At its core, social engineering in the context of cybersecurity involves psychological manipulation and exploits human error, as opposed to software flaws, with the intent of obtaining sensitive information.

Users are easier to trick into leaking sensitive information, making them the perfect target for a security breach gateway. Recent statistics confirm that human error is a significant driver in cybersecurity breaches, emphasizing the need for user education around cybersecurity. It starts with understanding the types of attacks, which is a crucial first step in recognizing and eventually stopping them from following course.

An S&P Global Market Intelligence research, cited in thejournal.com and conducted between 2021 and 2024, shows that 44% out of the 3000 responders around the globe reported a security incident during this period, with 14% being affected within a span of only 12 months.

The same study shows that 34% of cloud breaches was attributed to misconfiguration and human error, with another 17% attributed to the lack of use of MFA (Multi Factor Authentication). These numbers combined reinforce the importance of robust user education on cybersecurity, both as individuals as well as in a business setting.

Understanding Social Engineering Attacks

Social engineering is a psychological tactic used to persuade someone into trusting a person, thus lowering their guard and eventually leading to either willingly releasing sensitive information or allowing access to secure areas, that would aid the persuader in initiating an attack.  

Unlike software that functions based on strict rules and procedures, humans often operate in unexpected ways, making it easier for attackers to construct ways to distract, confuse and mislead them into taking actions that go against their good intent. 

These actions can include giving away passwords, due to trusting the attacker would be part of their internal IT department, filling out personal information forms that they believe to be genuine and mandatory, or allowing physical access to secure areas within a building.

Social engineering tactics reveal a long-standing reliance on psychological manipulation to exploit trust and gain unauthorized access to information or resources. It started being associated with information technology in the early 1980s, when hackers used pretexts and persuasion to extract information from phone company employees, granting them unauthorized system access. 

Later, in the 1990s and early 2000s with the growth of email, attackers began sending fake messages designed to trick recipients into sharing sensitive details, such as passwords or financial information and moving on to exploit social networks such as Facebook and Twitter. 

Today, it includes sophisticated AI techniques such as voice phishing that mimics trusted people’s voices and deepfakes that use real-time data to make scams even more convincing.

It is important to distinguish between social engineering tactics within the cybersecurity space and other cyber threats such as malware or network attacks. Social engineering mainly involves the persuasion of individuals by an attacker, usually through impersonation of an already trusted person, such as the IT support personnel, or the CFO of the company, and leverages that trust to obtain sensitive information enabling them to initiate a security attack. Educating personnel on cybersecurity and social engineering can aid in lowering the chances of such an attack to prove successful.

On the other hand, malware and network attacks heavily rely on automated programmable bots that exploit already known security loops of various software and infrastructure. These can usually be exposed and stopped by using a combination of security tools such as antiviruses and firewalls, as well as keeping systems up to date and patched. 

Other forms of malicious attacks not involving social engineering, can leverage so-called zero-day vulnerabilities, or not yet known security flaws. They monitor the behaviour of newly released applications or specific versions of an application and try to find new, unknown security loops to exploit. EDR (Endpoint Detection and Response), MDR (Managed Detections and Response) and XDR (Extended Detection and Response) systems can detect and stop these threats.

Recognizing the key differences between these types of attacks allows for proper actions to be taken toward preventing these threats. Some require user education, while others require properly securing systems and the whole infrastructure. Addressing them together creates a holistic approach to security that every business should incorporate. 

Common Types of Social Engineering Attacks

Let’s break down some of the most common types of social engineering attacks to help you better identify them.

Phishing

Phishing remains one of the most prevalent types of social engineering threat, with an increase of over 150% only in the first quarter of 2024. 

This method involves crafting emails or SMS text messages with fake links embedded into the body that pose as legitimate websites. Clicking these links usually takes the user to either a malicious website that collects sensitive data or triggers the download of a malicious piece of code onto the system. 

Phishing emails can also contain malicious attachments, such as PDF files posing as legitimate invoices, or macro-enabled Microsoft documents. 

