r19.io | Hackers Behind the Code

136Days

13Hours

03Minutes

17Seconds

136Days

13Hours

03Minutes

17Seconds

JUNE 6TH - 2026

Lisboa, Portugal

About

High-level minds. High-impact learning. One day.

Hackers Behind The Code – Conference is a one-day premium experience designed for a select group of hackers and developers seeking real challenges, practical learning, and high-level connections. More than a traditional conference, the event delivers advanced insights, technical demonstrations, and sessions where participants explore new techniques, dive into the latest industry updates, and interact directly with leading experts including speakers previously featured on the Hackers Behind The Code podcast. Hosted at the VIP Grand Lisboa Hotel & Spa, a 5-star venue in Lisbon, the conference offers an exclusive environment with continuous catering, premium service, and personalized gifts. Every detail is crafted to deliver a complete, immersive, and unforgettable experience. This isn’t just about watching talks it’s about experiencing the content in practice, connecting strategically with the speakers, and joining a community that is shaping the future of cybersecurity.

For Whom?

If You Shape the Future of Security, This Is Your Place

Business

Investors

Hackers

Developers

Unlock AI’s potential to optimize operations, enhance customer experiences, drive data-informed decisions, and stay competitive in a fast-evolving market.

Business

Investors

Hackers

Developers

Unlock AI’s potential to optimize operations, enhance customer experiences, drive data-informed decisions, and stay competitive in a fast-evolving market.

Innovation . Networking . Business . Deep-Tech .

Speakers

Meet the Experts Shaping the Future of Cybersecurity

Yuri Diogenes
PhD in Cybersecurity and Professor at University of Texas at Dallas
Filipi Pires
Head of Identity Threat Labs
Wesley Thijs
Hacker and Founder of The XSS Rat
Sergey Chubarov
Security Expert
Teresa Pereira
Cyber Threat Hunter
Jefferson Macedo
Incident Responder & Founder of PurpleBird Security
Johan Sydseter
OWASP Cornucopia project co-leader, AppSec Pokémon

Yuri Diogenes
PhD in Cybersecurity and Professor at University of Texas at Dallas
Filipi Pires
Head of Identity Threat Labs
Wesley Thijs
Hacker and Founder of The XSS Rat
Sergey Chubarov
Security Expert
Teresa Pereira
Cyber Threat Hunter
Jefferson Macedo
Incident Responder & Founder of PurpleBird Security
Johan Sydseter
OWASP Cornucopia project co-leader, AppSec Pokémon

Event Agenda

Discover the Full Hackers Behind The Code Conference Event Agenda

Kickoff

Main Conference

Kickoff

Main Conference

Kickoff

Main Conference

08:45 – 09:15

Welcome to the Hackers Behind The Code – Conference

Start the day with an opening message from the organizers and a brief overview of what this exclusive experience has prepared for you.

09:15 – 10:15

AI Adoption with Proper Security Guardrails - An AI journey from start secure to staying secure

Organizations are rapidly adopting AI, making security a foundational requirement rather than an afterthought. This session presents an end-to-end AI security journey focused on starting secure and staying secure. It explains how security guardrails can be embedded early through governance, secure data pipelines, and identity-driven access controls. The presentation introduces AI Security Posture Management (AI-SPM) as a way to gain visibility into AI assets, configurations, and compliance gaps. It also covers AI threat detection for identifying risks such as prompt injection, model abuse, and data leakage. Exposure Management is discussed as a method to correlate risks and prioritize remediation across AI workloads.

Organizations are rapidly adopting AI, making security a foundational requirement rather than an afterthought. This session presents an end-to-end AI security journey focused on starting secure and staying secure. It explains how security guardrails can be embedded early through governance, secure data pipelines, and identity-driven access controls. The presentation introduces AI Security Posture Management (AI-SPM) as a way to gain visibility into AI assets, configurations, and compliance gaps. It also covers AI threat detection for identifying risks such as prompt injection, model abuse, and data leakage. Exposure Management is discussed as a method to correlate risks and prioritize remediation across AI workloads.

Yuri Diogenes

PhD in Cybersecurity and Professor at University of Texas at Dallas

Yuri Diogenes

PhD in Cybersecurity and Professor at University of Texas at Dallas

Yuri Diogenes

PhD in Cybersecurity and Professor at University of Texas at Dallas

10:15 - 11:15

Hunting Malicious Documents with OSINT: Investigating Malware Beyond the Payload

Malicious documents like PDFs, Word, and Excel files remain a common entry point for attacks. This talk shows how OSINT enhances malware analysis, helping investigators understand who is behind an attack, how it operates, and why it happens.

Attendees will learn practical techniques to extract intelligence from metadata, embedded objects, URLs, file hashes, and infrastructure, correlating these indicators with OSINT sources to link campaigns and identify threat actor behavior.

By combining document analysis with OSINT, defenders gain visibility beyond the file, uncovering attacker patterns, infrastructure, and attack strategies.

Malicious documents like PDFs, Word, and Excel files remain a common entry point for attacks. This talk shows how OSINT enhances malware analysis, helping investigators understand who is behind an attack, how it operates, and why it happens.

Attendees will learn practical techniques to extract intelligence from metadata, embedded objects, URLs, file hashes, and infrastructure, correlating these indicators with OSINT sources to link campaigns and identify threat actor behavior.

