How Hackers Control You | AI Mind Control

[00:00:03] Ever notice it's always the overconfident leader that thinks cybercrime doesn't apply to them who gets selected and hurt the most? Moving Target. Books 1 and 2, out now. Hardcover, paperback, Kindle, and audiobook. Amazon, Barnes & Noble, and independent bookstores. Book 3, coming soon. Be a moving target.

[00:00:33] Welcome, everybody, to Cyber Crime Junkies. I am your host, David Mauro, and we have Dr. Sergio Sanchez on today. And you just got back, my friend, from the convention of KnowBefore down in Orlando, Florida, and I want to hear about it.

[00:00:54] And we've also, you met with Perry Carpenter, who we've had on the show, talking about AI risk in social engineering and deepfakes in particular. You have some tools where you can show us how quickly it is. But first, welcome to the studio. Tell us what's new and tell us about your trip to Florida.

[00:01:18] Hello, Dave. Hello, everybody. Nice to be again here with all of you guys. And yes, like David just mentioned, I just came back from a very interesting conference. Yes. They do a really nice job there. Well, oh my goodness, you can. Well, the thing that I love about KnowBefore is the approach that they take to cybersecurity. Right. You know, most of the companies, they approach via technology.

[00:01:50] Sins, SoC, all these very weird names for that normally humans, normal humans, sometimes they don't understand what is. Yeah. The approach of KnowBefore is actually for the human side. Like, what is the risk of a human getting full, getting, you know, basically conned into click a link?

[00:02:16] So, what's mostly about psychology and how the services, the products, they can, you know, help remediate all that problems that big company has. One of the things that I always says, and I think they agree with what I do, is no matter how much money a company pays for cybersecurity, from the technical point of view,

[00:02:42] take one person to click the wrong link, to open the wrong file, to put the wrong, the credentials, the credentials in the wrong place, for all that money basically goes to the garbage. Yeah. And really, what I love about their approach also is they really address risks that people have had for thousands of years, right?

[00:03:08] They are addressing the human element of convincing someone to do something against their own interests, whether it's releasing sensitive data or something like that. Yeah, you know, I have the good fortune to be one of my heroes, which is Perry Carpenter. One of his sessions, one of his, I would say show, because basically it was like a magician Vegas level show.

[00:03:38] Yes. Where he fooled everybody else. Everybody else in the audience, we were like, wow. And I will show you, if you allow me, one of the tricks that he presented. So Perry, I am going to copy this if you are watching this. Please do. So show us. You demonstrated this to me last week when we spoke.

[00:04:03] And within, it was, it took less than two minutes. Yes. For you to find a clip of me from something, some educational piece that I pushed out to deepfaking me and being able to say anything that I wanted to say. Yes. Or anything that you wanted me to say in my voice. Yes. But it was frightening. Before I show you that, I want to show you something that played with your mind without your knowledge.

[00:04:33] So just like a magician trick, Perry presents this deck of cards. So let me share the presentation here. Let's see if you can see it. Let me know. Okay. Let me share my screen. Let me look for those. All right. So let me know if you are able to see it. Yes, we are. So basically. Choose a card. Choose a card. It says choose a card.

[00:04:58] It has king of hearts, king of spades, queen of hearts, jack of diamonds, jack of clubs, and queen of spades. All right. So you choose a card and I'm going to tell you, I'm going to remove the card that you selected. So you're going to know what card I pick. So I don't have an idea about the card you pick. Right. But I'm supposed to pick mentally one of these cards. Correct. In my mind and not tell you about it. Yes. So. Okay. I have it. Perfect. It's in my mind.

[00:05:27] And I remove it. Do you see now the card that you choose? Probably not. It hasn't shifted. Here. Go back. Go back to the other one. All right. Ah, okay. Sorry. All right. So I've got it. I've got it in my mind. Perfect. And now you're showing me the card and it's gone. It's gone.

[00:05:55] And the thing is, really, all that cards are completely different. But you don't say it. What you did is, I see. So what you've demonstrated is something that's done in social engineering, right? Yeah. Correct. And that is, I am focused on the card that I selected, which was, by the way, the queen of hearts. Correct. And so I was picking the queen of hearts in my mind. Correct. By doing that, I'm not paying attention to the other cards. That's correct.