Spear Phishing

Spear Phishing is a specialized type of phishing, which targets a very specific individual within the organization. It takes meticulous planning involving harvesting information from public sources such as LinkedIn and other social media platforms to craft a more credible attack. All other characteristics related to general phishing apply to this type of threat as well.

A recent spear-phishing attack targeted Reddit in early 2023. The BlackCat ransomware group used a highly convincing phishing email to trick an employee into providing credentials, by logging into a portal that the user believed was Reddit’s internal login system. This breach allowed the attackers to steal 80GB of sensitive data and demand a $4.5 million ransom.

Pretexting

Pretexting is a tactic that involves plausible fabricated scenarios to convince victims to share sensitive information, by inducing sentiments of authority, fear, or a sense of emergency. 

The attacker may pose as the internal IT support person or a Canada Revenue Agency agent to induce authority and craft a plausible context that would lead the victim into trusting the attacker. Other key elements would be a sense of emergency or fear, that could be induced by claiming the necessity of action be taken shortly, or that a lack of action could lead to personal consequences. 

Once context and authority had been established, the attacker would then ask for the release of sensitive information aiding them in causing lateral damage. 

Baiting

Baiting involves strategically placing intriguing digital assets that would spark a user’s curiosity. This could mean a USB stick left on the kitchen table or at the washrooms, or free downloads on a website. 

Once the victim would plug in the specific drive into their laptop, or access the download, a malicious piece of code would get installed aiding in the collection of sensitive information from the device itself.

Quid Pro Quo Attacks

Quid Pro Quo Attacks usually rely on the victim’s desire to resolve a system issue or some other IT related problem. It represents an exchange of services, where the attacker will disguise as the IT personnel, offering to address fabricated issues such as event viewer errors, which are in fact non harmful to the user or the machine. 

The attacker could for instance initiate the attack by phoning the victim and impersonating a Microsoft support technician. Then they would ask the user to follow a few simple steps that would reveal false issues with their system, to ultimately convince them to allow access to their machine or provide sensitive information such as login credentials. 

Tailgating/Piggybacking

Tailgating or piggybacking takes advantage of politeness, where a user may be holding the door or provide physical access to an attacker given proper circumstances and convincing. 

The attacker would pretend to be part of the internal staff and that they have forgotten their badge or wear a false one but use pretexts such as the badge had been demagnetized or not yet properly activated.  

Providing physical access to secure areas of the building, could be a first step in a chain of events leading to a successful cyber attack. This can be avoided by implementing proper access procedures and policies, and educating users into challenging or even reporting unknown individuals attempting to gain access without following proper procedure. 

Recognizing Social Engineering Attacks

Recognizing signs of social engineering is imperative in keeping away threats by leveraging these tactics. Social engineering is becoming harder to identify due to more meticulous crafting and the availability of public information related to employees and businesses on numerous platforms. However, always being fully present and aware of the key elements that are embodied within these attacks will have a positive impact on keeping the guard up.

One of the most common red flags to look for in digital communications would be a sense of urgency and authority such as an item needing actioning today, or within an even shorter time. This would leave the user with very little time to think, raising the chances of them clicking on a malicious link or filling out a form.

Closely checking the sender of an email by hovering over the “from” field should bring valuable information about the real sender whenever in doubt. Also, watch for grammar mistakes and misspells of well-known genuine websites. These are common tactics used to deceive users into believing they are clicking on genuine links, when not alert.

Most mail hosting providers offer the ability to see the original non-formatted message. Just look for options like “view message details” (Microsoft Outlook on the Web) or “view original message” (Google Webmail). These views contain metadata that includes valuable information, such as the real sender, IP of originating email and server used to send. 

Most importantly, it validates the sender through authentication frameworks such as SPF, DKIM and DMARC. Look for these parameters and ensure that at least SPF and DKIM show as “pass”. Failure to do so, can indicate that the email had been tampered with or that it originates from a malicious source.

Everyone has been exposed at least a few times either in their personal or work life to such examples of malicious attempts that embody at least one if not many of the above listed elements. 

