The Economy for Phish
mnemonic security podcast
08/18/25
•50m
About
Comments
Featured In
This episode, we’re joined by Ford Merrill, Senior Director of Research and Innovation at SEC Alliance, to discuss the evolution and sophistication of Phishing as a Service (PhaaS).
Merrill shares from his 11 years of experience working on security research in primarily the areas of phishing and DDoS botnets. In the episode, he talks about the shift from Russian to Chinese-speaking operators, who the developers of advanced kits like Darcula and Lighthouse are, and who actually uses them to impersonate brands for financial gain.
Merrill also outlines a complex ecosystem with supporting technologies and roles involving spammers, data brokers, and money launderers. He also shares what thinks needs to be done to respond this problem, and where he sees rays of hope already.
Related resources:
If you haven’t listened to our series on Darcula, a phishing-as-a-service operation targeting victims globally, check out episode 137 and 138 to hear Robby’s interview with mnemonic's security researchers Erlend Leiknes and Harrison Sand about the findings from their technical investigation into the phishing kit platform Magic Cat. And hear how this story progressed as Robby interviews investigative journalist Martin Gundersen from the Norwegian media agency NRK.
Previous Episode
Agentic
August 4, 2025
•56m
We ́re back from Summer break!
To kick things off, we’re excited to have Armin Buescher and Einar Oftedal from RSAC join Robby for a dive into the most talked-about topic at this year’s RSA Conference: the emergence of agentic AI.
Agentic AI, the way they define it, are agents that complete tasks acting on behalf of a user. Unlike the traditional LLM experience, where the agent is relying on human prompts, agentic AI is designed to plan, decide, and act on their own within set goals - instead of waiting for instructions.
During their conversation with Robby, they cover what agentic AI means for different domains within cyber, how it is being utilised, and the challenges of implementing agentic AI.
They also talk about the importance of human oversight, why decision-makers need to stay educated, and the biggest buzzwords when it comes to agentic AI.
Next Episode
Pig Butchering
September 1, 2025
•42m
Trust is one of the most powerful and dangerous currencies that we have. Whether it's a phishing email, a romance scam or a human trafficking operation, the criminals behind it exploit some of the same dynamics; mainly that trust can be earned by playing to our emotions.
This is particularity true when it comes to this episode’s topic; the global crime of "pig butchering". The scam involves luring victims into fake romantic relationships, convincing them to invest in cryptocurrency schemes, and then stealing their money through fake investment platforms. It’s worth to add that the term is a violent term for a violent crime, and that financial grooming might be more fitting description.
This week’s guest, Erin West, spent 26 years as a district attorney, and the last few years she’s been exclusively working on these kinds of scams. She’s been featured in the Wall Street Journal about her work, testified before Congress and started her own non-profit (Operation Shamrock) focusing on educating about and disrupting transnational organised crime.
Erin explains how Chinese organised crime uses high-tech methods, including cryptocurrency, to defraud victims of their life savings, the link to human trafficking, and the surprising scale of it all.
If you like this episode you’ll love
Promoted