Most security plans are written for the plane crash. A named group, a nation state, a breach with its own logo. Trevor Hilligoss spent his government career on the cases that came in the door instead, and his advice to founders is to plan for the thing that is far more likely to hit them.
“Look, unless you work for an organization that is best known by a three-letter acronym, you don’t need to worry about APT whatever.”
Trevor Hilligoss, at 6:27
Trevor is SpyCloud’s chief intelligence officer. He sets the company’s global intelligence strategy and leads SpyCloud Labs, its research team (SpyCloud). He served in the Army from 2011, first as a forward observer and joint fires observer at Fort Bliss, then from 2015 as a special agent investigating cyber crimes with Army CID, including nearly two years as its liaison to the US Forces Korea Regional Cyber Center. From 2019 to 2022 he served on an FBI cyber task force in Austin, and he joined SpyCloud in August 2022 as an investigator (LinkedIn). SpyCloud’s bio adds that he has given expert testimony before the House Intelligence Committee and is a named participant in Europol’s Operation Endgame.
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security reviews enterprise buyers run, and questions about stolen credentials and sessions come up in almost every one of them. Jon McLachlan and Sasha Sinkevich co-hosted this one. We recorded in the fall of 2025, when Trevor still ran SpyCloud Labs as its senior vice president, and the episode aired on January 13, 2026.
A sociology degree and door number two
Jon opened with Trevor’s résumé, fire support sergeant to cyber, and Trevor filled in the steps. In college he had a vague notion of becoming an FBI agent, and a recruiter at a career fair gave him the bad news about his major.
“And she broke me the very hard news that my sociology degree was essentially bupkis as far as FBI applications are concerned.”
Trevor Hilligoss, at 2:26
The options were to become a cop or become a veteran. He picked the Army and spent years as a forward observer, which taught him one thing about the job market.
“bombs and other things that go boom do not make very transitive skills in the civilian sector.”
Trevor Hilligoss, at 2:48
So he went into federal law enforcement as a special agent with Army CID, worked general crimes for a while, and steered toward cyber because he’d liked building computers and coding as a kid. That brought him to the FBI’s cyber task force, where he finished his government service. His LinkedIn fills in a detail he skipped. In 2013 the 2nd Infantry Division named him its Soldier of the Year.
No undo button
Sasha asked what pulled him into cyber. Trevor’s answer was about timing. Most police work starts after the harm is done.
“Typically, 90% of the time, you’re responding to something that’s already happened, and you do the best you can for the victims, for the witnesses, justice, all of those high-minded ideals.”
Trevor Hilligoss, at 3:56
What drew him to cyber was the chance to act earlier.
“So we can actually impact the crime or the criminal before it actually happens.”
Trevor Hilligoss, at 4:17
There are things you can do in the cyber realm, he said, that don’t really have corollaries in the physical one. Think of a stolen password reset before anyone uses it, or a phishing kit’s servers seized before the next wave of messages goes out. Finding the exposure before the criminal acts on it is the business SpyCloud is in.
Meatbags behind keyboards
Jon added that connecting the work back to people is what makes any company worth building. Trevor agreed, and pushed back on the way the industry talks about itself, all AI security and foreign threat actors.
“We’re all just a bunch of meatbags that are sitting behind keyboards.”
Trevor Hilligoss, at 5:12
He takes that two ways. The first is that threat actors are just people, not the master villains Hollywood makes them. The second, which matters more to him, is the victims. Stopping a ransomware event is fantastic, he said, and so is the smaller win.
“Let’s not minimize the day-to-day good that happens when we prevent an identity theft.”
Trevor Hilligoss, at 5:41
His example was a grandmother who gets a call from someone claiming to be Microsoft Support who wants a Walmart gift card. The scale is different from a company-wide ransomware attack, he said, but it is no less impactful to that individual.
Forget APT whatever
Sasha asked where the biggest risk is today. Trevor warned that the answer would make some people angry, and then gave the line this episode is named for.
“You need to worry about a [19]-year-old dude sitting on a 2006 Acer computer in the basement of his mom’s house in, you know, St. Petersburg, or wherever in the world you want to put that pin, that has all the time in the world, just enough money in their Bitcoin wallet to be dangerous, and just enough skills to be motivated.”
Trevor Hilligoss, at 6:36
He wasn’t saying advanced persistent threats don’t matter. They are a handful of highly targeted groups whose techniques and targets are well known. Against them he set everyone else.
“You have 99 million people on the internet that want to harm people in whatever way.”
Trevor Hilligoss, at 7:21
The public record has a sharp example of how young that crowd can be. Lapsus$, the extortion group that broke into large companies with social engineering, MFA fatigue and SIM swapping, had members arrested in Brazil and the UK in 2022, and City of London Police said at least two of them were teenagers (Wikipedia).
The plane crash and the car crash
Trevor’s comparison is the one founders tend to remember. Most people fear a plane crash more than a car crash, even though the drive to the airport is the dangerous part.
“You are so much more likely to die driving to the airport than you are to have any kind of incident on the actual aircraft in the air.”
Trevor Hilligoss, at 7:57
The named groups get the coverage because they’re large and flashy and fun to talk about. That’s the plane crash, he said.
“What we should really be worried about 99% of the time is the car crash.”
