Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
In March 2020, a single phishing email led to a credential theft incident at Magellan Health that exposed data on 365,000 patients. The attacker impersonated a Magellan executive, tricked one employee, and spent five days inside the network before anyone noticed. A functioning phishing awareness program might have stopped
In 2020, the FBI's Internet Crime Complaint Center received 19,369 business email compromise complaints. The adjusted losses? A staggering $1.8 billion — making BEC the single most financially devastating cybercrime category in the FBI IC3 2020 Internet Crime Report. That's more than ransomware, more than
In 2020, a single spear phishing email sent to a Twitter employee gave attackers access to internal admin tools — and ultimately let them hijack verified accounts belonging to Barack Obama, Elon Musk, and Apple. The attackers walked away with over $100,000 in Bitcoin. That breach didn't start
The CEO Who Wired $17 Million to a Criminal In 2016, an executive at Austrian aerospace parts manufacturer FACC received what appeared to be a routine email from the company's CEO. The message instructed a wire transfer of approximately €42 million — roughly $47 million — to accounts controlled by
In February 2021, the FBI warned that threat actors were sending fake text messages impersonating banks, delivery companies, and even state unemployment agencies — all designed to steal credentials and drain accounts. These weren't theoretical risks. The FBI's Internet Crime Complaint Center (IC3) reported over $54 million
In January 2021, the FBI and CISA issued a joint advisory warning about a surge in vishing attacks targeting corporate employees working from home. Threat actors were calling employees directly, impersonating IT help desks, and convincing them to hand over VPN credentials. Within hours, attackers had access to internal networks,
In July 2020, a 17-year-old from Florida convinced Twitter employees to hand over internal credentials. Within hours, the accounts of Barack Obama, Elon Musk, Joe Biden, and Apple were all posting Bitcoin scam messages. The attacker didn't exploit a software vulnerability. He exploited people. These social engineering examples
In July 2020, a teenager convinced Twitter employees to hand over internal credentials through a phone-based social engineering attack. The result: hijacked accounts belonging to Barack Obama, Elon Musk, Joe Biden, and Apple — broadcasting a Bitcoin scam to hundreds of millions of followers. The attacker didn't exploit a
In 2020, a teenager and two accomplices convinced a Twitter employee they were from the company's IT department. That single phone call gave them access to internal tools, which they used to hijack 130 high-profile accounts — including those of Barack Obama, Elon Musk, and Apple — netting over $100,
In March 2021, a single employee at a water treatment plant in Oldsmar, Florida, watched someone remotely take control of their screen and attempt to increase sodium hydroxide levels to dangerous concentrations. The attacker got in through a shared TeamViewer password. No advanced exploit. No zero-day. Just poor cybersecurity awareness
