Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
In July 2020, a 17-year-old in Florida convinced a Twitter employee to hand over internal credentials. Within hours, the attacker had hijacked accounts belonging to Barack Obama, Elon Musk, Joe Biden, and Apple — tweeting a Bitcoin scam that netted over $100,000. The most sophisticated firewall in the world wouldn&
A Disgruntled Engineer, a Careless Accountant, and $11.45 Billion in Losses In 2018, a former Tesla employee reportedly sabotaged the company's manufacturing systems and exfiltrated sensitive data to third parties. That same year, countless organizations bled data because an employee clicked a phishing link or misconfigured a
In April 2020, the FBI's Internet Crime Complaint Center reported it was receiving between 3,000 and 4,000 cybersecurity complaints per day — a roughly 400% increase from pre-pandemic levels. The single biggest catalyst? Millions of employees suddenly working from home on networks and devices that no corporate
The Breach That Cost a Children's Charity Everything In 2023, Save the Children Federation confirmed it was hit by the BianLian ransomware group, which claimed to have stolen nearly 7 GB of data including financial records, personal information, and medical data. A global nonprofit with significant resources still
82% of Phishing Sites Now Target Mobile Devices In late 2024, a wave of toll-road smishing texts hit millions of Americans. The messages claimed unpaid tolls from agencies like E-ZPass and SunPass, directing victims to pixel-perfect payment pages optimized for mobile screens. The FBI's Internet Crime Complaint Center
In January 2022, the FBI issued a public warning that the cybercriminal group FIN7 had been mailing malicious USB drives — disguised as gift cards and COVID-19 guidelines — directly to U.S. companies. The drives contained ransomware. Employees plugged them in. Networks fell. That campaign wasn't some edge case
The Server Room Door Was Unlocked In 2019, a penetration tester hired by the state of Iowa walked into the Dallas County Courthouse after hours. He accessed restricted areas, took photos of sensitive systems, and demonstrated just how easy it was to bypass physical controls. The exercise ended with him
In 2019, a penetration tester hired by the state of Iowa walked into a locked courthouse after hours simply by following an employee through a secured door. He was arrested — despite being under contract to test exactly that vulnerability. The incident made national headlines and exposed an uncomfortable truth: a
A former employee at a financial services firm in Chicago watched his coworker type her password every morning for two weeks. He memorized it character by character. After he was terminated for performance issues, he used those stolen credentials to access the company's client database from a public
The Sticky Note That Cost a Hospital $1.2 Million A few years ago, I walked into a client's office for a security assessment and found a sticky note on a monitor in the billing department. It had a username, a password, and the name of their patient