Trevor Hilligoss, at 8:23
Jon put it in a founder’s terms. If you’re running security for a startup or a medium-sized business, it’s all probabilities, and AI lowers the barrier to entry for the people on the wrong side of them.
Everything as a service
Trevor has spent about ten years in this space, and the biggest change he’s seen is that cybercrime became a market with products for sale.
“Pay a dude on the internet 150 bucks in Bitcoin, and you get your own [malware as a service], right?”
Trevor Hilligoss, at 9:03
It comes complete with command-and-control infrastructure and a nicely built panel, he said, and the same is true for phishing and even doxing. The barrier to entry dropped to a little money, a little know-how and the intent. AI lowers it further, because the small amount of code a criminal used to need, a model can now write.
The court records match the price list. Raccoon Infostealer, the case Trevor worked as an agent, was leased to criminals for about $200 a month in cryptocurrency, and they installed it on victims’ computers with ruses like email phishing (Justice Department). RedLine and META, two more infostealers, were sold the same way, under a malware-as-a-service model in which affiliates buy a license and run their own campaigns (Justice Department).
Ignorance is not bliss
Sasha asked what companies should do about the flood. Trevor called it the million-dollar question, the one the vendors at Black Hat are all hoping to answer, and said he doesn’t know of a silver bullet. He does have a starting point.
“Ignorance is not bliss.”
Trevor Hilligoss, at 10:05
“I think we could all kind of agree that, you know, just because you don’t know about something doesn’t mean that something doesn’t know about you and is able to harm you.”
Trevor Hilligoss, at 10:07
If you can see what might happen, who is targeting you or who already has, that is a step in the right direction. As for the vendors who promise that AI will solve the problem, he said, no shade, but he hadn’t seen anything compelling yet.
Between the driver’s seat and the steering wheel
Sasha asked whether the biggest threat is how easy it has become to stage an attack. Trevor’s answer was simpler.
“I think the biggest threat in cybersecurity is the human.”
Trevor Hilligoss, at 10:51
He borrowed an old mechanic’s saying, that 90% of the problems in a car happen between the driver’s seat and the steering wheel, and pointed at Lapsus$ as proof. Its attacks were very low-skill impersonation, the kind of social engineering people try when they first get into pen testing. What made them work was a person on the other end.
“It’s the person that’s going to answer the call. It’s the person that’s going to click on the email or download the file.”
Trevor Hilligoss, at 11:30
He was careful not to blame the victim. The point is where an attacker aims, and the answer is the same every time.
“It’s always going to be the dude behind the keyboard.”
Trevor Hilligoss, at 11:39
Everyone had the same last name
Jon asked how law enforcement shaped his view. Trevor saw both ends of the spectrum. On one end were well-run organizations that had an incident and handled it, with runbooks, expertise and logs. On the other was a case he still remembers.
“I remember one of the cases that I worked was a very, very small company in Texas that got ransomed.”
Trevor Hilligoss, at 12:36
The company was small enough that everyone in it had the same last name, and the sysadmin was the owner’s son. It played a critical role, and it was completely wiped out, because it had no backups. Trevor didn’t claim the view is unique to law enforcement. Incident responders see both extremes too. What it taught him was how much the response decides the damage.
The corners of the internet
Jon asked what SpyCloud’s special place in the market is. Trevor skipped the analyst category.
“So I don’t know the Gartner answer, so I’ll hand-wave over what that is.”
Trevor Hilligoss, at 13:47
What SpyCloud does, in his words, is identity and data. He runs SpyCloud Labs, the research organization inside the company, a team of researchers and engineers who spend their days “digging into all of the corners of the internet that most sane people choose to avoid.” They engage threat actors directly, they work the forums you’ve heard of, and the mission is to collect as much data as they possibly can and then tell a story about it.
The point of all that collection is the step after it. Knowing about a problem doesn’t fix it, he said, but it’s the only way anyone gets the chance.
“But if you do, it’s like a ship with holes in it. If you don’t patch those holes, eventually you’re gonna sink. But you gotta know where those holes are.”
Trevor Hilligoss, at 14:48
So the lab works on two things. One is making sense of the identity data and validating that it’s legitimate. The other is getting it to the people who need it most, in time for them to fix the problem before a criminal uses the data.
Operation Magnus and after
Jon asked for the soundbites from SpyCloud’s research that year, its identity exposure report among them. Trevor gave two. The first was mixed news.
“One is that commodity malware is still a huge problem.”
Trevor Hilligoss, at 15:36
He credited US and European law enforcement with fantastic work against commodity malware families like RedLine. Operation Magnus, which he said the Dutch led with the FBI and a bunch of other agencies, took RedLine and META Stealer, essentially a fork of RedLine, out of the equation.
“And with very limited exceptions, those basically turned off overnight.”
Trevor Hilligoss, at 16:06
The record matches his account. The Dutch National Police and their partners disrupted RedLine and META on October 28, 2024 (Operation Magnus). The next day the Justice Department said the FBI, the Naval Criminal Investigative Service, IRS Criminal Investigation, the Defense Criminal Investigative Service and Army CID, Trevor’s old agency, had joined the action to seize domains, servers and Telegram accounts used by the administrators. Its description of the business is the commodity market from earlier on this page: a decentralized malware-as-a-service model in which affiliates buy a license, spread by malvertising, email phishing and fraudulent software downloads (Justice Department).