[00:06:24] You then show me the second slide. And in the second slide, the queen of hearts is missing. So you just proved your case. Exactly. And it seems like magic. Like, how did Sergio know what I had in mind? But the truth is, is all of the cards are different. Correct. And because in the first time, I show you six cards. And in the second one, I give you five. Also, you have the impression that someone is missing. No, something is missing.

[00:06:54] Correct. All right. Very, very good. Now, that is a really good trick. That is a trick. Another trick that he did is this one about choosing an icon. So he told us to choose any icon in this screen. Like a computer? Like a computer. Yeah, like a chip. Like, is a mouse there? Envelope, et cetera, et cetera. I've got it. And he says...

[00:07:24] I've got the one in my mind. So he says that with your finger, point to that one. Okay. Then he says that choose the icon of the hacker, the guy with the black hoodie, closer to the icon that you choose already. That would be this guy right here. So you choose that one. And then he says, very good.

[00:07:48] Now, I want you to choose the closest envelope with a hook. This one right here. That's the closest. And then it says, and then choose the closest Nova 4 red, you know, arrow that is close to that icon that you just selected. So that would be this one right here that I'm indicating on the screen. Correct. And then he says, the one that you choose was that.

[00:08:17] It is that one. That's amazing. And the funny part here is that in general, all of those instructions, even when you at the beginning says, you know, free will, choose whatever icon you want. But in the truth is, with the instructions that you are getting,

[00:08:40] you are going to actually the specific one that the hacker or the scammer want you to choose. Stay with us. We'll be right back. Ever notice it's always the overconfident leader that thinks cybercrime doesn't apply to them who gets selected and hurt the most? Moving Target.

[00:09:10] Books one and two, out now. Hardcover, paperback, Kindle and audiobook. Amazon, Barnes & Noble and independent bookstores. Book three coming soon. Be a moving target. That's amazing. And so those tactics are identical to the tactics that are used by threat actors. That's correct.

[00:09:40] In social engineering. And those have been around for hundreds of years, thousands of years. Thousands. Yeah. Since men, we exist in the planet there. So that's one of the things that make you feel. I'm not that sure that when I am presented with information, I am free willing choosing something.

[00:10:08] Scammers, conmen, they know that. So they don't hack computers. You give a very good example, actually, in the book that you wrote about like a hacker is like a thief in a parking lot. He's going to be checking door by door by door of every car there. If he sees that the car is closed, he moves to the next car.

[00:10:34] He don't want to spend time, you know, opening with that, you know, like in the movies. No, no, no. He will go and see which one is open. And the one that is open, open the door and get in. A hundred percent. A hundred percent. Because the theory, the theme of the book is simple. And that is you're not even being – we're all being targeted, right? And it's whether you actually get breached, whether it's your organization or you yourself,

[00:11:03] and they take your 401k or they steal your identity. It's not about whether they from another country found you and are targeting you and only you. It's not like that because that's not what the data says. That's not what all of our interviews have said. Like that's not the way it works. The way it works is if you are the easiest mark, if you are the easiest victim to victimize,

[00:11:31] you will be swept up in their campaigns, right? Because these guys have quotas to hit. They are not going to go and attack people that put up resistance because there are so many people that don't have resistance. The analogy that we use is we've all been to Target. We've all seen the Target. We can picture in our mind a Target parking lot, hundreds of cars, right? Lots of people walking in and out.

[00:11:57] Somebody that wants to break into a car is not going to take a crowbar and smash a window and have the alarm go off and draw attention to themselves. What are they going to do? They're going to walk by all of the car doors and pull on the handles. That's what they do. Like that's literally what they do. Why? Because there are still people that don't lock their doors. Correct. Or forget, right? And so that is how they're going to do it.

[00:12:25] And so it's very similar. It's a really strong analogy for cybersecurity. We just need to do enough resistance so that we are not the easiest one on the block because they will, because of it being organized crime and it operating like a business. They have a limited amount of time. They want the biggest return for the amount of time that they spend.

