Who’s Reading Your ChatGPT Chats? Flock Camera Secrets and HBO’s Reddit Account Spreads Malware

Welcome to The Low Down, the best show on the internet for hackers

Listen on Spotify!
https://go.lowdownpod.com/spotify

The Low Down is presented by Maze.
LinkedIn: https://www.linkedin.com/company/mazehq/
X: https://twitter.com/Maze_Security

Follow Us!
https://www.instagram.com/lowdown.pod

Today we're talking about:

The ChatGPT Group Chat
"I thought me and Sam were homies." Project Lily has us talking about the humans reading ChatGPT conversations, Moxie Marlinspike's take on chat interfaces, and who else is in the room when you're telling a chatbot your problems.
https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/
https://confer.to/blog/2025/12/confessions-to-a-data-lake/

Flock, Meet the Hardware Hackers
Someone pulled down a Flock camera and copied its storage. Ed wants to separate the physical-access findings from the remote-hacking claims. Also, "Flock bad" is apparently a content strategy now.
https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/

Pixel's Very Unhelpful CVE
A modem vulnerability, signs of targeted exploitation, and very few details. Cue a conversation about basebands, spyware, and the price of a good phone exploit.
https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/
https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01

Revolut
"A bank suffered a data breach by not getting hacked." Fake official requests got customer data handed over. Matt gets into the market for stolen government accounts and why a familiar email address isn't enough.
https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/

HBO's Reddit Account
The account was real. Someone else was running the ads. A compromised HBO business account on Reddit becomes a delivery system for a ClickFix malware campaign.
https://www.hudsonrock.com/blog/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation

Cisco Got Owned by an Email
An email security gateway. An email-triggered SQL injection. "The call is coming from inside the house."
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Your MRI Results Are Malware
Iranian operators using fake medical results and personalized messages to deliver CHOSEN BRICK spyware. This one gets uncomfortably specific.
https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists

Passkey-Themed Phishing
That word "themed" is doing a lot of work. We walk through the device-code trick that gets victims to authorize an attacker's access.
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/

Inflatable PLCs
CISA wants critical infrastructure operators thinking about cyber decoys. We're into canary tokens. A full deception operation for an already understaffed team takes a little more convincing. Ed has a business idea.
https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf