Threat Vector by Palo Alto Networks

The episode contains a few genuinely interesting operational details - VS Code CLI abuse used in the wild before any public reports, and the Contagious Interview TTPs - but is padded with high-level statements and generic advice that any B2B security practitioner would already know. The ratio of novel claims to filler is mediocre.

“when I tried to search about the technique I only found some poc that were published about it like a half year prior. But there were zero reports about the technique being used in an actual meshes operation”

“One of the biggest red flags we see is when an IDE spawns a shell process like a, uh, cmd or a PowerShell”

The VS Code CLI abuse angle and its rapid adoption by multiple threat actor groups is a genuinely fresh data point, but the surrounding framing - attackers hide in legitimate tools, social engineering is the main vector, train your employees - is entirely recycled. The episode never makes a truly contrarian or first-principles argument.

“some IDEs have built in capabilities to control the machine, so the attackers sometimes don't even need to deploy malware”

“if an attacker gets hold on one of these platforms, they can create these automated workflows for all kinds of malicious activities and without needing to deploy any extra malware”

Both guests are real practitioners with relevant hands-on backgrounds - Israeli military intelligence, CyberReason, F5, RSA Security, a patent in fraud detection - who personally uncovered and presented these campaigns at RSAC. They are credible researchers, though not widely recognised names and not senior operators who have run large security organisations at scale.

“Tom has a strong background in cyber threat intelligence, malware analysis and network forensics, with experience spanning both private sector and Israeli military service”

“Daniel brings over a decade of experience in malware research and threat detection with a career that includes senior research roles AT Cyber Reason, F5UM Networks, RSA Security”

The episode names real campaigns (Contagious Interview), a real technique (VS Code CLI abuse), a real target type (Southeast Asian government entity), and a real conference (RSAC), but stops short of providing hard metrics, specific victim organisations, timelines, or technical indicators beyond generic shell-spawning patterns. The evidence base is thin for a 25-minute episode.

“it came from an environment that belonged to a government entity located in Southeast Asia”

“I only found some poc that were published about it like a half year prior. But there were zero reports about the technique being used in an actual meshes operation”

The host asks reasonably structured questions that move the topic forward, but consistently accepts answers without probing or pushing back - responses like 'that's wild' and 'absolutely' dominate. Softballs like asking for 'success stories' and the wrap-up 'number one takeaway' format prevent any productive tension or deeper extraction.

“That's wild. That had to shock you when you saw that in the alert”

“Can you share any success stories where those techniques were detected really early?”