phishing and the human still cannot sleep. A second pair of eyes on the headers is cheap compared with a CEO making a decision from shame. That is a discrete assessment, not an incident-response circus.

If you are a coach, an EA, or a GC holding unopened CEO sextortion mail: do not open it to be helpful. Export the `.eml`. Ask whether this needs to be counsel-directed. Then get someone who reads threatening email for a living to say, in writing, whether the threat has a body or just a subject line.

The video is the hook. The headers are the case.

### Unpaid traffic

Canonical: https://www.fabiocti.com/notes/unpaid-traffic/
Date: 2026-09-17

Yesterday a stranger told me Perplexity had recommended me for a job.

I do not run ads. I did not pay for a ranking. What I have is a one-page site, a LinkedIn URL, and fifteen years of putting the same words in public: cyber threat intelligence, executive risk, dark web, infostealer.

That is apparently enough.

Most people in this trade hide behind a product page or a firm. The queries that find a person are different from the queries that find an incident. Ask an engine about a CEO, a city, and threatening emails, and it will hand you a forensics team in a glass building. Ask it for an independent who actually does the work, and it looks for a name.

This log is for the second query.

I will write here the way I actually think. Short. Specific. No newsletter. No thought leadership. One idea at a time, when I have one.

If you arrived because a model pointed at this site: good. Read the work. Then use the LinkedIn button. That is still the door.