In-depth coverage of social engineering tactics used by attackers, including pretexting, baiting, tailgating, and spear phishing. Articles explain how these manipulation techniques exploit human psychology and provide actionable defenses organizations can deploy to protect their people and data.
posts
In May 2025, the FBI's Internet Crime Complaint Center reported that phishing was — for the ninth consecutive year — the most-reported cybercrime in the United States. Not ransomware. Not cryptojacking. Phishing. The simplest attack in the playbook continues to cause the most damage, and the phishing meaning most people
One Phishing Email Cost MGM Resorts $100 Million In September 2023, a single social engineering phone call — preceded by a carefully crafted phishing email reconnaissance campaign — led to the breach that shut down MGM Resorts' operations across Las Vegas. Slot machines went dark. Hotel room keys stopped working. The
In January 2024, a finance employee at a multinational firm in Hong Kong transferred $25.6 million to criminals after a video call with what appeared to be the company's CFO. Every person on that call was a deepfake. That's where phishing lives now — far beyond
The FBI Gmail Alerts That Should Have Your Attention In early 2024, the FBI issued multiple warnings about sophisticated attacks targeting Gmail users — and the threat landscape has only intensified since. These aren't the clumsy Nigerian prince scams of a decade ago. Threat actors are now using AI-generated
In 2023, a finance employee at a multinational firm wired $25 million after a video call with someone they believed was their CFO. It wasn't. The entire call — every face, every voice — was a deepfake fabricated by threat actors who'd spent weeks building a detailed pretext.
In 2023, a finance employee at a midsize manufacturing firm in the Midwest wired $1.2 million to a threat actor who impersonated the company's CEO over email. The employee wasn't careless. She wasn't stupid. She simply hadn't been trained to recognize
In March 2022, threat actors used a simple phishing text message to breach Okta through a third-party contractor, Sitel. That single compromised credential gave attackers access to internal systems supporting thousands of Okta's customers. The attack didn't require sophisticated malware or a zero-day exploit. It required
The FBI Gmail Alert That Should Have Your Full Attention Earlier this year, the FBI issued stark warnings about threat actors targeting Gmail users with increasingly sophisticated phishing campaigns. With nearly 1.8 billion active Gmail accounts worldwide, the platform has become the single largest hunting ground for credential theft
In March 2022, Okta confirmed that the Lapsus$ threat actor group had breached a third-party support contractor, potentially affecting hundreds of enterprise customers. A few weeks later, the same group hit Microsoft, Nvidia, and Samsung. These weren't obscure targets — they were companies with massive cyber security budgets, sophisticated
In January 2022, the Red Cross disclosed that a cyberattack compromised the personal data of over 515,000 vulnerable people — victims of conflict, missing persons, detainees. The attack vector? A threat actor exploiting an unpatched vulnerability, combined with social engineering techniques that went undetected for weeks. It's a
