Iranian Cyberattacks on U.S. Water Systems - 2026-08-03

This episode examines Anthropic’s disclosure that Claude breached real organizations during security testing, along with new technical details about the OpenAI and Hugging Face incident. The discussion covers ExfilSquad’s claimed Microsoft breach, cyberattacks targeting U.S. water systems, and malicious Android TV boxes used for residential proxy networks and advertising fraud. The hosts also explore Google’s Android age-verification plans, Chrome protections against hijacking extensions, Microsoft Teams impersonation attacks deploying Chaos ransomware, and Bank of America’s acquisition of MDSec. Additional topics include the GrapheneOS duress-password court case, a DEF CON prediction market, continued Kali365 phishing activity, and credential-stuffing attacks against Chick-fil-A loyalty accounts.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Zuckers
• (03:43) - Iranian Cyberattacks on U.S. Water Systems - 2026-08-03
• (07:00) - Story # 1: Anthropic’s Claude Breaches Companies During Security Testing
• (11:35) - Story # 2: Hugging Face Publishes Technical Details of the OpenAI Incident
• (13:37) - Story # 3: ExfilSquad Claims a Microsoft Cloud Breach
• (19:34) - Story # 4: Iranian Cyberattacks Target U.S. Water Systems
• (28:27) - Story # 5: Malicious Android TV Boxes Fuel Proxy Networks and Ad Fraud
• (40:51) - Story # 6: Google Introduces Android Age Verification
• (43:26) - Story # 7: Chrome Targets Tab- and Homepage-Hijacking Extensions
• (47:02) - Story # 8: Fake Microsoft Teams Support Calls Deploy Chaos Ransomware
• (48:38) - Story # 9: Bank of America Acquires MDSec
• (51:15) - Story # 10: GrapheneOS Duress Password Wipes Phone During Border Search
• (55:25) - Story # 11: Pony Market Takes Bets on DEF CON and Black Hat
• (58:06) - Story # 12: Kali365 Phishing Platform Remains Active
• (01:02:26) - ChickenSec : Chick-fil-A Loyalty Accounts Hit by Credential Stuffing

Links
Story # 1: Anthropic’s Claude Breaches Companies During Security Testing
Story # 2: Hugging Face Publishes Technical Details of the OpenAI Incident
Story # 3: ExfilSquad Claims a Microsoft Cloud Breach
Story # 4: Iranian Cyberattacks Target U.S. Water Systems
Story # 5: Malicious Android TV Boxes Fuel Proxy Networks and Ad Fraud
Story # 6: Google Introduces Android Age Verification
Story # 7: Chrome Targets Tab- and Homepage-Hijacking Extensions
Story # 8: Fake Microsoft Teams Support Calls Deploy Chaos Ransomware
Story # 9: Bank of America Acquires MDSec
Story # 10: GrapheneOS Duress Password Wipes Phone During Border Search
Story # 11: Pony Market Takes Bets on DEF CON and Black Hat
Story # 12: Kali365 Phishing Platform Remains Active
ChickenSec : Chick-fil-A Loyalty Accounts Hit by Credential Stuffing
Infosec: Age of AI Summit

DEATHcon
- November 13 - 14, 2026
- Univeristy of San Diego
5998 Alcala Park Way
San Diego, California 92110

Creators & Guests

• Ralph May - Host
• Wade Wells - Host
• Bronwen Aker - Host
• Corey Ham - Host
• Nick Ascoli - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits 

https://poweredbybhis.com

Brought to you by:

Black Hills Information Security 

https://www.blackhillsinfosec.com

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com

Wild West Hackin Fest

https://wildwesthackinfest.com