[00:12:51] And they don't have time to jump over a million different hoops just to get you. That's correct. You know, and also you're making me think about this. You are talking about the thief opening a door and the alarm starts sounding. And that comes something also harder now in this time. Long ago, you know, we were scared. Doesn't matter if I was in Mexico or you in the United States.

[00:13:20] We, when we were kids, we never went to bad neighborhoods. Why? Because we were worried that somebody was going to rob us. Yes. Today, that's a change. It's not that many people that is, you know, carrying cash in their wallets. Actually, I don't even carry my wallet anymore. All my information is in my iPhone. Right. But think about this.

[00:13:46] A thief has to also risk their lives and their freedom going face to face a victim. Right. So they need to be lucky enough that the victim don't have a bigger gun or knife that they have. They need to be also sure that they can escape and run away. They need to be sure that... That they can't identify them. Identify all that stuff. And for how much? I don't know. Probably...

[00:14:16] 50 bucks. 50 bucks? Yeah. Actually, if you have more than 50 bucks, they don't even take 50 bucks in Walmart anymore. So you're going to risk all that for $25? Right. Instead of sit down in the comfort of their houses, in a couch, in front of a computer, hacking and scamming people, and they can go directly to their bank accounts.

[00:14:43] Probably a lot of people have more than $25 in that bank account. So less risk, too. And that is horrible because you don't need to go out of your house without your wallet because you are worried that somebody is going to mug you. Now they can do it in your own house. Yeah, that's a really, really excellent point. Right. That's an excellent point.

[00:15:07] I saw a segment that our friend John DiMaggio was being interviewed on when he was talking about taking down one of the big ransomware gangs over in Ukraine or Russia. And in that segment, they had interviewed several members of the Bloods and the Crips, the gang members. And they are actually growing their cybercrime departments in those gangs.

[00:15:37] And they interviewed a guy and they said, why are you doing this? Like, why are you doing carding? Why are you, you know, stealing identities and, you know, making fake bank cards and all this, all this cybercrime operation? Because they interviewed him at a table and he had thousands of cards. He had all these devices for rigging things and hacking, et cetera.

[00:16:01] And he goes, if I deal heroin or meth or something like that, there's minimum, there's standard minimum sentences. Like, I go away for a long time in a state prison where it is violent and I've got rival gang members there. And my life is in jeopardy.

[00:16:25] And I have to, like you just said, I have to take my own life and get out on the street and go one-on-one and risk my own safety just to do whatever I can get right from that. Or I can do this. And if I get pinched, if I get caught, I do time in a federal prison, not a state prison, and nobody gets hurt. He's like, and there's no minimum sentences.

[00:16:52] Like, yes, the sentences are when they do finally catch these guys, you know, they're long. But it's not like we had a major war on drugs here in this country for decades, right? We can debate whether that was just or whether it worked or it didn't work or whatever. But the result of that were a lot of very long sentences for even trace amounts of certain drugs now, right?

[00:17:22] Yeah. Schedules or the statutes are pretty complicated. But in cybercrime, like, there's very, like, it's not, we haven't declared a war on it. Like, it is not as developed and as penalized as that. And so it was a very logical thing that he was saying, right?

[00:17:44] And it's frightening because now you've got people that are, that have been raised with violence and crime in this game. Yeah. Well, think about this too. And I'm going to tell you, you know, from my friends, my peers in the same sector that we are, but in Mexico, they are telling me that now, you know, drug dealers are switching to be cyber criminals.

[00:18:12] Mostly because just for a moment, I want you to think like a drug dealer. So to be a drug dealer, and I'm going to put it, this is very cold, you need to have land. You have to have a place to cultivate whatever, you know. To grow the poppy. Pod or poppy, yes. Right. And then to process it and refine it. Yes.

[00:18:41] For all that, you have to spend money. You have to buy or get a place. Or you can buy a laptop, right? Yeah. Yeah. And you're in business. Think about this, the land, the people that cultivate their land, the people that, you know, harvest the thing. Then the people that you have to have for chemical industry, like who is going to be in charge of the process. Then the distribution.

