This developer wanted to cheat at Roblox. It cost millions

This episode of Smashing Security dives into a high-profile breach that began with a developer's attempt to cheat at Roblox, revealing a cascading chain of security failures across multiple companies. The story centers on an employee at Context AI who downloaded a Roblox auto-farming script—malware disguised as a gaming tool—that stole OAuth tokens from their corporate Google Workspace account. These tokens granted access to sensitive data belonging to Vercel and Versal customers, including API keys, database credentials, and cloud secrets. The stolen data was later sold on the dark web for $2 million by a hacker claiming ties to the Shiny Hunters group. The episode uses this incident to illustrate the 'Swiss cheese' security model, where multiple layers of protection fail simultaneously due to a single human error. The discussion then shifts to broader systemic vulnerabilities, particularly in mobile phone networks, where outdated SS7 protocols allow for widespread location tracking and surveillance, even on secure devices. The segment highlights how activists, journalists, and political dissidents are disproportionately targeted, with real-world consequences like the recapture of a fleeing Emirati princess. The episode concludes with a deep dive into Microsoft 365 security, focusing on how attackers are turning legitimate tools like Intune against organizations—such as Stryker, which lost 200,000 devices in a single attack—emphasizing the urgent need for configuration drift detection, backup systems, and least-privilege access models. Rob Edmondson from CoreView explains how their platform enables fine-grained access control and tenant recovery, offering practical solutions to prevent total tenant takeovers.