Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
PRG Trojan VARIANT_OF WSNPoem
Secureworks described PRG as a newer, more advanced and effective version of WSNPoem.
Explicit Confidence 98% · Jack Rhysider EP 111 Details
“they called it PRG and had it down as a more advanced and effective version than the WSNPoem malware”
Gameover ZeuS VARIANT_OF ZeuS Version 3
Gameover ZeuS developed from a newer version of ZeuS that added peer-to-peer capability.
Explicit Confidence 96% · Jack Rhysider EP 111 Details
“this would soon develop into a new version of ZeuS which had peer-to-peer capability, and that version was called Gameover ZeuS”
ZeuS Version 3 VARIANT_OF ZeuS V2
ZeuS V2.1 became ZeuS Version 3.
Explicit Confidence 98% · Jack Rhysider EP 111 Details
“On 2011, ZeuS V2.1 became ZeuS Version 3”
NFT phishing AFFECTS MetaMask
NFT phishing is described as tricking a victim into connecting MetaMask and revealing a wallet seed phrase, enabling wallet theft.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“the site said in order to mint the NFT, you just need to connect your MetaMask crypto wallet and enter your twenty-four-word seed phrase”
“this person put their seed phrase into the bogus website, and as soon as they did, the thief got in their crypto wallet”
Roblox botnet AFFECTS Roblox
The Roblox botnet/service is used to create nonexistent players and falsely increase a Roblox game's popularity.
Explicit Confidence 98% · Drew EP 112 Details
“it would use a botnet to do it. It would have players that didn’t exist join the game”
Discord token theft AFFECTS Discord
Discord token theft allows an attacker to log in as a Discord user without their password.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“if you can just take the authentication token, then you can log in as that person without needing a password”
Coinbase balance-disclosure flaw AFFECTS Coinbase
Drew alleges that for about one month Coinbase exposed account balances when a valid username and password were supplied without 2FA; Jack says this may be the flaw reported in connection with drained accounts.
Uncertain Confidence 91% · Drew EP 112 Details
“there was an exploit in Coinbase for about one month where you could check the balance of any valid password and username”
“Bleeping Computer ran an article back in October 2021 saying that 6,000 Coinbase customers had their crypto wallets drained due to a flaw in Coinbase’s 2FA system”
Baby Al Capone ASSOCIATED_WITH SIM swapping
Jack identifies Baby Al Capone as a person who allegedly stole cryptocurrency through SIM-swapping-related activity, while the episode does not provide a fuller identity claim.
Attributed Confidence 88% · Jack Rhysider EP 112 Details
“There’s a guy, goes by the nickname Baby Al Capone; he stole $20 million in cryptocurrency”
“This guy was just fifteen years old when he was arrested”
James O’Connor ASSOCIATED_WITH SIM swapping
Jack says authorities accused James O’Connor, also known as PlugWalkJoe, of stealing cryptocurrency through SIM-swapping.
Attributed Confidence 96% · Jack Rhysider EP 112 Details
“Then there’s PlugWalkJoe, James O’Connor. He was twenty-two, living in the UK, when he was arrested for SIM-swapping”
“Authorities say he stole over $700,000 doing this”
Drew came across OGUsers and became one of its early users.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“he came across a forum called OGUsers”
“I’m the 700th user to make an OGUser account”
Michael Turpin cryptocurrency theft ATTRIBUTED_TO Joel Ortiz
The episode says police evidence led to Joel Ortiz in connection with the cryptocurrency theft and that he was arrested and sentenced.
Attributed Confidence 90% · Jack Rhysider EP 112 Details
“were able to find some pretty solid evidence that led them to a guy named Nicholas Truglia who was twenty-one, living in Manhattan, and Joel Ortiz”
“Joel Ortiz was sentenced to ten years in prison”
Michael Turpin cryptocurrency theft ATTRIBUTED_TO Nicholas Truglia
Police investigation evidence led to Nicholas Truglia, whom Jack later calls the hacker sued by Turpin; the episode presents this attribution through its account of police and court proceedings.
Attributed Confidence 91% · Jack Rhysider EP 112 Details
“were able to find some pretty solid evidence that led them to a guy named Nicholas Truglia”
“Turpin also sued the hacker, Nicholas”
Michael Turpin cryptocurrency theft INVOLVES AT&T
Jack says AT&T insiders helped with the theft of $23 million from Michael Turpin's cryptocurrency wallet.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“In this case, it was insiders working at AT&T that helped do this”
Michael Turpin cryptocurrency theft INVOLVES SIM swapping
The theft of Michael Turpin's cryptocurrency is described as following the SIM-swapping process discussed in the episode.
Derived Confidence 95% · Jack Rhysider EP 112 Details
“someone did the steps you just heard to hack into Turpin’s crypto wallet and steal $23 million worth of crypto out of it”
Coinbase wallet-drain incident INVOLVES Coinbase balance-disclosure flaw
Jack believes the Coinbase wallet-drain reports may refer to the balance-disclosure/2FA flaw described by Drew.
Uncertain Confidence 86% · Jack Rhysider EP 112 Details
“I’m pretty sure it’s talking about this bug that Drew just said”
Remo snatching TARGETS T-Mobile
Remo snatching is described as stealing a T-Mobile store manager's tablet to enable a SIM swap.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you are going to T-Mobile. T-Mobile is the easiest place to hit right now. You go to a T-Mobile, you run in, you take the store manager’s tablet”
Remo snatching USES social engineering
Before stealing the tablet, attackers allegedly social-engineer the store manager to obtain the manager's password.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you need to do recon on the store, figure out everything you can about the manager to try to social-engineer them”
“They send you a fake URL, you enter your manager login”
Combo list USES Credential stuffing
Combo lists are used to test reused username-and-password combinations against many sites.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you could take this combo list and have a tool just automatically try logging into tons of sites”
SIM swapping USES Telegram
SIM-swapping operations are organized through Telegram channels and chats.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“They all get organized inside a Telegram chat room”
“people on Telegram aren’t the type of person to go run into a store”
Sentry NBA USES Combo list
Sentry NBA is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“they use software such as Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
OpenBullet USES Combo list
OpenBullet is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
SIM swapping USES Credential stuffing
Drew describes SIM-swappers using reused credentials from databases to identify and access Coinbase accounts.
Explicit Confidence 97% · Drew EP 112 Details
“They’re using commons from databases, getting into Coinbase – this is all automated – and then they get their balance; they had SIM-swapped them”
Turbo USES Username swapping
Turbo is described as an automated system for claiming a username during username swapping.
Explicit Confidence 99% · Drew EP 112 Details
“an automated system called a swapper or a claimer or a turbo”
“the turbo automatically uses an Instagram endpoint to claim this username”
SilverBullet USES Combo list
SilverBullet is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
Drew says the fake gift-card balance site was a phishing page, and Jack says Drew operated one himself.
Explicit Confidence 99% · Drew EP 112 Details
“It’s a phishing page.”
“He learned how to clone a website which is really easy, and set up his own phishing site”