[00:19:09] So it's really, it's a process that is a lot of money. And just like you said, what about if I just buy computers? Yeah. That's exactly right. I mean, think about it. So the return is, well, also in your book, you are saying that, you know, the cyber criminals is the third economy. The largest economy. In the world. It's been that way six years in a row. It's surpassed the international drug trade. It's the third largest economy.

[00:19:38] There's the United States, there's China, and there's cyber crime. That's a lot. It's terrible. So what are we going to do? That's the question. And with that. We're all going to just make ourselves a moving target, a harder target to hit. Yes. So that they move on. And because the bigger it gets, the less vindictive and personal it becomes. Yeah. Right. And the more of a business operation.

[00:20:05] And so by putting up a little resistance, we're able to avoid a lot of it. That's correct. Now, with that in mind, you know, I will show you again, everybody watching this video, how easy is to scan people using voice. Nice. Well, yeah. And when we talk about AI, people don't necessarily even know what it is. It's a pattern predictor.

[00:20:34] There's large language models, et cetera. But really, seeing has always been believing. Right? When we see something with our own eyes, we believe it more than ever. And that no longer is true, especially when you see things. Most of us work through screens. Most of us work remotely. Or there's a large hybrid model where a good vast portion of our lives are remote.

[00:21:01] And we are relying on our devices. And the critical thing is just because you see somebody speak certain words, we don't know whether that really happened. And so we have to go and verify the human. Yeah. At the end of the day. Like, phishing emails, it's bad advice today to try and spot a phishing email. It is bad advice. So stop following that advice. The email is going to be perfect.

[00:21:30] There's not going to be, it's not going to be from a prince from Nigeria, our good friend. It's not going to be, have, you know, bad grammar. It works. You're not going to, it's not going to be from some crazy long Gmail address that is, that is, you know, 56 characters in it. It's not going to have a link that if you hover over it, it's not going to say that it's exactly from the place. AI has fixed all of that.

[00:21:58] The emails will be perfect. Yeah. So how do we know? We know by asking ourselves this question, what is it asking us to do? And the answer to that question is your red flag.

[00:22:13] If it is asking us to send somebody all of the W-2s or release financial information or change the wiring instructions, then before we do that, we have to go and verify with the actual human that that request is real. This is interesting. Perry, Perry in the presentation was talking exactly what you was asking yourself right now.

[00:22:38] And he says that the question is now, how this email, how this message make me feel? If the message make you feel rush or fear or you are being threatened, that is a red flag too. Like, why do they want me to do this now? Who is these people that they want me to answer this or click this link or follow this information?

[00:23:09] So that is also a new question that we used to have before. Like, what am I getting clicking here? Or am I going to resolve the problem that the email says that I am? You know, it's interesting and sad. And yes, let me show you how easy and how actually it's free, how to do this. Yes, I can see it. So it's OmniVoice and it's through HuggingFace.com? That is, yes.

[00:23:38] So if you want... I check this out after we met. Perfect. It works. It's frighteningly accurate. So this is free. You can use it for nothing. And the thing that we're going to do is first, and I'm using incognito just to be sure that I am safe to from my side. But let's choose a voice that everybody can recognize.

[00:24:06] So who do you want me to put there? Oh, that is good. Who should we use? Let's choose a particular voice. How about... I don't want to get political. Yes, no, don't get political. How about somebody from Shark Tank? One of those guys. Okay, tell me who can be. Mark Cubitt. Mark Cubitt. Or Gary V. We like Gary V.

[00:24:35] Gary V. Gary V. Gary V. It's like Vander... How do you spell it? I don't know how to spell it. Maybe just do Mark Cuban. Yeah, let's go to Mark Cuban. Sorry, everybody. I follow squirrels. I choose squirrels as well. Instagram. Yeah. Okay. So we just go there. There you go. See, he's got a million. Perfect.

[00:25:01] So let's go with one of his videos. So I get Mark Cuban. Let's see this video here. I don't need to sign. So I think it's... Oh, okay. Perfect. It's two voices. So probably that will be no good idea because he's going... Right. Let's find one where it's just a clip of him talking. Let's see if this is the one. Again. Yeah, that's... Looks like that's the one.

