Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that threat actors impersonating company executives tricked employees into wiring $46.7 million to overseas accounts. The attackers never breached a firewall. They never deployed malware. They sent emails — and those emails were enough. That's
The FakeEmail That Cost One Company $37 Million In 2024, the FBI's IC3 reported that business email compromise — the art of sending a convincing fakeemail that impersonates a trusted sender — accounted for over $2.9 billion in adjusted losses. That's not a typo. One European company
The Phone Call That Cost MGM Resorts $100 Million In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. That single vishing call — a voice phishing attack — triggered a ransomware event that shut down
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime for the fifth consecutive year. Yet when I ask executives to give me a phishing definition, most of them still say something like "those fake emails from
The FBI Didn't Issue a Joint Advisory for Nothing In March 2025, CISA, the FBI, and MS-ISAC released a joint cybersecurity advisory (#StopRansomware) specifically about the Medusa ransomware variant. By that point, Medusa had already hit over 300 organizations across critical infrastructure sectors — healthcare, education, legal, insurance, technology,
In 2024, MGM Resorts lost an estimated $100 million after a threat actor social-engineered an IT help desk employee with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password. They simply convinced a human being to hand over access.
A $12.5 Billion Problem That Keeps Getting Worse The FBI's Internet Crime Complaint Center reported $12.5 billion in cybercrime losses for 2023 — a 22% jump from the prior year. And the trajectory hasn't slowed. If you're reading this in 2026 and still
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that threat actors impersonating senior executives tricked finance employees into wiring $46.7 million to overseas accounts controlled by attackers. No malware. No zero-day exploit. Just a convincing email that looked like it came from the CEO.
The Phone Call That Cost One Company $23 Million In early 2024, a finance employee at a multinational firm in Hong Kong joined a video call with what appeared to be the company's CFO and several colleagues. Every person on the screen was a deepfake. The employee transferred
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Behind nearly every one of those complaints was a single moment: someone clicked a link they shouldn't have. If you&
