A forgotten application on a laptop asks the internet for updates, every few minutes, with full system privileges. No user is involved, nothing is signed, and nobody remembers installing it. When our threat hunters spotted it in customer telemetry, it turned out to be running on millions of devices worldwide, including corporate networks.
This talk tells the story of what we found, what an attacker could have done with it, and why stolen credentials, tokens and sessions from such devices are the raw material of modern identity attacks. We share how we weighed the legal and ethical limits of active defense, what we decided and how it turned out. You will leave with practical guidance on software inventory, update hygiene and continuous trust beyond the login.
