Why phishing still leads ransomware—and what we can actually do about it

What's Up with Tech?

Interested in being a guest? Email us at [email protected]

Phishing didn’t fade—it evolved. We sit down with Trevor Hilligoss, SVP of SpyCloud Labs and former Army CID/FBI cyber agent, to map how identity has become the criminal world’s most tradable commodity, why phishing-as-a-service keeps gaining ground, and how adversary-in-the-middle kits are turning session cookies into skeleton keys. From ransomware’s favorite entry point to the rise of deepfake-enabled voice scams, we unpack what’s changing, what isn’t, and how to actually close the gaps that matter.
Trevor explains what 64 billion recaptured identity records unlock in the fight: faster detection, targeted revocation, and automation that cuts through alert fatigue. We dig into the uncomfortable truth that attackers aggregate your history—password patterns, reused credentials, scattered profiles—and then pivot opportunistically between initial access brokerage, data theft, and extortion. The conversation moves from economics to execution, showing where short-lived sessions, phishing-resistant MFA, and least privilege can limit blast radius, and why unmanaged and undermanaged devices—especially from contractors and vendors—remain a high-leverage weak point for lateral movement.
We also explore a headline story with day-to-day consequences: North Korean IT worker schemes that blend nation-state goals with criminal monetization. When covert contractors show up in malware logs, remediation demands more than a reset; it requires decisive identity and session controls. Looking ahead, we level with you about the odds: permissive jurisdictions and profitable markets favor attackers. The advantage for defenders comes from speed—detect stolen identity artifacts early, revoke access instantly, and practice a response that works under pressure. Subscribe, share with your security team, and leave a review with the one control you’ll implement this week—what’s your first move?

Support the show

More at https://linktr.ee/EvanKirstel

Kapitel

1. Guest Intro & SpyCloud’s Mission (00:00:00)

2. Trevor’s Path: Army, CID, FBI, Cyber (00:01:53)

3. Phishing-as-a-Service & Session Hijacking (00:04:10)

4. Identity Threat Report: Phishing Tops Ransomware (00:06:32)

5. Scale: 64B Records & Automated Remediation (00:07:40)

6. Data Aggregation, Password Patterns, and Risk (00:10:05)

7. Automation Gaps and The Dragon Analogy (00:11:20)

8. Monetizing Stolen Identities & Access Brokers (00:13:15)

9. Unmanaged Devices, Contractors, and Lateral Risk (00:14:58)

10. DPRK IT Workers: Detection and Disruption (00:16:43)

11. What’s Next: Deepfakes, Commoditized Phishing (00:18:34)

12. Practical Defense: MFA, Visibility, Response Plans (00:20:41)

13. Closing Thanks and Resources (00:22:05)