# What Happened to Black Basta's Playbook? The Automated Teams Phishing Threat Hitting Executives

Page: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives
Text version: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives.md
Podcast: [ShadowTalk: Powered by ReliaQuest](https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547)
Published: 2026-04-29T15:00:00+00:00
Episode link: https://www.buzzsprout.com/2154459/episodes/19097284-what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives.mp3
Audio file: https://www.buzzsprout.com/2154459/episodes/19097284-what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives
Duration seconds: 1596

## Resource

Black Basta disbanded in February 2025, but their playbook didn't go with them. In March 2026, 77% of observed incidents targeted executives and directors, and attackers moved from first contact to malicious script execution in as little as 12 minutes. The tactic has been automated, refined, and is now running faster than most SOCs can respond. Join hosts Alexandra and John as they discuss: How attackers leverage Microsoft Teams phishing to target high-privilege accounts with alarming s...

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/what-happened-to-black-basta-s-playbook-the-automated-teams-phishing-threat-hitting-executives.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.