“Unfortunately, that has not fixed the problem.”
Trevor Hilligoss, at 16:10
“There are still a lot of these commodity malware families out there, LummaC2 being kind of the biggest, baddest right now, that are highly accessible, that are very successful at getting into a system and exfiltrating data, and are used incredibly widely.”
Trevor Hilligoss, at 16:13
LummaC2 had already been hit once by the time we recorded. In May 2025 the Justice Department seized five domains that served as login pages for its user panels, while Microsoft filed a civil action against 2,300 more. An FBI assistant director called it “the most popular infostealer service available in online criminal markets,” and the FBI had identified at least 1.7 million instances of it being used to steal information (Justice Department). Months later Trevor still called it the biggest, the good and bad he described in a single malware family.
Phishing never left
His second takeaway surprised him.
“The second thing that I would take away was a huge surprise to me, and maybe I’m admitting something I shouldn’t be, that I was surprised at this, but, like, phishing is still a huge problem.”
Trevor Hilligoss, at 16:41
He remembers phishing messages on AIM in the early 2000s, maybe into the ’90s, and he still sees mature cybersecurity organizations hit by phishing emails, by smishing and by the toll violation text scam. So much of it has become a commodity that attempts exploded, “which then has had the predictable outcome that there has been more successes.”
Jon said someone had tried to phish him not too long before.
SpyCloud’s next annual report, in March 2026, put numbers on the surprise. It recaptured 28.6 million phished identities, nearly half of them corporate users, said successful phishing attacks had surged 400% year over year, and found that the workforce was three times more likely to be targeted with phishing than with infostealer malware (SpyCloud).
The cookie walks out
Why phishing keeps paying is the most technical stretch of the episode. The kits got good.
“Yeah, one of the crazy things about these phishing kits these days is just how, I mean, technically advanced they’ve gotten, right?”
Trevor Hilligoss, at 17:34
An adversary-in-the-middle kit sits between you and the real site. You log in to the real thing, with your real password and your real MFA, and the kit passes it all through. When the site sends back the cookie that marks you as signed in, the kit keeps a copy.
“And then as that comes back to you, it’s pulling that cookie out. So you’ve effectively bypassed whatever MFA is on that account.”
Trevor Hilligoss, at 17:53
The cookie is what the site checks on every request after the login, so whoever holds it is signed in as you. And nobody has to build the kit.
“It’s a payment to a guy on Telegram.”
Trevor Hilligoss, at 18:16
The fix for this kit is a credential that won’t sign for the wrong site. A passkey or a security key is bound to the origin the browser is actually talking to, so a relay on a look-alike domain has nothing it can use. We wrote up why passwords still get stolen and how device-bound credentials close that door. Trevor’s own reading list shows the attackers adjusting. In June 2026 he shared Netcraft’s writeup of BlueKit, a phishing kit sold as a service that puts the victim in a browser the attacker controls.
Origin binding defeats AiTM but device code grants, and now BiTM, change that equation.
Trevor Hilligoss · June 29, 2026
What’s your TAM?
Jon put the founder’s question. If I’m the chief executive of a startup, or of a Fortune 500 company, how do I turn this research into something actionable? Trevor’s answer was a question every founder has already answered once.
“I think it has to start with data, right?”
Trevor Hilligoss, at 18:40
Before a company takes a product to market, the first question is the total addressable market, and nobody answers it from instinct. Services sell financial data, and companies buy it and use it to decide. Trevor said the same discipline carries over.
“They’re directly applicable to cybersecurity and cyber risk.”
Trevor Hilligoss, at 19:06
Without the data, he said, you’re effectively rolling the dice.
“Maybe they’re loaded dice, because you’re especially experienced, or you know more than the average consumer, but they’re still, at the end of the day, they’re still dice.”
Trevor Hilligoss, at 19:36
“And you might get lucky, or you might roll snake eyes.”
Trevor Hilligoss, at 19:44
His advice to founders, and to anyone in a decision-making role, was to find the best, most accurate, most verbose source of data you can, “so that you’re not gambling on the security of your company.” The scorecard further down asks the eight questions that tell you which dice you’re holding.
One gap in the armor
Jon reframed it. Founders are in the business of taking risks and moving toward threats rather than away from them, but they do it with the gear and the armor. Trevor took the armor and ran with it.
“Yeah. I really like that you said that, because it’s like a medieval knight in their suit of armor, right?”
Trevor Hilligoss, at 20:26
“The challenge is that, as an adversary, you only have to find one.”
Trevor Hilligoss, at 20:43
“But as a defender, as the knight, we have to make sure that there are no gaps in that armor.”
Trevor Hilligoss, at 20:54
The odds are stacked against the defender, he said, and the best hope of evening them is visibility and information. It’s the ship with holes again. You can’t close a gap in the armor you don’t know is there.
Punched in the face
Jon took the data to the boardroom. If we allocate this much spend to these risks, here’s how our risk changes as we grow into a bigger target, because hackers run a business too and a juicier target is a bigger payoff. Trevor agreed, added that the class of adversary changes with the size of the company, and then set expectations.