[00:25:30] Now they've got two voices too. I can always edit this out later. All right. So we can change that later, but let's select that one. So I copy the link. Okay. Copy the link address and I will go to this website, which also is free. Instagram audio downloader. So I'm going to paste the link there and I choose audio here in the corner.

[00:25:59] So let's get it. It's checking. Perfect. Found it. Download the audio. I'm going to save it in the downloads like everything else and save. And because I am blocking up... There you go. Let me move it here. It's because I have the screen. There you go. Save. Okay. Save. Save. And then you see it says that the location is not available. But my location or the location of...

[00:26:27] Let me save it then in my hard drive. Sometimes I cannot save it there. Let's see if I can save it. Perfect. I save it there. So I open that. Very good. I have the real audio there. Very good. So now go back again to that. And I'm going to... Drop the audio that you downloaded. Yeah. From Instagram or anywhere else. Yep. Now, think of this.

[00:26:55] While you're doing that, let me point something out to people. Some people might say or think to themselves, well, hey, I'm not a big social media person. I don't have a lot of audio out there. I don't post on LinkedIn. I don't have a lot of things where I'm talking out there. But how many of us have a voicemail? And your phone number is out there. Yeah.

[00:27:19] And literally, if your voice is on your voicemail and you have that, I have seen hundreds of examples where executives and leaders and regular people are deep faked, right? And what they do with this is brutal. Like it is like they can, you know, create situations where people are calling family members. People are, you know, disclosing client information. It's really, really bad.

[00:27:48] So you never want to be deep faked is the point. But now let's circle back to what Sergio is demonstrating for us. So the steps about, you know, capture something from Instagram, that was just a way to capture sound. Right. Capture the voice. The methods can be different. Again, yes, somebody make a phone call and is recording your voice answering, you know, your answer machine. Hello, my name is David in this moment.

[00:28:17] At this moment, I am not home. Please. As you can see here in the button is telling you recommended three to 10 seconds of audio. So that's all it takes. So that's now. Three to 10 seconds. Yes. That is scary. So now I'm going to select, you know, basically the language that I want this to talk. And of course, I will go to English.

[00:28:46] And as you can see, it has like a 250 different languages. So they can make it sound like any language. So I go to English. There you go. And now let's get him to say. Yes. What you want. Something like, I can't wait to buy David Dean Morrow's book. Period. It is one of the best things I've ever seen. Period.

[00:29:13] Or we can have it say, I really enjoyed Dr. Sergio Sanchez's book. Well, let's go with yours first. And I want to have him on Shark Tank. Okay. So basically what you are doing is you are typing in what you want Mark Cuban to say. Yeah. You come to the show. Okay. So now basically the only thing that I do is generate that sounds. And he's doing it. It's generating right now. So see how fast it. And let's see.

[00:29:42] So we're not able to hear that, but I will play it in post-production. Yeah. Perfect. Just send me the audio. Absolutely. So play it, play it one more time. So. It sounds real, doesn't it? So I'm going to save it for you and send it to you. Let's put it in. So what is shocking about that is this is a free tool. It costs nothing.

[00:30:09] So they even have, they have paid versions, which work even better. Right. Absolutely. But the point is, is this is no barrier to entry. Any criminal can access this type of tool and be deep faking any one of us. Correct. And so what we hear with our own ears, what we see with our own eyes, none of it can be

[00:30:38] believed on its face. Yeah. We just need to verify. Right. That's, that's really the, the thing to remember that in 2026, we have to verify the humans behind what we see. That's correct. And this is scary because just like you says, we cannot trust our own eyes. We cannot trust our own ears. So. Unbelievable.

[00:31:04] My question for everybody is, do you think are we humans prepared for what is coming? Because this is not only affecting companies. This is not affecting business. No, it's affecting individuals. Everybody. Everybody. There are a lot of instances. I mean, we see it in the, with children. We see it with revenge, you know, sextortion, revenge porn.

