Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Technical defenses keep evolving but attackers have learned that people are often the weakest link. Social engineering has quietly outpaced many technical intrusions because it reliably targets human behavior rather than firewalls or intrusion detection systems. 2025 Verizon Data Breach Investigations Report highlights that social engineering remains one of the top three breach patterns, with phishing and pretexting consistently leading incident categories.

In essence, that is the disclosure and notification message that the open-source developer "qix" sent to the world when he was social engineered to give up access credentials to his GitHub account. Using his account, the attackers inserted malware in a series of popular NPM packages to direct cryptocurrency payments to their own wallets.

ReliaQuest has published a report on the cybercriminal recruitment ecosystem, finding that fluent English speakers with social engineering skills are highly sought-after. “Among the most in-demand skills is English-speaking social engineering, with job posts more than doubling from 2024 to 2025,” the researchers write.

When most people think about cybersecurity, they picture firewalls, anti-virus software, and complex passwords. But the weakest link isn’t a server or a laptop—it’s a person. Social engineering attacks exploit human behavior rather than technical vulnerabilities, and four techniques dominate the landscape today: phishing, smishing, vishing, and quishing.

Trustwave SpiderLabs researchers have recently identified an EncryptHub campaign that combines social engineering with abuse of the Brave Support platform to deliver malicious payloads via the CVE-2025-26633 vulnerability. In this blog post, we will break down the techniques used in the campaign and highlight the new tools employed by the threat group.

Cybersecurity incidents nearly tripled in the first half of 2025, jumping from 6% in the second half of 2024 to 17% in 2025, according to a new report from LevelBlue. Business email compromise (BEC) remains the most common method for initial access, but non-BEC tactics rose by 214%. The researchers observed a major surge in social engineering attacks, driven by the recent popularity of the ClickFix tactic.

ClickFix attacks have been around for decades; only the name is new. ClickFix attacks use social engineering to trick users into clicking on buttons and links that the user is told are needed so their browser or computer can perform some desired action.