Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
The $4.88 Million Lesson Your Employees Haven't Learned Yet In January 2024, the SEC's own X (formerly Twitter) account was hijacked because someone fell for a SIM-swap attack. If the agency that regulates public companies can't keep its own accounts secure, what does
In January 2024, a finance employee at a multinational firm in Hong Kong transferred $25 million to threat actors after a deepfake video call convinced him his CFO had authorized the payment. No malware. No zero-day exploit. Just a well-trained employee who wasn't trained well enough. That incident
In January 2024, Microsoft disclosed that a Russian threat actor group — Midnight Blizzard — had breached executive email accounts using a simple password spray attack against a legacy test account that lacked multi-factor authentication. One of the most technically sophisticated companies on the planet, compromised by one of the oldest tricks
October Ends. The Phishing Emails Don't. Every October, organizations plaster break rooms with cybersecurity posters, blast out a few reminder emails, and call it a win. Then November rolls around, and the same employees click the same malicious links. I've watched this cycle repeat for over
In 2023, a single employee at a 12-person accounting firm in Nevada clicked a link in what looked like a DocuSign email. Within four hours, every client file on the network was encrypted. The ransom demand was $250,000. The firm didn't have backups. They paid. That firm
In January 2024, Microsoft disclosed that the Russian threat actor group Midnight Blizzard had breached corporate email accounts — not through some exotic zero-day exploit, but through a password spray attack on a legacy test account that lacked multi-factor authentication. One of the most well-resourced technology companies on the planet got
In September 2023, MGM Resorts International lost an estimated $100 million after a threat actor social-engineered a help desk employee with a single phone call. One conversation. That's all it took to cripple slot machines, hotel check-in systems, and digital room keys across Las Vegas for over a
The Breach That Cost MGM Resorts Over $100 Million In September 2023, a threat actor called Scattered Spider brought MGM Resorts to its knees — not with some exotic zero-day exploit, but with a phone call. A social engineering attack against the company's IT help desk gave attackers the
A Single Stolen Password Cost One Company $4.4 Million In May 2021, a threat actor used a single compromised password to shut down Colonial Pipeline — the largest fuel pipeline in the United States. The company paid a $4.4 million ransom. Gas stations across the southeastern U.S. ran
The Threat That Already Has a Badge and a Password In January 2023, the FBI arrested a former GE employee and a collaborator for stealing trade secrets related to turbine technology — a scheme that had been running for years. The insider had legitimate access the entire time. No firewall stopped
