Your Google Account Just Got Hacked – And You Didn’t Click Anything

2.5 billion daily account-takeover attempts.That’s one every 34 microseconds.Damian, Troy & Fern go full send-it mode on the 2025 ATO playbook: SIM swaps, session-token theft, MFA fatigue bombing, rogue QR codes, deep-fake family scams, and the OAuth tokens you granted in 2017 that are still wide open.Timestamps00:00 – Intro05:20 – SIM swaps & losing your phone number in minutes09:40 – Why password resets are useless (session tokens survive)14:20 – MFA fatigue / push-notification bombing19:10 – OAuth & old third-party app tokens nobody revokes24:30 – Rogue QR codes at restaurants & hotels30:15 – Enterprise reality – weekly O365 token theft37:40 – Non-human identities & service-account sprawl44:50 – Passkeys in 2026 – will increase ATO risk if misconfigured51:00 – Public Wi-Fi, juice jacking & QR code myths58:00 – Closing thoughtsDiscord (coming soon) #AccountTakeover #SIMSwap #MFAFatigue #CyberSecurity #Infosec #ZeroTrusthttps://www.fcc.gov/consumers/scam-alert/grandparent-scams-get-more-sophisticatedhttps://newsroom.servicenow.com/press-releases/details/2025/ServiceNow-to-Expand-Security-Portfolio-With-Acquisition-of-Vezas-Leading-AI-native-Identity-Security-Platform/default.aspxhttps://thehackernews.com/2025/04/customer-account-takeovers-multi.htmlhttps://www.gartner.com/reviews/market/identity-threat-detection-and-response-itdrhttp://cyberpodcast.netSpotify: http://spotify.cyberpodcast.netApple: http://apple.cyberpodcast.netX: https://x.com/dtfcyberpodcastIG: https://www.instagram.com/dtfcyberpodcast/Linkedin:DTF: https://www.linkedin.com/company/dtf-cyber-podcast/Damian: https://www.linkedin.com/in/damianchung/Troy: https://www.linkedin.com/in/kosovotroy/Fern: https://www.linkedin.com/in/fernrojasaz/Business Inquiries: dtf at cyberpodcast dot netEverything here is our personal hot takes — not our employers, not the vendors we roast, not legal advice. Just three idiots with mics trying to keep you from getting pwned.