OnlyFans Models Are Accidental Blue Team Defenders - 2026-07-13

This week, the team unpacks a wide range of cybersecurity news, including a fraudulent offensive security startup tied to cybercriminals, how leaked OnlyFans content is inadvertently helping defenders identify compromised government websites, and new vishing attacks targeting Microsoft Entra passkey enrollment. They also examine AI prompt injection risks in GitHub workflows, malware campaigns abusing hundreds of GitHub repositories and Go packages, Microsoft's latest identity security developments, and the growing push for online age verification through government-issued IDs and selfies.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-event-chat

Chapters

• (00:00) - PreShow Banter™ — The New Mainframes
• (05:24) - OnlyFans Models are Accidental Blue Team Defenders - 2026-07-13
• (06:23) - Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup
• (15:37) - Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
• (20:37) - Story #3 - Vishing actors target Entra passkey enrollment
• (32:44) - Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
• (46:32) - Story #5 - Network of 200 GitHub Repositories Used for Malware Infection
• (48:13) - Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
• (53:53) - Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie
• (59:39) - Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver's face

Links
Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup
Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
Story #3 - Vishing actors target Entra passkey enrollment
Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
Story #5 - Network of 200 GitHub Repositories Used for Malware Infection
Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie
Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver’s face

Creators & Guests

• John Strand - Host
• Mishaal Khan - Guest
• Ralph May - Host
• Meagan Bentley - Producer
• Bronwen Aker - Host
• Wade Wells - Host
• Doc Blackburn - Guest
• Jake Hildreth - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits 

https://poweredbybhis.com

Brought to you by:

Black Hills Information Security 

https://www.blackhillsinfosec.com

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com

Wild West Hackin Fest

https://wildwesthackinfest.com