Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cyber threats aren’t always about complex code or advanced hacking tools. Often, they start with a simple trick—convincing someone to click a link, share a password, or let someone into a secure area. This tactic is called social engineering. Social engineering is when attackers trick people into breaking security rules. Instead of hacking systems, they use lies, pressure, or fake trust to get what they want. These attacks work well because they target human emotions, not technology.

A constantly shifting threat landscape has given rise to a new cyberattack vector, driven by two powerful forces: the rapid migration of data to the cloud and the fundamental change in how employees access and interact with that data. Today’s workforce expects the freedom to work and access information from any device—especially mobile devices, which have become integral to their professional and personal lives.

A social engineering campaign is abusing Zoom's remote control feature to take control of victims’ computers and install malware, according to researchers at security firm Trail of Bits. The operation targeted Trail of Bits’ CEO, who recognized it as malicious and didn’t fall for the attack. The researchers have attributed the campaign to the ELUSIVE COMET threat actor.

ClickFix is an emerging social engineering technique that has gained traction among both cybercriminals and APT groups due to its effectiveness and low barrier to execution. First observed around October 19, 2023, disguised as Cloudflare anti-bot protection, ClickFix deceives users into taking action to “fix” a non-existent issue, often through fake reCAPTCHA pages, spoofed software updates, or fraudulent security prompts.

99% of phishing emails that reached inboxes last year did not contain malware, according to a new report from Fortra. Attackers were much more successful using malicious links or purely response-based social engineering. Fortra explains, “Anti-malware scanning, sandboxing, and other pre-delivery security processes are increasingly common and make it more difficult for emails containing malware payloads to reach user inboxes.

Group-IB has published a report on SIM swapping attacks, finding that attackers continue to use social engineering to bypass technical security measures. SIM swapping is a technique in which an attacker takes over a victim’s phone number, which enables them to access the victim’s accounts. This involves tricking the telecom operator into reassigning the victim’s phone number to a SIM card controlled by the attacker.

Most people know not to click on obvious spam emails, but today’s scams are polished, highly personalized, and AI-powered. Whether it’s a fake banking alert, a deepfake customer service call, or a cloned e-commerce website, social engineering fraud often spreads fast. When customers see familiar branding, hear a confident voice, or receive a message that appears to come from a trusted source, it’s easy to comply and get duped.

From fake job postings to fake candidates, it’s clear the job market has changed in the past few years. Finding a job ad that sparks your interest is now only half the battle — the other half is making sure it’s not a scam. I see three or four LinkedIn posts about job searches and applications gone wrong every day. I’ve read tales of recruiter impersonations, postings for roles that don’t exist, and ads that demand money in order to apply.

Hackers don’t always need malware or harvested credentials to break into systems and accounts. Why bother with technical hacks when bad actors can trick people into getting what they want? From deepfake video calls impersonating friends or relatives to perfectly cloned login portals that steal credentials in real-time, social engineering scams are more convincing than ever. In fact, social engineering now accounts for 70 to 90% of cyber attacks.