“I’ll say it at the outset: like, everybody’s going to get punched in the face at least once.”
Trevor Hilligoss, at 22:01
You can have all the data, plan for the worst case and do everything right, and chances are you’ll still fail at some point. What comes next has two parts. How serious was the punch, meaning how long are you down, and what decisions do you make next?
“Both of those things, I would argue, are just as important as what you do beforehand.”
Trevor Hilligoss, at 22:20
That’s the lesson of the two companies from his law enforcement years in Everyone had the same last name. Both were hit. The runbooks, the logs and the backups decided what happened next. His second recommendation was about the model behind the plan.
“you should totally have a re-evaluation schedule, where you’re constantly going back to that model that you built, and you’re challenging that model and saying, do we need to worry about that next tier?”
Trevor Hilligoss, at 22:44
The question to ask at each review is whether you’ve reached the level where targeted campaigns show up, or whether you’re still facing the to-whom-it-may-concern attacks that hit everyone. The answer should change your threat model over time.
The cost center argues for itself
Sasha asked how you get a founder or an executive to do these evaluations at all, when security is so often seen as the overhead that slows down innovation and growth. Trevor started with the label.
“Yeah, I mean, we’re the cost center, right?”
Trevor Hilligoss, at 23:29
“It’s like you have to argue for yourself, and you have to argue for the company, and you need to frame that in the way that it’s going to be received.”
Trevor Hilligoss, at 23:37
Sometimes the frame that lands is financial. Sometimes it’s reputational, and for a cybersecurity company the reputational harm may be even bigger. He apologized for giving the political answer, but it really depends on who you’re speaking to, what they’ll be receptive to and what the company stands for. Jon put it in one line.
“If you want the business to do something, you have to make a business argument for it to do something.”
Jon McLachlan, at 24:21
“Exactly,” said Trevor. For a startup the argument usually writes itself in the sales cycle, since the enterprise buyer’s security review is a business requirement with a revenue number attached.
The letter nobody credits
Sasha raised an idea that falls in and out of fashion, the CIA triad of confidentiality, integrity and availability (Wikipedia). The third letter sounds like an operations problem, and it’s the one customers feel first.
“One specific example is CIA triad, and the last letter of that, CIA, has nothing to do with security per se, but it’s the availability of the product.”
Sasha Sinkevich, at 24:38
A service that can’t keep its customers’ data confidential, intact and available, Sasha argued, isn’t really serving them in the first place. Trevor agreed that availability speaks to both of his frames.
“That could be, at its core, a reputational harm. It could be, at its core, a financial harm, or it could be both.”
Trevor Hilligoss, at 25:04
“And that calculus, that’s a sliding scale, and I think everybody needs to figure out where they exist on that scale individually.”
Trevor Hilligoss, at 25:10
Ransomware is the clearest case of an attack on availability, and the family company in Texas lost all of it.
Forum Wars
Jon asked how a security team gets its hands on the data to build the business case. Trevor pointed to SpyCloud’s monthly newsletter, which he reposts on LinkedIn and which lives on spycloud.com. It’s hyper-focused on cybercrime rather than nation-state actors, and it had a recurring segment the lab calls Forum Wars.
“BreachForums went down, and then it was like, oh, who’s going to be the next? Is it going to be DarkForums? Is it going to be BreachForums v97, or whatever number we’re at now?”
Trevor Hilligoss, at 26:18
The public record explains the joke. BreachForums launched in March 2022 as a successor to RaidForums, which had been seized, and its founder was 19 when he started it. The FBI seized it in May 2024 and it came back within weeks. Its administrators took it offline in April 2025, citing an alleged zero-day in the MyBB forum software. That June, French police arrested four suspected administrators, all reported to be in their twenties, and after a July relaunch the site went offline again in August (Wikipedia). Trevor’s 19-year-old from Forget APT whatever isn’t a figure of speech.
The newsletter doesn’t pick winners, and that’s on purpose.
“And our philosophy is we try not to draw conclusions.”
Trevor Hilligoss, at 26:30
“We are not ultimately the arbiters of truth when it comes to what is the most dangerous thing out there.”
Trevor Hilligoss, at 26:33
He has his own opinions, he said, and they aren’t always right. So the lab puts out the data it has and lets readers draw their own conclusions.
Climbing the ladder
Jon asked where the data comes from. Is it scraped from the dark web and Tor services, or do subscribers submit it? Trevor said he had to keep the answer general, then gave a picture of it.
“If you think about cybercrime as a ladder, and the higher you get on the ladder, the closer to the source, you know, we want to climb that ladder.”
Trevor Hilligoss, at 27:25
“So we go to where the threat actors are, we talk to those threat actors, we build relationships with those threat actors, and we use some cool, sparkly human intelligence and social engineering techniques that everybody that was in government service likes to talk about.”
Trevor Hilligoss, at 27:30
Scraping is part of it too. Everybody scrapes data, he said, and it’s the easiest thing in the world.
“But if you’re just scraping data, you’re seeing what is effectively the surface.”
Trevor Hilligoss, at 27:51
Data takes weeks to reach the surface, if it gets there at all. By then it has probably been adulterated, and the chain of custody is broken. For a company on the receiving end, that delay is the whole story. A stolen password or session that surfaces weeks after the theft has already had weeks of use, and the closer to the source the warning comes from, the more time you have to reset it or end it first.