That text message about winning a vacation that needed actioning right away, or an email with an attached invoice originating from a business partner requiring to be paid immediately. Some of these malicious communications are easy to spot, others are conveyed with much detail, pertaining to a very specific person within the organization and considering business specifics to make it more credible. 

Preventing Social Engineering Attacks: Best Practices for Individuals

Within their personal lives, users can stay vigilant and proactive by adopting a combination of simple, but very effective habits and tools.

It’s easy to act without thinking when performing repetitive tasks, however adopting an overall skeptical attitude towards security is a first step in recognizing signs of malicious attempts. 

Create a habit of choosing strong passwords and store them in a password manager, rather than using the same password across multiple accounts, and always enable MFA (Multi Factor Authentication) where possible. We cannot stress enough the importance of Enabling MFA, since this simple action can save an account for which the password had been compromised, by adding that second layer of security.

There are plenty of free password generators on the web and even free password manager tools. Most browsers incorporate password managers as well, but they aren’t always available and as robust as dedicated password managers. Not only do these tools increase the security of your accounts, but they also make it easier to keep all your passwords up to date in a central, digital and easily accessible location.

Preventing Social Engineering Attacks: Strategies for Businesses

According to Verizon’s “Data Breach Investigations Report”, as of 2024, human-related factors, which include social engineering, were linked to approximately 68% of data breaches, underscoring the importance of user education within business environments.

Implementing employee training and awareness programs such as Wizer or Curricula, is a great start in fostering a security-conscious culture. Not only will such a program help employees recognize malicious intents a lot easier, but it will also send out regular tests to users and create reports helping in identifying those users that present a higher risk within the company. Ultimately, IT staff can address those weaknesses by helping these specific employees raise their security awareness on an individual basis  

Comprehensive security policies and procedures for handling sensitive information can minimize confusion among employees when communicating and sharing data both within the organization as well as externally. For instance, sharing employees’ personal contacts with third parties could eventually pose a risk to the company. Sharing passwords in clear text could also pose a security risk. Should an attacker compromise a user’s account that had shared passwords via Teams, it will now be able to cause lateral damage that would have not been possible otherwise.  

Zero trust policies should be adopted, where a user’s access would be restricted to only what they need to perform their tasks and nothing more. This keeps security tight and even if it may sound difficult to manage, it is in fact easier in the long term.

Securing the infrastructure is just as important as employee education in preventing social engineering attacks. Stopping malicious content at the door is way more efficient than leaving it up to the user to deal with. Configuring spam filters is no easy task and it requires constant maintenance, but it is well worth the hassle. These filters can be implemented at various locations, such as mail servers, network firewalls, and end devices. Properly configured policies such as SPF, DKIM and DMARC can substantially reduce the amount of spam received, but it can also hinder mail deliverability if not maintained properly.  

Even with the best security practices in place, a clear incident response plan is required to avoid havoc, should a social engineering attack prove successful. Who will be the stakeholders to be immediately informed should such an event strike? Are backups readily available and what is the time frame required to get the business back up and running? Who are the people in charge of securing the infrastructure and restoring functionality? These are all actions that are best to be pre-established and not have to be decided upon in the heat of the moment. 

Case Studies: Learning from Real-World Social Engineering Attacks

In January 2021, a highly targeted phishing campaign was conducted against Ubiquiti Networks, leading to a successful attack. The attackers posed as Ubiquiti IT staff and contacted an employee. Using pretexting, they created a convincing scenario requiring immediate action. The attackers exploited the employee’s trust and urgency to persuade them to provide access credentials.

Once inside the system, the attackers gained control over administrative privileges in the company’s Amazon Web Services (AWS) infrastructure, which hosted sensitive customer data. They exfiltrated information and later attempted to extort Ubiquiti for a significant ransom, threatening to leak the stolen data publicly if the company did not comply

The breach exposed sensitive customer information, including email addresses, hashed passwords, and in some cases, encrypted keys. Ubiquiti initially downplayed the severity of the attack but later faced criticism for underreporting its impact

This is a perfect example of how social engineering can target internal employees to exploit trust within an organization. The incident highlights the importance of employee awareness training and the adoption of Zero Trust policies.

