June 26, 2026 • 4 mins
In this episode, we cover emerging threats targeting healthcare and enterprise organizations, including AI platform impersonation scams, the ShinyHunters attacks on Oracle PeopleSoft systems, and research showing AI email agents are vulnerable to phishing. We also discuss Paubox joining LegitScript's Compliance Collective and the Novo Nordisk clinical trial data breach investigation. Key takeaways include verifying AI tool sources, reviewing legacy system configurations, and applying least-privilege principles to AI agents.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:00):
You're listening to POWBox Weekly Fully Automated.
(00:03):
I'm Jen, Cybersecurity Analyst,Professional Paranoid.
SPEAKER_01 (00:07):
And I'm Alex, healthcare IT guy who still
believes in the good in people.
Mostly.
Brave of you.
So this week, attackers areimpersonating AI platforms:
ChatGPT, Claude, DeepSeek, usingfake versions to steal
credentials and financial data.
SPEAKER_00 (00:24):
Of course they are.
Everyone's rushing to try thenew AI tools, and attackers know
it.
They set up fake payment pages,bounce victims through a CRM, an
Amazon tracking domain, a URLshortener.
SPEAKER_01 (00:37):
That's a lot of hops.
SPEAKER_00 (00:38):
That's the point.
By the time you land on themalicious site, you've got no
idea how you got there.
And the page looks legitimateenough that you hand over your
credit card.
SPEAKER_01 (00:48):
The takeaway here: if you're signing up for an AI
service, go directly to thesource.
Don't click through from anemail or ad.
SPEAKER_00 (00:56):
Threat actors are operationalizing AI to
accelerate attacks.
We should probablyoperationalize some skepticism.
SPEAKER_01 (01:03):
Speaking of trust, Powbox is now a founding partner
of LegitScript's compliancecollective.
SPEAKER_00 (01:09):
Which is actually a big deal for healthcare
organizations.
SPEAKER_01 (01:12):
Right.
LegitScript certifies healthcarebusinesses in highly regulated
spaces.
The compliance collectiveconnects those certified
organizations with vendors whocan help with ongoing compliance
work.
SPEAKER_00 (01:24):
And Powbox fits naturally there.
You've done the hard work to getcertified.
Now you need tools that don'tundo that work.
SPEAKER_01 (01:31):
Jalen Kuhnz from LegitScript said it well.
Their clients need solutionsdesigned to manage risk, protect
consumers, and build trust.
Secure email is table stakes forthat.
Alright, next up, Shiny Huntersis back.
Ugh, those guys.
Over a hundred organizationshit.
They targeted Oracle'sPeopleSoft software.
(01:53):
Healthcare, higher education,mostly US-based.
SPEAKER_00 (01:57):
68% were higher ed, which tracks universities run
everything forever and patchnothing.
SPEAKER_01 (02:05):
Harsh.
SPEAKER_00 (02:06):
Fair though.
SPEAKER_01 (02:07):
The interesting part, some organizations blocked
the attack.
SPEAKER_00 (02:11):
Which means it was blockable.
This wasn't some zero-day magic.
It was preventable with theright configurations and
monitoring in place.
SPEAKER_01 (02:19):
So, the takeaway, if you're running PeopleSoft, now's
a good time to review yoursecurity posture.
SPEAKER_00 (02:25):
Now was six months ago, but today works too.
SPEAKER_01 (02:28):
Okay, this next one is wild.
Researchers tested AI emailagents, the kind that
automatically process yourinbox, and they fell for
phishing attacks.
SPEAKER_00 (02:39):
Handed over AWS keys, database credentials,
customer records.
SPEAKER_01 (02:44):
Just gave them up.
SPEAKER_00 (02:46):
Yep.
The same social engineeringtricks that work on humans work
on AI agents too.
Turns out, please send me thecredentials is pretty effective
when there's no human in theloop saying, wait, what?
SPEAKER_01 (02:58):
The researchers recommended requiring agents to
verify sender identities beforetaking action.
SPEAKER_00 (03:04):
Which seems obvious, but here we are.
SPEAKER_01 (03:07):
So if you're experimenting with AI agents in
your environment.
Don't give them the keys to thekingdom.
Least privilege, always.
And finally, Novo Nordisk isinvestigating a cyber attack.
Unauthorized access to internalsystems.
Non-public clinical trial datawas copied.
SPEAKER_00 (03:25):
They say no direct identifiers, no names, no
contact details.
SPEAKER_01 (03:30):
But clinical trial data is still sensitive.
SPEAKER_00 (03:33):
Extremely.
Even without names, you cansometimes re-identify people
from medical data.
And the reputational damagealone.
SPEAKER_01 (03:41):
The investigation is ongoing.
We'll keep an eye on it.
As one does.
So stepping back, what's thethread connecting all of this?
SPEAKER_00 (03:50):
It's not bad luck.
It's bad configurations, blindspots, AI tools deployed without
guardrails, legacy systems leftunpatched, users bouncing
through five redirects becausenobody trained them to pause.
And most of it, fixable.
That's the frustrating part.
And the hopeful part, I guess.
