Risky Business #816 -- Copilot Actions for Windows is extremely dicey

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Salesforce partner Gainsight has customer data stolen

• Crowdstrike fires insider who gave hackers screenshots of internal systems

• Australian Parliament turns off wifi and bluetooth in fear of of visiting Chinese bigwigs

• Shai-Hulud npm/Github worm is back, and rm -rf’ier than ever

• SEC gives up on Solarwinds lawsuit

• Dog eats cryptographer’s key material

This week’s episode is sponsored by runZero. HD Moore pops in to talk about how they’re integrating runZero with Bloodhound-style graph databases. He also discusses uses for driving runZero’s tools with an AI, plus the complexities of shipping AI when the company has a variety of deployment models.

This episode is also available on Youtube (youtu.be/3YC5aBR-N5o).

Show notes

• Google says hackers stole data from 200 companies following Gainsight breach (techcrunch.com/2025/11/21/google-says-hackers-…)

• Gainsight Status (status.gainsight.com)

• Trust Status (status.salesforce.com/generalmessages/20000233)

• CrowdStrike fires 'suspicious insider' who passed information to hackers (techcrunch.com/2025/11/21/crowdstrike-fires-su…)

• Salesforce cuts off access to third-party app after discovering ‘unusual activity’ (therecord.media/salesforce-cuts-off-access-to-…)

• Атаки разящей панды: APT31 сегодня (ptsecurity.com/research/pt-esc-threat-intellig…)

• Office of Public Affairs | Seven Hackers Associated with Chinese Government Charged with Computer Intrusions (justice.gov/archives/opa/pr/seven-hackers-asso…)

• Australian federal MPs warned to turn off phones when Chinese delegation visits Parliament House (theguardian.com/australia-news/2025/nov/24/aus…)

• Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets (semgrep.dev/blog/2025/digging-for-secrets-sha1…)

• FCC eliminates cybersecurity requirements for telecom companies (cybersecuritydive.com/news/fcc-eliminates-tele…)

• Trade Associations Cybersecurity Practices Ex Parte (fcc.gov/ecfs/document/101663436912/1)

• SEC voluntarily dismisses SolarWinds lawsuit (therecord.media/solawards-lawsuit-dismissed-sec)

• Record-breaking DDoS attack against Microsoft Azure mitigated (cybersecuritydive.com/news/record-ddos-attack-…)

• The Cloudflare Outage May Be a Security Roadmap – Krebs on Security (krebsonsecurity.com/2025/11/the-cloudflare-out…)

• Critics scoff after Microsoft warns AI feature can infect machines and pilfer data (arstechnica.com/security/2025/11/critics-scoff…)

• vx-underground on X: "I've had a surprising amount of people ask me about Copilot" (x.com/vxunderground/status/1992320900444643336)

• Researchers warn command injection flaw in Fortinet FortiWeb is under exploitation (cybersecuritydive.com/news/command-injection-f…)

• Two suspected Scattered Spider hackers plead not guilty over Transport for London cyberattack (therecord.media/transport-for-london-hack-scat…)

• Russia arrests young cybersecurity entrepreneur on treason charges (therecord.media/russia-arrests-tech-entreprene…)

• This campaign aims to tackle persistent security myths in favor of better advice (cyberscoop.com/hacklore-org-cybersecurity-advi…)

• Oops. Cryptographers cancel election results after losing decryption key. (arstechnica.com/security/2025/11/cryptography-…)

• Uncovering network attack paths with runZeroHound (runzero.com/blog/introducing-runzerohound)

• Model Context Protocol (help.runzero.com/docs/mcp)