The insider at the bank
Sasha pointed at a whole sector of the economy that isn’t tech but still lives online, often with some compliance knowledge nearby and no dedicated security team, and asked where attacks succeed most. Trevor started by questioning the line between the two.
“I mean, everything’s a tech company now, right?”
Trevor Hilligoss, at 28:52
Everybody’s got to have an app and a web portal, so in a way everyone is in that space. The threats still differ by industry. For a financial services company, one of the big ones is the insider.
“What if I hire somebody, maybe a teller, or maybe an insurance adjuster, or a broker, or something like that, and whether they’re witting or unwitting, they are exploitable by an adversary, by a criminal?”
Trevor Hilligoss, at 29:11
In that case the criminal is typically after money. In defense the insider problem stays, but the target may shift to intellectual property. And over all of it sits what he called the big umbrella.
“And everybody’s vulnerable to, again, the human element.”
Trevor Hilligoss, at 29:41
Nobody targeted you
Infostealers are, in his words, kind of a passion of his, and the most important thing he said about them is that they’re almost never aimed at anyone.
“When we look at infostealers, which is kind of a passion of mine, almost all of those are not a targeted attack.”
Trevor Hilligoss, at 29:44
Targeted infections happen, he said. They just aren’t the common case.
“by far and away, the most common way that infostealer infections occur is because you were in the wrong place at the wrong time.”
Trevor Hilligoss, at 30:00
“You clicked on the wrong ad. You downloaded the wrong Fortnite skin. You followed that link from that YouTube video, which led you to the bad place.”
Trevor Hilligoss, at 30:07
“And it might not even be you. It might be your kid, or your spouse, or it might be on your personal computer.”
Trevor Hilligoss, at 30:15
That’s why the attack surface is so broad. Infections are pervasive and frequent, and the haul is robust. A modern stealer takes the form data your browser helpfully caches, your saved credit cards and saved passwords, and your cookies, “which, anybody has heard of session bypass or session hijacking? Not a great thing.” Some take files too.
“Oh, I wonder what’s in passwords.csv that was saved on your desktop.”
Trevor Hilligoss, at 30:55
The Justice Department’s description of RedLine and META reads the same way. It says the malware steals usernames and passwords, and that stolen authentication cookies can let criminals bypass multi-factor authentication (Justice Department). That’s the cookie from The cookie walks out, taken from the laptop instead of from the login.
“It doesn’t really matter what vertical you’re in or what you do.”
Trevor Hilligoss, at 31:02
He called it a to-whom-it-may-concern attack with a very long tail, because digital exhaust is pretty big and hard to get rid of. For a startup, the takeaway is that the laptop that exposes you may be one you don’t manage, used by someone nobody targeted. A password reset doesn’t end a session a stealer already copied, and the calculator below counts how many can outlive one.
Check your exposure
Jon asked what the options are for a consumer, since everyone has some kind of digital footprint. Trevor started with his own company’s tool.
“If you go to checkyourexposure.com, it’s available for anybody. It’s free.”
Trevor Hilligoss, at 31:23
“You can enter your email, and it’ll tell you where you show up, whether you’re in malware or something else.”
Trevor Hilligoss, at 31:28
The address forwards to SpyCloud’s personal data exposure check, which reports malware infections, phishing and breaches tied to an email address (SpyCloud). He also pointed out that law enforcement agencies like putting up portals, and that he built one.
“Actually, years ago, I was the case agent for the Raccoon Infostealer case, and we put up a little portal.”
Trevor Hilligoss, at 31:36
The Justice Department’s 2022 announcement of the Raccoon case said the FBI had identified more than 50 million unique credentials and forms of identification, including over four million email addresses, and pointed to a website, raccoon.ic3.gov, where anyone could check whether an address was in the data (Justice Department). Trevor thought it was still up. When we checked in November 2026, the address no longer resolved, so use a current service instead.
His real ask was about which address you check.
“I would recommend doing it for your personal emails.”
Trevor Hilligoss, at 31:53
“There’s a lot of hooks that kind of come into our lives from our enterprise environment down into our personal.”
Trevor Hilligoss, at 32:01
“And so just because it’s a personal email doesn’t mean it’s not a serious exposure and something that you should absolutely remediate.”
Trevor Hilligoss, at 32:06
A benefit for employees
Sasha asked whether companies offer services like SpyCloud as an employee benefit, since people are already bombarded with offers “to buy a car, a boat, ticket to the SpaceX to orbit around Mars,” and a person who becomes a target has much more information out there. Trevor had a nominee for the most common offer.
“Yeah. Yeah. Mortgage refinance. That’s the one that always shows up in my email.”
Trevor Hilligoss, at 32:51
Some SpyCloud customers do offer it to their employees, he said, and if your company doesn’t, free resources exist.
“I really would encourage everyone to go out there and just check your personal exposure, see what it looks like, see what the bad guys might have about you, might know about you.”
Trevor Hilligoss, at 33:16
For an employer the logic is the one from Nobody targeted you. The family computer that holds an employee’s work sessions is part of the company’s attack surface, whether or not the company ever sees it.