SPEAKER_01 (04:09):
Verify your sources, lock down your agents, patch
your systems, and partner withvendors who take compliance as
seriously as you do.
That's the week.
Thanks for listening, everyone.
Stay safe out there.
And maybe don't click that ChatGPT ad.
You're listening to POWBox Weekly Fully Automated.
(00:03):
I'm Jen, Cybersecurity Analyst,Professional Paranoid.
SPEAKER_01 (00:07):
And I'm Alex, healthcare IT guy who still
believes in the good in people.
Mostly.
Brave of you.
So this week, attackers areimpersonating AI platforms:
ChatGPT, Claude, DeepSeek, usingfake versions to steal
credentials and financial data.
SPEAKER_00 (00:24):
Of course they are.
Everyone's rushing to try thenew AI tools, and attackers know
it.
They set up fake payment pages,bounce victims through a CRM, an
Amazon tracking domain, a URLshortener.
SPEAKER_01 (00:37):
That's a lot of hops.
SPEAKER_00 (00:38):
That's the point.
By the time you land on themalicious site, you've got no
idea how you got there.
And the page looks legitimateenough that you hand over your
credit card.
SPEAKER_01 (00:48):
The takeaway here: if you're signing up for an AI
service, go directly to thesource.
Don't click through from anemail or ad.
SPEAKER_00 (00:56):
Threat actors are operationalizing AI to
accelerate attacks.
We should probablyoperationalize some skepticism.
SPEAKER_01 (01:03):
Speaking of trust, Powbox is now a founding partner
of LegitScript's compliancecollective.
SPEAKER_00 (01:09):
Which is actually a big deal for healthcare
organizations.
SPEAKER_01 (01:12):
Right.
LegitScript certifies healthcarebusinesses in highly regulated
spaces.
The compliance collectiveconnects those certified
organizations with vendors whocan help with ongoing compliance
work.
SPEAKER_00 (01:24):
And Powbox fits naturally there.
You've done the hard work to getcertified.
Now you need tools that don'tundo that work.
SPEAKER_01 (01:31):
Jalen Kuhnz from LegitScript said it well.
Their clients need solutionsdesigned to manage risk, protect
consumers, and build trust.
Secure email is table stakes forthat.
Alright, next up, Shiny Huntersis back.
Ugh, those guys.
Over a hundred organizationshit.
They targeted Oracle'sPeopleSoft software.
(01:53):
Healthcare, higher education,mostly US-based.
SPEAKER_00 (01:57):
68% were higher ed, which tracks universities run
everything forever and patchnothing.
SPEAKER_01 (02:05):
Harsh.
SPEAKER_00 (02:06):
Fair though.
SPEAKER_01 (02:07):
The interesting part, some organizations blocked
the attack.
SPEAKER_00 (02:11):
Which means it was blockable.
This wasn't some zero-day magic.
It was preventable with theright configurations and
monitoring in place.
SPEAKER_01 (02:19):
So, the takeaway, if you're running PeopleSoft, now's
a good time to review yoursecurity posture.
SPEAKER_00 (02:25):
Now was six months ago, but today works too.
SPEAKER_01 (02:28):
Okay, this next one is wild.
Researchers tested AI emailagents, the kind that
automatically process yourinbox, and they fell for
phishing attacks.
SPEAKER_00 (02:39):
Handed over AWS keys, database credentials,
customer records.
SPEAKER_01 (02:44):
Just gave them up.
SPEAKER_00 (02:46):
Yep.
The same social engineeringtricks that work on humans work
on AI agents too.
Turns out, please send me thecredentials is pretty effective
when there's no human in theloop saying, wait, what?
SPEAKER_01 (02:58):
The researchers recommended requiring agents to
verify sender identities beforetaking action.
SPEAKER_00 (03:04):
Which seems obvious, but here we are.
SPEAKER_01 (03:07):
So if you're experimenting with AI agents in
your environment.
Don't give them the keys to thekingdom.
Least privilege, always.
And finally, Novo Nordisk isinvestigating a cyber attack.
Unauthorized access to internalsystems.
Non-public clinical trial datawas copied.
SPEAKER_00 (03:25):
They say no direct identifiers, no names, no
contact details.
SPEAKER_01 (03:30):
But clinical trial data is still sensitive.
SPEAKER_00 (03:33):
Extremely.
Even without names, you cansometimes re-identify people
from medical data.
And the reputational damagealone.
SPEAKER_01 (03:41):
The investigation is ongoing.
We'll keep an eye on it.
As one does.
So stepping back, what's thethread connecting all of this?
SPEAKER_00 (03:50):
It's not bad luck.
It's bad configurations, blindspots, AI tools deployed without
guardrails, legacy systems leftunpatched, users bouncing
through five redirects becausenobody trained them to pause.
And most of it, fixable.
That's the frustrating part.
And the hopeful part, I guess.
SPEAKER_01 (04:09):
Verify your sources, lock down your agents, patch
your systems, and partner withvendors who take compliance as
seriously as you do.
That's the week.
Thanks for listening, everyone.
Stay safe out there.
And maybe don't click that ChatGPT ad.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.