Hiding in plain sight: Fake GPTs, SMTP malware and NetScaler zero-days
Source: YouTube · IBM Technology · published Oct 8, 2026 · 20:34
In this week's IBM Security Intelligence podcast, new host Patrick Lucas Austin and X-Force experts cover impersonation-based attacks: malicious custom ChatGPT instances, malware disguised as anti-spam software, and mass exploitation of Citrix NetScaler flaws 0:32-1:11.
Key Takeaways:
• Hackers use custom ChatGPT instances with ClickFix-style delivery, exploiting trust in legit-looking GPT URLs 1:36-4:10
• ClickFix works because frustrating CAPTCHAs push users to run malware themselves; awareness lags behind tactics 3:48-7:06
• Rapid7 detailed malware mimicking SpamSniper anti-spam software, copying its IDs and services for trusted, long-term access at the network edge, especially in telco 7:39-8:48
• Detection requires EDR, behavioral analysis, and threat hunting outbound mail traffic (Port 25), since many lack baselines of normal mail flow 9:07-11:01
• Citrix disclosed eight NetScaler flaws (two actively exploited, 9.5/10) with attacks since August—patching isn't enough; hunt for persistence like web shells 13:52-15:45
• Response needs tested playbooks, long log retention, info sharing, and clear chain-of-command, as shown by Dutch hospitals 16:24-20:01
Despite evolving AI-flavored disguises, the core attack chains remain familiar—awareness, baselines, and preparation are the best defenses.
Sources:
- 1:36-4:10 ChatGPT-based ClickFix delivery
- 3:48-7:06 CAPTCHA psychology, lagging awareness
- 7:39-8:48 SpamSniper impersonation malware
- 9:07-11:01 Detection and threat hunting advice
- 13:52-15:45 NetScaler flaws; patching isn't enough
- 16:24-20:01 Playbooks, logging, incident response
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
It appears that hackers are infecting
email applications. Panelists, I have one
very important question for you. Can I use this as an excuse
to not respond to my boss? Respond to your boss. But definitely just take
a little bit of time to it before you do. Only don't respond
if you're really sure it's infected. And you can blame it on that. Otherwise,
maybe still respond. Yeah, absolutely. I just have to wait for the threat actors
to get off the Slack. Hello,
and welcome to Security Intelligence, IBM's weekly cybersecurity podcast,
where our expert panelists turn the biggest industry news stories
into practical takeaways you can use. I'm your new host, Patrick Lucas Austin,
taking over for the great Matt Kozinski, who we wish
the best of luck on this next endeavor. Am I a very advanced dee…