The domain report
Jon asked about the business version. Could a security leader check every employee, every contractor, the whole organization at once?
“So you can still do that at checkyourexposure.com. It’s not limited to just free emails.”
Trevor Hilligoss, at 34:05
You get a different report, and fair warning came with it.
“And I can’t promise you won’t get a nice little marketing email from SpyCloud after you do that. In fact, I can promise you will.”
Trevor Hilligoss, at 34:11
The report is usually domain-based, he said, which can be a challenge for companies that use a different domain for email than for their website, a practice he wishes more companies followed. He didn’t say why on the tape. The practical point for a startup is to run the check on the domain your people actually sign in with. He also recommended the competition.
“So, you know, compare different resources, see what works best for you, pick whichever one that’s right for you.”
Trevor Hilligoss, at 34:41
Job security is part of security
Sasha asked for a prediction. What will the cyber threat surface look like in a year?
“I mean, it’s going to continue, right?”
Trevor Hilligoss, at 35:06
“Like, I think we kind of say this tongue-in-cheek in the security industry, that job security is part of security, because people are still going to be making mistakes.”
Trevor Hilligoss, at 35:08
Criminals will still have all of the motivation in the world and very few downsides. He expected the commodification of cybercrime to keep going, from malware and phishing to access and “anything as a service,” with new malware families, new phishing kits and new means of exploitation, all for sale. AI in the mix was the unknown.
“I don’t really know what that’s going to mean long term, but it’s probably not going to mean anything good.”
Trevor Hilligoss, at 35:49
He reserved the right to change his answer in six months. A year later the as-a-service half of the forecast holds up. The platform Microsoft and its partners disrupted in September 2026 was, in Trevor’s words, phishing-as-a-service, and BlueKit was sold the same way. You can read both in What happened after the tape.
Insider threat as a service
Jon asked whether there’s such a thing as insider threat as a service. Trevor didn’t hesitate.
“I know there is. Yeah. Especially within financial services companies, banks, especially.”
Trevor Hilligoss, at 36:16
He wouldn’t name any banks, but the posts follow a pattern he sees pretty regularly, and he gave the gist of one.
“I work at this bank, and I have access to these things, and I’m seeking an aged account that’s interested in moving $10,000 to $50,000.”
Trevor Hilligoss, at 36:29
That’s a very common thing to see on Telegram or on a forum, he said. Maybe it isn’t the full as-a-service model, and nobody is fully autonomous at that point, “but it’s that easy.” This is the exchange the episode’s YouTube title is built on.
The defense for a company that isn’t a bank is the same idea. Limit what any one person can reach to what the job needs, review it, and watch for access that doesn’t fit, so one insider, witting or unwitting, can only sell a small slice. Our blast radius playbook covers the controls, and our counter business espionage team builds insider-risk programs.
Reading Telegram at scale
Jon asked how SpyCloud finds posts like that. Is it watching Telegram and every other platform where they’re announced?
“Yeah, we do. Telegram’s a big part of that. We’ve begun leveraging LLMs a lot to do that.”
Trevor Hilligoss, at 36:57
“The volume is just too much. You’d employ a team of hundreds of researchers, and you’d still miss things.”
Trevor Hilligoss, at 37:02
For all the buzzwords around AI, he said, one thing it does really well is “condensing and summarizing user-generated content, human text.” That lets the team build a profile of a threat actor or a technique and look for where it shows up across a broad swath of data. The other half is still a person.
“Human being reading through a channel and saying, whoop, that looks like something that’s illegal, let me flag that.”
Trevor Hilligoss, at 37:28
It’s a good division of labor for any security team. Let the models read the volume and surface what matters, and keep people on the calls that take judgment.
What happened after the tape
In January 2026, the month the episode aired, Trevor became SpyCloud’s chief intelligence officer (LinkedIn). In March, SpyCloud’s 2026 Identity Exposure Report counted 65.7 billion distinct identity records in its recaptured data, up 23% in a year, along with 8.6 billion stolen cookies and session artifacts, 13.2 million infostealer infections, 18.1 million exposed API keys and tokens, and 6.2 million credentials or authentication cookies tied to AI tools (SpyCloud). The session cookies are the car crash from Nobody targeted you, counted.
The takedowns kept coming too. On June 24, 2026, Europol’s Operation Endgame went after the SocGholish, Amadey and StealC malware networks. The operation’s release counts 326 servers and 142 domains actioned, 27 million stolen login credentials recovered and more than 41 million euros in crypto assets restricted, and SpyCloud is among the partners it lists (Operation Endgame). Two weeks later Trevor posted what it did to StealC.
Every one of these takedowns is worth doing, and once in a while the numbers show it this cleanly.
Trevor Hilligoss · July 9, 2026
That’s the good half of the good and bad from Operation Magnus and after. In September, SpyCloud’s data went into a takedown of the phishing kind.
Today Microsoft's Digital Crimes Unit, Health-ISAC and a group of partners disrupted EvilTokens, a phishing-as-a-service platform that's been compromising Microsoft accounts since February.