Another coordinated social engineering attack compromised several high-profile Twitter accounts, including those of Elon Musk, Barack Obama, and Apple in 2020. The attackers targeted Twitter employees via a phone-based phishing campaign, gaining access to internal tools. They used this access to post cryptocurrency scam messages on the compromised accounts, tricking followers into sending Bitcoin.

The incident disrupted the platform, caused reputational damage, and raised concerns about the platform’s internal security practices. Twitter later confirmed that human error facilitated the breach, as the attackers exploited employees’ lack of vigilance during the phishing attempt

This event highlights that even sophisticated tech companies are vulnerable to social engineering. Implementing multi-layered security protocols such as MFA and stringent access control are critical in preventing such attacks.

Responding to Social Engineering Attempts

In the unfortunate event of a social engineering attack unfolding, responding to the incident in a strategic, planned manner can minimize the extent of the damage. Typically, the first step would be ceasing any kind of interaction with the attacker and informing the IT team as well as the stakeholders. An incident plan should be readily available for the IT team and followed accordingly.

Compromised users and devices should be immediately isolated by locking out accounts and removing devices from the local network to avoid further damage. A quick investigation should be conducted to determine the entry point and what type of data was leaked. Logs could provide valuable information, and they should be preserved for further evidence. EDR and XDR systems should also be engaged if in place.

It is also a good idea to communicate the incident to external parties that may be impacted, as well as the authorities. Once the incident has been isolated, a post-assessment is required to determine what made the attack successful and address those areas accordingly. 

Key Tools and Resources for Prevention

Knowledge isn’t always enough; it needs to be paired with the proper tools to maximize efficiency. There are lots of both free and paid resources available to users and businesses alike, that could empower them to prevent most cyber-attack attempts if used diligently.

Virustotal for instance is a great tool where anyone can scan links embedded inside an email before clicking them, should suspicion arise. Attachments can also be uploaded and scanned before opening them. 

MXToolbox and Whois provide tools to check if a mail sender had been blacklisted or help determine a website’s legitimacy. 

Training platforms such as Wizer and Huntress offer free security awareness training. 

The Future of Social Engineering: Emerging Trends and Threats

Social engineering attacks are evolving rapidly, driven by advancements in technology and the increasing interconnectedness of digital ecosystems. These threats are expected to become more sophisticated, personalized, and challenging to detect in the coming years, posing significant risks to individuals and organizations alike.

One emerging trend is the use of artificial intelligence (AI) and machine learning (ML) to craft highly convincing attacks. AI tools can analyze large datasets, such as publicly available social media information, to create detailed profiles of targets. This enables attackers to tailor phishing emails, voice messages, or even deepfake videos to deceive individuals more effectively.

Additionally, the rise of automation in social engineering is enabling attackers to scale their operations. Automated phishing campaigns, combined with bots that mimic human interaction, can launch attacks on thousands of individuals simultaneously. These campaigns often leverage SMS (smishing) and messaging apps to bypass traditional email security measures, targeting users on their personal devices where defences may be weaker

As organizations adapt to these challenges, robust training programs and advanced security measures, such as behavioural analytics and Zero Trust architectures, will be critical. By understanding the trajectory of social engineering tactics, businesses can stay ahead of emerging threats and better protect their assets and personnel.

Key Takeaways

Social engineering remains one of the most effective methods for cybercriminals, exploiting human psychology to bypass traditional IT defences. The tactics described—phishing, pretexting, baiting, and others—highlight the importance of vigilance and proactive measures. With social engineering attacks becoming more sophisticated and personalized, the need for ongoing education and robust security practices has never been greater.

For Calgary-based SMBs, partnering with EezIT’s security experts and IT support services can significantly strengthen your defences against these threats. From implementing employee awareness training to deploying advanced security tools, EezIT can help safeguard your business against evolving risks.

Ready to protect your business from social engineering attacks? Contact EezIT for a consultation today and discover how our tailored IT support can bolster your security posture. Explore our comprehensive IT Support services or reach out directly via our Contact page to get started. Together, let’s ensure your organization stays resilient in the face of ever-changing cyber threats.