Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
One Click Cost MGM Resorts Over $100 Million In September 2023, a social engineering attack against MGM Resorts International shut down slot machines, hotel key cards, and reservation systems across Las Vegas. The threat actors didn't exploit a zero-day vulnerability. They called the help desk, impersonated an employee,
The $20 Million Breach That Started on a Home Wi-Fi Network In 2024, a healthcare company disclosed a breach that exposed 11 million patient records. The root cause? A remote employee connected to an unsecured home network, clicked a phishing link, and handed over VPN credentials to a threat actor.
Your Employees Are Eating Phish Food Every Day In March 2024, MGM Resorts was still tallying the damage from a social engineering attack that started with a single phone call. The estimated cost exceeded $100 million. The threat actor didn't exploit a zero-day vulnerability or deploy some exotic
In 2019, a former employee of Capital One walked into an AWS cloud environment — digitally, not physically — but the breach that exposed over 100 million records started with exploiting trust and access. That same principle of exploiting trust is exactly how a tailgating attack in cybersecurity works in the physical
In November 2023, the international law firm Allen & Overy confirmed it was hit by a LockBit ransomware attack that disrupted internal systems and exposed sensitive data. They weren't alone. The American Bar Association disclosed a data breach that same year affecting 1.4 million members. If you
In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a single phone call to a help desk. The attackers didn't exploit some exotic zero-day vulnerability. They used techniques that anyone familiar with basic cybersecurity terminology would recognize — vishing, credential theft,
In 2023, a finance employee at a multinational firm wired $25 million after receiving what appeared to be emails from the company's CFO. The messages were convincing, urgent, and completely fabricated. The attacker used a fake mailer — a tool designed to forge the "From" field in
The Call That Almost Fooled a Google Engineer In 2024, a Google engineer received a phone call from someone claiming to be Google support. The caller ID showed a legitimate Google number. The voice was professional, calm, and eerily convincing. It was AI-generated. The FBI warns Gmail users of sophisticated
A Fake Invoice Cost One Company $121 Million In 2019, a Lithuanian national named Evaldas Rimasauskas pleaded guilty to orchestrating a phishing scheme that stole over $121 million from Google and Facebook. His weapon wasn't malware. It wasn't a zero-day exploit. It was email — and an
The FBI Says Phishing Scams Are the #1 Cybercrime — And It's Not Even Close In 2023, the FBI's Internet Crime Complaint Center (IC3) received over 298,000 complaints about phishing scams — more than any other cybercrime category. That number has topped the charts for five consecutive