Trevor Hilligoss · September 22, 2026
In October, on SpyCloud’s YouTube channel, Trevor and Aurora Johnson walked through the next generation of the kits from The cookie walks out, device code phishing and browser-in-the-middle attacks. In device code phishing, the attacker starts a real sign-in for its own device and gets the victim to approve it on the real sign-in page, so the victim’s MFA works exactly as designed and the access goes to the attacker anyway.
The thesis from the tape held up. The losses that reach most companies still come from commodity tools bought cheaply and pointed at everyone, and the thing they steal is increasingly the session rather than the password. For more from SpyCloud on this show, Damon Fleury, its chief product officer, joined us on episode 60 to talk about the darknet. On episode 78, Deepak Dutt made the case for checking who’s behind a session after the login, which is the answer to a stolen cookie.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Trevor, Jon and Sasha actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
What did an FBI recruiter tell Trevor about his sociology degree?
- It was ideal for the FBI
- It was essentially bupkis for FBI applications
- He should add a law degree
b. "And she broke me the very hard news that my sociology degree was essentially bupkis as far as FBI applications are concerned." Transcript, 2:26.
-
Who does Trevor say most companies should worry about, instead of advanced persistent threats?
- A rival nation's intelligence service
- Their own security vendors
- A young criminal with all the time in the world
c. "that has all the time in the world, just enough money in their Bitcoin wallet to be dangerous, and just enough skills to be motivated." Transcript, 6:48.
-
In Trevor's comparison, what is the plane crash?
- The large, named groups that get the media attention
- A ransomware attack on a small company
- A phishing email
a. "Realistically speaking, that's the plane crash." Transcript, 8:20.
-
What does Trevor say it costs to get your own malware, complete with a panel?
- About 150 bucks in Bitcoin
- About $15,000
- Nothing, it's open source
a. "Pay a dude on the internet 150 bucks in Bitcoin" Transcript, 9:03.
-
How does an adversary-in-the-middle phishing kit get past MFA?
- It guesses the one-time code
- It keeps the authentication cookie from a real login
- It calls the help desk
b. "And then as that comes back to you, it's pulling that cookie out." Transcript, 17:53.
-
What's the most common way infostealer infections happen, according to Trevor?
- A targeted lure built for one person
- Being in the wrong place at the wrong time
- A zero-day in the operating system
b. "the most common way that infostealer infections occur is because you were in the wrong place at the wrong time." Transcript, 30:01.
Are you rolling the dice?
Trevor’s test for a security decision is whether it rests on data or on luck. This scorecard asks eight questions about stolen sessions, from MFA to the family computer to the restore nobody has timed. It takes about two minutes.
Scorecard · eight questions
Are you rolling the dice?
Answer for the people and devices that sign in to your company's apps, contractors included. If two answers fit, pick the lower one.
-
When a stealer infects a laptop that's signed in to company apps, what do you do?
- Reset the person's password
- Reset the password and wipe the laptop
- Wipe it, reset the password and end every active session in each app the person used
"it pulls your cookies, which, anybody has heard of session bypass or session hijacking? Not a great thing." See Nobody targeted you.
-
What kind of MFA protects email, single sign-on and admin panels?
- None, or text message codes for some
- Codes from an app, or push approvals
- Passkeys or security keys, for everyone
"So you've effectively bypassed whatever MFA is on that account." See The cookie walks out.
-
Would you know if a company password or session showed up in a breach, a phishing haul or a stealer log?
- Only if someone told us
- We check now and then
- We monitor continuously and act on each finding
"Ignorance is not bliss." See Ignorance is not bliss.
-
Can company apps be used from personal or family computers?
- Yes, from anywhere
- Some apps require a managed device
- Company apps require a managed device, and sessions are tied to it
"It might be your kid, or your spouse, or it might be on your personal computer." See Nobody targeted you.
-
When did you last revisit your threat model?
- We don't have one
- When we wrote it
- On a schedule, and after every big change in size, customers or funding
"you should totally have a re-evaluation schedule" See Punched in the face.
-
If ransomware hit tomorrow, how long would you be down?
- We don't know
- We have backups but haven't tested a restore
- We've restored from offline backups and know how long it takes
"how serious was that punch? You know, how long are you down?" See Everyone had the same last name.
-
Do you check exposure for your people's personal email addresses, starting with admins?
- No
- When someone asks
- Yes, at onboarding and on a schedule, or as an employee benefit
"I would recommend doing it for your personal emails." See Check your exposure.
-
What can one person in a sensitive role reach on their own?
- More than their job needs
- What their job needs, reviewed once a year
- Only what their job needs, with alerts on unusual access
"I work at this bank, and I have access to these things" See Insider threat as a service.
Most of what protects you today is luck. Start with the two fixes that close the most doors for the least effort: passkeys or security keys on email and single sign-on, and a rule that a stealer infection means ending every session, not just resetting the password.
Experience is doing some of the work. Close the gaps Trevor's stories point at next: personal and family computers that hold work sessions, a threat model nobody has reopened, and a restore nobody has timed.
You decide from data rather than instinct. Keep it that way as you grow, and reopen the threat model when the company gets bigger, because the class of adversary changes with it.
How many sessions outlive the reset?
A stealer takes the cookies for every app its victim was signed in to, and resetting a password doesn’t always end the sessions those cookies belong to. Put in your own numbers to see how many could still work after the resets.