[00:31:32] We see it with elderly people where, you know, they get a voice call and it's from their grandchild. Right. It's because they, they, they spoof the number. So it looks like it's calling from the grandchild and it has the grandchild's name. And they're like, you know, I'm, I got busted or I got arrested for DUI or I'm in trouble. And I need, I need money. Just wire, wire it to me, send it to me.

[00:32:01] I'll pick it over, you know, telegram it to me, whatever it is, depending on the age of the elderly person. And then it's, it's not them. And so just be, again, if the elderly target, the person that is trying to be victim, that is, you know, being targeted to be victimized. If they could just ask themselves, what is it asking me to do? Is it, how is it making me feel? Like Perry said, right? Is it making me feel scared, nervous? Is there urgency?

[00:32:32] Right. Is it asking me to release money? Is it asking me to release sensitive information or to do something? Right. That is the red flag. And then what is the step? Go and verify the human. Go call your grandchild on the number that you know that is in your phone that you know is a separate channel than the one that they're calling on. So stop the call and say, I'm going to call you back. End the call.

[00:32:58] And then go and call them on the number that you know they actually are at and see if it's actually real. Not only that, also, and this looks like we are back in an episode of Get Smart. You remember the show? Of course. That they have to have these code words between them. Oh, that's a really good point. I even forgot about that. Yeah. Now you've got having a family code word. Now.

[00:33:25] So and it's something that only the family members know, you know, like I ate my peanut butter is the family phrase, whatever the family phrase is. Right. And you're like, OK, I will wire you this money. Little Jimmy. Like, what's the family code word? Oh, grandma, I don't have time for that right now. If you're my grandson, you know, the family code word. Tell it to me. Yes.

[00:33:51] Actually, next Thanksgiving dinner, which is when you have all the family together, choose the word. Yeah, that's a really good. That's good advice. Yeah. Play the game like, OK, we're going to have a code word. Yes. What is the password to get in, you know? Yeah. Just to be abracadabra. Right. Exactly. That's exactly right. All right. Well, hey, everybody. Hope you enjoyed this session. I learned some things. I thought that was great.

[00:34:21] Thank you, Dr. Sergio Saquez. Important thing to say is whatever we show today is for educational purposes only. 100%. Be responsible. We are not encouraging cybercrime. In fact, we've both published books about how to avoid cybercrime, how to learn how to stop it. So we will have links to our books, links to Dr. Sergio's book. We are currently redoing our website for Cybercrime Junkies, and we will actually be having our

[00:34:47] audio book available through a premium subscription right there on our website. So you can subscribe and get exclusive content, release of never before seen episodes and access to the audio book that you can listen over and over. And it is we're very excited about releasing that. So that'll be out as well. And Dr. Sergio Sanchez will be joining us with Mike Acera, the CEO of Lux Blocks, for another

[00:35:16] chaos episode coming up. And we will play our hack or hype trivia game, and we will talk about the updates in AI and things that have been changing over the last couple of weeks. So watch for that as well. So thanks, everybody, for joining. Thank you, Dr. Sergio Sanchez. Thank you, baby. Appreciate your time, my friend. Thank you, everybody. This was great. This was a nice show and tell. I really like it. Yeah. This is wonderful. Thanks, buddy. No, you're welcome. Thank you.

[00:35:46] Thank you, babe. We'll talk to you. Bye. Hey, everyone. David Mauro, creator and host of Cybercrime Junkies and author of the new nonfiction moving target book series. If you're a leader in an organization curious how to roll out AI safely, or if you have questions on your incident response plan, how to run tabletop exercises, or looking for 24-7 eyes

[00:36:10] on glass to protect you and keep you growing without interruption, then I invite you to sit down with me and my team at Netgain Technologies. We've been around since 1984 before cybersecurity even existed. A simple conversation, absolutely no pressure and no salesy fluff, and you will walk away with a great roadmap no matter what.

[00:36:31] So if improving your IT, bolstering your security, or rolling out AI interests you, contact me directly today at dmorrow at netgainit.com. That's d-m-a-u-r-o at netgainit.com. Find out more at our website at netgainit. That's netgainit.