Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
One Clicked a Link. The Other Sold the Data. Both Cost Millions. In 2023, Tesla disclosed that two former employees had leaked the personal information of over 75,000 people — including Social Security numbers — to a foreign media outlet. That same year, the Verizon 2023 Data Breach Investigations Report confirmed
In May 2022, a Yahoo research scientist named Qian Sang downloaded roughly 570,000 pages of proprietary source code to his personal devices — just two weeks after accepting a job at a competitor. Yahoo's internal systems flagged the bulk transfer, but only after the damage was done. This
In March 2024, a finance director at a mid-size logistics company received a text message that appeared to come from the CEO. It asked for a quick wire transfer to close a vendor deal. The director tapped the link, entered credentials on what looked like the company's banking
The $0.97 Device That Cost a Defense Contractor Millions In 2008, a USB flash drive infected with the Agent.BTZ worm was plugged into a U.S. military laptop at a base in the Middle East. It took the Department of Defense 14 months to clean up the damage,
In January 2024, a penetration tester hired by the Iowa State Court Administration was arrested for breaking into a courthouse — even though he had a signed contract to test physical security. The incident made national news and sparked a legal battle. But it also exposed something most organizations ignore: the
A Badge Swipe, a Smile, and a Six-Figure Data Breach In 2019, a penetration tester hired by Coalfire walked into a locked Iowa courthouse after hours — simply by following someone through a door. He and his partner were arrested, but the point was proven: physical security is often the weakest
In 2023, a Ponemon Institute study sponsored by 3M found that 91% of visual hacking attempts — someone simply looking at a screen — were successful. No malware. No zero-day exploit. No phishing email. Just a person standing in the right place at the right time, reading credentials off someone else'
In 2023, a healthcare organization in the Midwest lost over 2,000 patient records — not because a hacker exploited a zero-day vulnerability, but because an employee left printed patient lists on their desk over the weekend. A cleaning contractor photographed them. That's it. No malware, no phishing email,
The Breach That Started With a Single Slack Message In September 2022, a threat actor convinced a Uber contractor to approve a multi-factor authentication push notification. That single moment of human failure gave the attacker access to Uber's internal systems, including their Slack workspace, vulnerability reports, and financial
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past the help desk with a single phone call. The attacker didn't exploit a zero-day vulnerability. They didn't write custom malware. They called an employee, pretended to
