Hacking Humans – "Liar, liar, AI on fire."

Podcast: Hacking Humans – N2K Networks
Date: October 23, 2025
Hosts: Maria Varmazes and Joe Kerrigan
Theme: Deception, influence, and social engineering in the world of cybercrime

Episode Overview

This episode examines the escalating nature of cybercrime and social engineering, with a particular focus on international scam operations, the exploitation of AI to target younger generations, and innovative but dangerous attack techniques. Joe and Maria break down recent headlines—including government crackdowns on Southeast Asian scam centers, the psychological toll of AI-fueled extortion on Gen Z, and a sophisticated phishing attempt that tries to trick users into running malicious code. With trademark candidness, humor, and a dash of cynicism, they explore both the bleak advancements in scams and emerging steps for personal defense.

Main Discussion Points & Insights

1. Security Update: Signal Scam Attempt

(Begins ~02:23)

• Listener Follow-Up (Michael):
  • Received a message on Signal, purported to be from "Signal Security Support Chatbot," warning of "suspicious activity" and instructing to complete a verification process.
  • The message asks for a verification code, warning not even to tell Signal employees, which is a classic scam red flag.
• Host Insights:
  • Maria confirms this is a scam after checking Signal’s FAQ:
    “Signal Support will never reach out to you first... Contact with Signal... will only come from a signal.org email address, not from within the app.” [04:08]
  • Advice: Report and block any in-app contact claiming to be Signal support.

2. Southeast Asia Scam Centers and Global Crackdowns

(Narratives begin ~06:17)

Story 1: South Korea & Cambodia (New York Times)

• Overview:
  • South Korea grapples with kidnappings and forced labor: 330 South Koreans reported missing in Cambodia this year alone; at least one found dead.
  • Victims forced to perpetrate scams targeting fellow South Koreans.
  • Estimated $10B stolen by Cambodian scam centers from the US in the last year; South Koreans lost $148M in 2023.

Story 2: US Seizes $15B in Bitcoin from Cambodia’s Prince Holdings

• Good News?
  • US government seizes $15 billion in bitcoin from a global crypto scam, linked to Chen G of Prince Holdings.
  • The scam operation built on forced labor and sophisticated laundering, covering "real estate," "banking," and "consumer services."
  • Maria’s dark humor:
    “That is, if you look through that with a dark sense of humor... Real estate development being these forced labor camps, banking being asset transfers of ill-gained money, ... consumer services being scamming people.” [11:15]
  • Casino Angle:
    • Joe explains how casinos, especially those without strong "know your customer" (KYC) requirements, are perfect for laundering illicit money.

Story 3: Chinese Crackdown—Death Sentences Issued

• Context (BBC):
  • China sentences 11 members of a crime family to death for running scam centers in Myanmar.
  • 39 total handed harsh sentences.
    “China has really... handed down sentences to 39 people in this case. So China's doing something about this. The United States is doing something about this. South Korea is doing something about this.” [15:32]
  • Both hosts comment on the severity and implications but express discomfort with the death penalty as a solution.

Key Takeaway:
International awareness and action are increasing, but the magnitude, foreign complicity, and sophistication (including use of crypto and forced labor) mean these scams aren’t going away soon.

“It is a global problem… And with AI it is a truly global problem.” —Maria [15:55]

3. AI-driven Scams Targeting Gen Z

(Begins ~19:57, Discusses Malwarebytes Report)

• Highlights from Research:
  • 69% of extortion scam victims and 64% of targets are Gen Z or Millennials.
  • Despite less financial loss than older victims, younger users face severe emotional/personal fallout from attacks (especially AI-driven, personalized scams).
  • Demographics: Majority of victims are male, many are parents, and a significant portion aren’t white. Many click links on phones more than on computers.
• Discussion:
  • Joe recalls prior findings:
    “Younger people are more likely to get scammed, but… less likely to suffer grave losses. Old people are less likely to be scammed, but when they are, it’s devastating.” [21:08]
  • AI is accelerating scam sophistication—deepfakes, personalized messages, and highly convincing scenarios built out of public or even private (Discord/Game chat) voice/video data.
  • The emotional damage quotient: eg. shame or distress from sextortion or fake porn blackmail, especially harmful to young or community-conscious targets.
    • “I wish people didn't feel shame about watching porn... but it breaks my heart that so many people have their lives ruined over just an allegation.” —Maria [26:15]
• Memorable Moment:
  • Reflection on how deepfakes and AI-made evidence can ruin reputations, jobs, and emotional wellbeing, especially in conservative or tight-knit communities.

Malwarebytes “STOP” Scam Response Acronym [28:08]

• S: Slow down – Don’t let urgency panic you.
• T: Test them – Ask a hard-to-Google question only the real person would know.
• O: Opt out – If it feels wrong, hang up or disconnect.
• P: Prove it – Verify identity via a trusted, separate method or contact.

Joe and Maria both endorse this as practical advice—bring back the “family password” concept for added protection against AI deepfakes and scam calls.

4. Catch of the Day: Technical Attack Disguised as Cloudflare Verification

(Begins ~32:19)

• Scenario:
  • Listener “Dark Prophet 6” visits a site for military ID (CAC) help and gets a fake Cloudflare “Are you human?” prompt.
  • The page instructs copying and pasting a “harmless command” into the terminal, which actually base64-decodes and executes a bash command—likely opening a reverse shell (remote access) for the attacker.
• Joe’s Explanation:
  • “Reverse shell” means your computer opens a hidden connection out to the hacker, giving them direct access.
    • "It's really just a really simple command that would give someone access to your computer." [40:03]
  • Because the command relies on an outbound connection, many firewalls won’t block it.
  • This attack is brazen: most phishing is web-based or form-based, not direct terminal manipulation.
• Security Lessons:
  • Never paste anything from a random website into your command line/terminal.
  • Even some antivirus engines miss such malicious pages, so vigilance is key.
  • Attackers may be specifically targeting users based on likely possession of high-value credentials (like CAC cards).

Notable Quotes & Memorable Moments

• “I cannot imagine in any universe Signal…would ever have anything like this.” —Maria, on Signal imposter scam [03:48]
• “Now, now schools are like a maximum security prison practically. Back then they’re like, ‘Yeah, just take the kid.’ But…a family password is a great idea.” —Maria [29:04]
• “Assume the breach. Assume your information is out there.” —Joe [32:11]
• “I have gone to all of my family and said, if you ever get a call from me and it sounds like it’s me asking you for money, it’s not me. Hang up.” —Joe [30:34]

Timestamps for Key Segments

• Signal imposter scam & official guidance: [02:23–05:27]
• Southeast Asian scam centers & crackdowns: [06:17–17:14]
• AI-driven Gen Z scams & emotional toll: [19:57–28:07]
• STOP response framework for scams: [28:08–31:11]
• Catch of the Day: Terminal copy-paste scam: [32:19–41:28]

Takeaways

• International scam operations are growing in sophistication and scale, often with government and criminal nexus.
• AI tools are giving scammers more convincing vectors to target and traumatize younger users.
• Old-school advice like out-of-band verification, family passwords, and skepticism of urgency remain vital—even in a world rife with AI and sophisticated malware.
• Technical awareness is crucial: Attacks prompting terminal copy/paste are next-level and dangerous—even trusted “branding” like Cloudflare can be spoofed.

Hosts:
Maria Varmazes (T Minus Space Daily)
Joe Kerrigan

For more practical guidance, cybersecurity analysis, and dry wit, tune in to Hacking Humans.