By combining document analysis with OSINT, defenders gain visibility beyond the file, uncovering attacker patterns, infrastructure, and attack strategies.

Filipi Pires

Head of Identity Threat Labs

Filipi Pires

Head of Identity Threat Labs

11:15 – 11:45

Morning Networking Coffee

Catch up with fellow attendees over coffee before diving into another exciting day of learning.

11:45 – 13:00

Hacking ChatGPT… 14 times… bug bounties is easy!

In this talk you are going to learn what I teach my coaching students for 250€ per hour for free. Join me as I take you beyond the scenes and explain how I have hacked one of the biggest AI companies ever no less than 5 times, and then again 14 times, and then I taught my students who got a divided 9 bugs over several people. This before I take you into game hacking and show you theoretically how to hack a game. I am going to finish with the surroundings of bug bounties like APIs, mobile and network bounty.

In this talk you are going to learn what I teach my coaching students for 250€ per hour for free. Join me as I take you beyond the scenes and explain how I have hacked one of the biggest AI companies ever no less than 5 times, and then again 14 times, and then I taught my students who got a divided 9 bugs over several people. This before I take you into game hacking and show you theoretically how to hack a game. I am going to finish with the surroundings of bug bounties like APIs, mobile and network bounty.

Wesley Thijs

Hacker and Founder of The XSS Rat

Wesley Thijs

Hacker and Founder of The XSS Rat

Wesley Thijs

Hacker and Founder of The XSS Rat

13:00 – 14:00

Lunch Break

A dedicated break for lunch, networking, and recharging before the next sessions.

14:00 – 15:15

Under the Radar: Evasion and Incident Response Beyond XDR

In an era of pervasive Extended Detection and Response (XDR), attackers and defenders alike must evolve their tactics.

Sergey Chubarov

Security Expert

Sergey Chubarov

Security Expert

Sergey Chubarov

Security Expert

15:15 – 16:15

Dialing into Danger: Inside the World of Vishing

In this engaging session, we will delve into the deceptive realm of voice phishing, or vishing. This talk aims to illuminate the common techniques used by attackers to manipulate and deceive individuals over the phone. Through real-world examples, we’ll explore how vishers craft their schemes to exploit human psychology and trust. By the end of the talk, attendees will be equipped with practical strategies and defenses to protect themselves and their organizations from falling victim to vishing attacks.

In this engaging session, we will delve into the deceptive realm of voice phishing, or vishing. This talk aims to illuminate the common techniques used by attackers to manipulate and deceive individuals over the phone. Through real-world examples, we’ll explore how vishers craft their schemes to exploit human psychology and trust. By the end of the talk, attendees will be equipped with practical strategies and defenses to protect themselves and their organizations from falling victim to vishing attacks.

Teresa Pereira

Cyber Threat Hunter

Teresa Pereira

Cyber Threat Hunter

Teresa Pereira

Cyber Threat Hunter

16:15 – 16:45

Afternoon Coffee Break

A short break for coffee, networking, and informal conversations before the next talks.

16:45 – 18:00

Inside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering (UNCENSORED)

This session explores a real-world multi-stage attack that led to a $15M financial fraud in Brazil. Starting with compromised home and small business routers, attackers evolved their tactics into a sophisticated social engineering campaign targeting contact center operators. Based on firsthand forensic investigations, the talk reveals how technical and human vulnerabilities were exploited, how the threat actors adapted over time, and the key lessons learned for defenders and incident responders.

This session explores a real-world multi-stage attack that led to a $15M financial fraud in Brazil. Starting with compromised home and small business routers, attackers evolved their tactics into a sophisticated social engineering campaign targeting contact center operators. Based on firsthand forensic investigations, the talk reveals how technical and human vulnerabilities were exploited, how the threat actors adapted over time, and the key lessons learned for defenders and incident responders.

Jefferson Macedo

Incident Responder & Founder of PurpleBird Security

Jefferson Macedo

Incident Responder & Founder of PurpleBird Security

Jefferson Macedo

Incident Responder & Founder of PurpleBird Security

18:00 – 19:15

Stop Lecturing! Start Playing!

This session will discuss how to use games to scale your application security program, foster agency, empathy, and community, spark imagination, and stimulate the brain. When choosing a strategy to make your applications more secure, don’t use reading materials, presentations with “talking heads,” or meetings as a medium to increase awareness and knowledge about application security. Instead, focus on activities that can be repeated regularly that are both relevant and engaging to the work you are doing. When employees are authentically involved and curious about their learning, their heightened focus and emotional connection lead to better memory formation and the application of knowledge. Numerous studies report that emotions have a significant impact on human cognitive processes. This underpins why games can enhance learning over time, and why having an extensive collection of games in your arsenal is beneficial when teaching others about application security.

This session will discuss how to use games to scale your application security program, foster agency, empathy, and community, spark imagination, and stimulate the brain. When choosing a strategy to make your applications more secure, don’t use reading materials, presentations with “talking heads,” or meetings as a medium to increase awareness and knowledge about application security. Instead, focus on activities that can be repeated regularly that are both relevant and engaging to the work you are doing. When employees are authentically involved and curious about their learning, their heightened focus and emotional connection lead to better memory formation and the application of knowledge. Numerous studies report that emotions have a significant impact on human cognitive processes. This underpins why games can enhance learning over time, and why having an extensive collection of games in your arsenal is beneficial when teaching others about application security.