Calculator
How many sessions outlive the reset?
Three estimates: how many browsers a stealer got into, how many company apps each was signed in to, and the share of those apps where a password reset also ends the sessions that already exist.
That's about 90 sessions to end across the infected browsers, one for each app someone was signed in to. Resetting passwords alone would leave about 54 of them working, 18 per browser. Ending the sessions in each app, not just the password, is the step that closes them.
40% is a placeholder, not a measurement. Check each app you use: some end every session when a password changes, and others keep existing sessions until they expire or someone revokes them.
From Fort Bliss to SpyCloud Labs
Everything on this page sits on one timeline, from Trevor’s first Army post to the takedowns of 2026. Filter it by thread.
Timeline · 2011 to 2026
From Fort Bliss to SpyCloud Labs
Filter by thread. Dates are from the public record except where marked as part of this show.
- Forward observer
Trevor joins the Army as a forward observer and joint fires observer at Fort Bliss, later a staff sergeant (LinkedIn).
- Army CID
Special agent investigating cyber crimes, based in Austin (LinkedIn).
- Korea
Liaison to the US Forces Korea Regional Cyber Center in Daegu, until February 2020 (LinkedIn).
- FBI cyber task force
Special agent on an FBI cyber task force in Austin, where he finished his government service (LinkedIn).
- Raccoon dismantled
The FBI and partners in Italy and the Netherlands dismantle the infrastructure behind the Raccoon Infostealer, Trevor's case (Justice Department).
- BreachForums opens
A successor to the seized RaidForums, started by a 19-year-old (Wikipedia).
- Lapsus$ arrests
Members of the social engineering crew are arrested in Brazil and the UK, and City of London Police say at least two are teenagers (Wikipedia).
- SpyCloud
Trevor joins as a senior investigator, and moves into security research in January 2023 (LinkedIn).
- The Raccoon portal
The indictment is unsealed, with more than 50 million stolen credentials and identifiers and a site, raccoon.ic3.gov, for checking an email address (Justice Department).
- SpyCloud Labs
Trevor becomes vice president of SpyCloud Labs (LinkedIn).
- BreachForums seized
The FBI takes the site, its onion service and a Telegram channel, and it returns within weeks (Wikipedia).
- Operation Magnus
The Dutch National Police and partners disrupt RedLine and META, with the FBI, Army CID and other US agencies (Justice Department).
- Senior vice president
Trevor leads SpyCloud Labs as senior vice president (LinkedIn).
- Episode 60
SpyCloud's chief product officer, Damon Fleury, on navigating the darknet (episode 60).
- BreachForums goes dark
Its administrators take it offline citing an alleged MyBB zero-day, and in June French police arrest four suspected administrators (Wikipedia).
- LummaC2's domains
The Justice Department seizes five domains behind LummaC2's user panels, as Microsoft goes after 2,300 more (Justice Department).
- We record episode 86
"What we should really be worried about 99% of the time is the car crash." (Transcript).
- Chief intelligence officer
Trevor sets SpyCloud's global intelligence strategy and keeps leading SpyCloud Labs (SpyCloud).
- Episode 86 airs
On Podbean, Apple Podcasts and Spotify (Apple Podcasts).
- 8.6 billion stolen cookies
SpyCloud's 2026 Identity Exposure Report, with 28.6 million phished identities and successful phishing up 400% (SpyCloud).
- Operation Endgame
A strike on SocGholish, Amadey and StealC, with 27 million stolen credentials recovered and SpyCloud among the partners (Operation Endgame).
- BlueKit
Trevor on browser-in-the-middle phishing kits and the limits of origin binding (LinkedIn).
- StealC down 58%
New infections fall from an average of 389 victims a day to 162 after the takedown (LinkedIn).
- On YouTube
Episode 86 goes up as a video with chapters (YouTube).
- EvilTokens disrupted
Microsoft's Digital Crimes Unit, Health-ISAC and partners take down a phishing-as-a-service platform, with SpyCloud data on more than 8,700 accounts (LinkedIn).
- Past MFA, again
Trevor and Aurora Johnson on device code phishing and browser-in-the-middle attacks (YouTube).
What to do this week
Five things, in the order Trevor’s argument suggests.
- Put passkeys where they count. Email, single sign-on, the code host and every admin panel. A passkey or security key won’t sign for a look-alike site, which takes the adversary-in-the-middle kit out of the picture. Our guide to device-bound credentials has a rollout plan, and the scorecard above is a quick first pass.
- Write the stealer runbook. When a stealer hits a laptop signed in to company apps, wipe it, reset the passwords and end every active session in each app. The calculator shows why the last step matters.
- Check your exposure, then your admins’ personal addresses. Run your company’s email domain through a free exposure check such as checkyourexposure.com, and ask the people with admin rights to check their personal email too.
- Put a date on the threat model. Book a review every quarter, or after any big change in size, customers or funding, and ask Trevor’s question. Are targeted campaigns showing up yet, or is it still the to-whom-it-may-concern attacks?
- Time a restore. Restore something real from an offline backup and write down how long it took. If you’d like help watching for stolen credentials and sessions, or testing your defenses the way an attacker would, our monitoring and response and penetration testing teams do this work every week, and you can book 15 minutes with us.