How not to steal $46 million from the US government

March 12, 2026·41 min·4 clips

A thief trolled his investigator, then proved his guilt live on a Telegram call—watch him confess to stealing $46 million.

Asterisks get an oddly dramatic entrance. Graham and Tricia begin with the kind of generational teasing that makes the cybersecurity story feel like it wandered in from a chat. Tricia is back, though most of her time is going into a stealth-mode company that will not stay stealthy much longer. Downtime exists, barely. Her escape is replaying GTA 5 from the start with her partner, which gives Graham room to admit that even real-life driving is not exactly his strongest lane. Then the security lesson tightens. A platform with scripts or user-generated content, the host says, cannot trust old material just because it has been quiet. Dormant maliciousness is the phrase, and it lands. Something can sit there for the better part of a couple of years, then come roaring back. Annoying, and a little unnerving. The fix is boring in the useful way: audit old content, use a test environment, and keep the blast radius boxed in. The cleanup sounds mostly reassuring. The material has been cleaned up, nothing appears permanently lost, and Wikimedia says more mitigations are coming. Then the sponsor read slides in. Vanta gets tied to the familiar 2am security worry: controls, suppliers, questionnaires, spreadsheets, the whole grim procession. It is plainly an ad, but it keeps the show’s rhythm by treating security busywork as genuinely draining. The ending turns domestic again. Listeners can support the show through smashingsecurity.com slash plus, or spread the word if money is not on the table.

As heard by us

A sharp Smashing Security episode about dormant malicious scripts, platform hygiene, and the boring maintenance that prevents louder failures.

Smashing Security episode 458 opens loose, with Graham Cluley and Tricia Howard trading GTA 5 banter before settling into a more practical security lesson: platforms that allow scripts or user generated content need to worry about code that looks dormant until it wakes back up.

Read the full review in PlayNext →

Why you'd press play

Someone tried to take $46 million from the US government, and it did not go well for them.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Smashing Security