Learn how attackers use psychological manipulation to trick people into revealing sensitive information or performing unsafe actions. Topics include pretexting, baiting, tailgating, vishing, and real-world social engineering case studies that expose common human vulnerabilities.
posts
The USB Drive in the Parking Lot Still Works In 2023, the U.S. Department of Health and Human Services warned healthcare organizations about a resurgence of USB-based attacks — threat actors dropping infected flash drives in parking lots, lobbies, and break rooms. People still plug them in. That single act
In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — a category heavily fueled by spoofing — accounted for over $2.9 billion in adjusted losses. That made it the single most financially devastating cybercrime category they tracked. Not ransomware. Not crypto scams. Spoofing-driven impersonation. If
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. And those are just the ones people actually reported. I've spent years helping organizations recover from phishing attacks, and I
A USB Drive in the Parking Lot Changed Everything In 2023, the Department of Homeland Security ran a test. They scattered USB drives in the parking lots of government buildings and private contractors. Forty-eight percent of the people who picked them up plugged them into a work computer. Nearly all
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider called MGM Resorts' IT help desk, impersonated an employee, and gained access to internal systems. The result? Over $100 million in losses, days of disrupted operations, and a data breach affecting millions of
A financial analyst at a Fortune 500 company typed her corporate credentials into a laptop at Chicago O'Hare. The man sitting two seats behind her wasn't reading the news on his phone — he was recording her screen. Within 48 hours, the attacker used those stolen credentials
One Phishing Email Cost This Company $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phishing email and a follow-up phone call. Threat actors from the Scattered Spider group used social engineering to trick an IT help desk employee,
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Despite billions spent on security tools, phishing remains the number one way threat actors break into organizations. So let's actually
82% of Phishing Sites Now Target Mobile Devices In 2024, Zimperium's Global Mobile Threat Report found that 82% of phishing sites specifically targeted mobile devices. That number didn't surprise me. What surprised me was how many security teams I spoke with still treated mobile phishing attacks
The CEO Who Wired $47 Million to a Stranger In 2016, FACC, an Austrian aerospace parts manufacturer, lost €42 million (roughly $47 million) after a threat actor impersonated the company's CEO via email and instructed an employee to wire funds for a fake acquisition project. The CEO and
