Schneier on Security

FEBRUARY 25, 2025

This attack proves that UI manipulation and social engineering can bypass even the most secure wallets. The Bybit hack has shattered long-held assumptions about crypto security. No matter how strong your smart contract logic or multisig protections are, the human element remains the weakest link.

Cryptocurrency

Security Through Education

APRIL 7, 2025

I’ve seen people with disabilities in online discussions and on the Social Engineer Slack channel exploring suitable career paths. The Value of Diversity in Social Engineering Social engineering is, at its core, the art of human connection.

Social Engineering

Krebs on Security

NOVEMBER 9, 2024

“This is social engineering at the highest level and there will be failed attempts at times. “In terms of overall social engineering attacks, the more you have a relationship with someone the more they’re going to trust you,” Donahue said. Don’t be discouraged.

Hacking

Krebs on Security

JANUARY 7, 2025

Each participant in the call has a specific role, including: -The Caller: The person speaking and trying to social engineer the target. A tutorial shared by Stotle titled “Social Engineering Script” includes a number of tips for scam callers that can help establish trust or a rapport with their prey.

Phishing

SecureWorld News

AUGUST 7, 2025

The recent wave of attacks, attributed to the financially motivated threat group ShinyHunters (also tracked by Google as UNC6040), serves as a powerful case study in the effectiveness of sophisticated social engineering. Regular, realistic training on vishing and impersonation tactics is non-negotiable for all employees.

Social Engineering

The Hacker News

MAY 23, 2025

The malware known as Latrodectus has become the latest to embrace the widely-used social engineering technique called ClickFix as a distribution vector. The ClickFix technique is particularly risky because it allows the malware to execute in memory rather than being written to disk," Expel said in a report shared with The Hacker News.

Malware

Security Affairs

MAY 24, 2025

law firms for 2 years using callback phishing and social engineering extortion tactics. law firms using phishing and social engineering. FBI warns Silent Ransom Group has targeted U.S. The FBI warns that the Silent Ransom Group, active since 2022 and also known as Luna Moth, has targeted U.S.

Social Engineering

The Last Watchdog

JUNE 13, 2025

3, 2025, CyberNewswire– Arsen , the cybersecurity startup known for defending organizations against social engineering threats, has announced the release of its new Vishing Simulation module, a cutting-edge tool designed to train employees against one of the fastest-growing attack vectors: voice phishing (vishing). Paris, Jun.

Phishing

Malwarebytes

JUNE 23, 2025

The hackers pulled this off by posing as US Department of State officials in advanced social engineering attacks, building a rapport with the target and then persuading them into creating app-specific passwords (app passwords). Here’s how to stay safe: Only use app passwords when absolutely necessary.

Authentication

The Hacker News

MAY 7, 2025

The Russia-linked threat actor known as COLDRIVER has been observed distributing a new malware called LOSTKEYS as part of an espionage-focused campaign using ClickFix-like social engineering lures.

Malware

SecureWorld News

APRIL 28, 2025

The phishing game has evolved into synthetic sabotage a hybrid form of social engineering powered by AI that can personalize, localize, and scale attacks with unnerving precision. At the heart of many of these kits are large language models (LLMs) trained or fine-tuned specifically for social engineering tasks.

Phishing

Penetration Testing

NOVEMBER 5, 2024

LastPass, a leading password management platform, has issued a critical warning to users about a social engineering campaign targeting its customer base through deceptive reviews on its Chrome Web Store... The post Warning: LastPass Alerts Users to Phishing Scam Using Fake Support Reviews on Chrome Web Store appeared first on Cybersecurity (..)

Scams

Krebs on Security

JANUARY 14, 2025

Tracked as CVE-2025-21186 , CVE-2025-21366 , and CVE-2025-21395 , these are remote code execution bugs that are exploitable if an attacker convinces a target to download and run a malicious file through social engineering. Unpatched.ai “It may be the first of many in 2025.”

Artificial Intelligence

Security Affairs

JULY 2, 2025

The cybercriminals are using social engineering techniques to gain access to target organizations by impersonating employees or contractors. These actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access.

Data breaches

The Hacker News

MAY 30, 2025

A new malware campaign is distributing a novel Rust-based information stealer dubbed EDDIESTEALER using the popular ClickFix social engineering tactic initiated via fake CAPTCHA verification pages.

Malware

Tech Republic Security

JULY 7, 2025

Scattered Spider hackers are now targeting airlines with advanced social engineering tactics to bypass MFA and breach critical systems, the FBI warns.

Social Engineering

Security Boulevard

DECEMBER 5, 2024

Identity phishing doesn’t just lead to data theft – it can also lead to financial fraud, targeted social engineering attacks and lateral movement across endpoints. The post Identity Phishing: Using Legitimate Cloud Services to Steal User Access appeared first on Security Boulevard.

Phishing

SecureWorld News

JANUARY 7, 2025

Beware the Poisoned Apple: Defending Against Malware and Social Engineering Just like Snow White was tricked into accepting a poisoned apple from the Evil Queen, malware and social engineering attacks exploit trust to deliver harmful payloads. Are your defenses ready to withstand a "Jack"?

Cybersecurity

Krebs on Security

DECEMBER 18, 2024

This process, he explained, essentially self-selects people who are more likely to be susceptible to their social engineering schemes. [It It is possible — but not certain — that this bot Daniel referenced explains the incoming call to Griffin from Google Assistant that precipitated his bitcoin heist]. .”

Cryptocurrency

Security Affairs

APRIL 21, 2025

The malware is delivered via social engineering, attackers attempt to trick victims into tapping cards on infected phones. Calls enable social engineering in a Telephone-Oriented Attack Delivery (TOAD) scenario. Analysis of the SuperCard X campaign in Italy revealed custom malware builds tailored for regional use.

Malware

Penetration Testing

JUNE 22, 2025

Red Canary uncovers Mocha Manakin, a new threat group using "paste and run" social engineering to deploy NodeInitRAT, a custom NodeJS RAT with potential ransomware links.

Social Engineering

SecureWorld News

APRIL 22, 2025

This incident highlights the critical vulnerability in cryptocurrency communities, where high-net-worth individuals or executives may be more prone to social engineering attacks due to the high volume of media and investor engagement they handle.

Cryptocurrency

Krebs on Security

NOVEMBER 21, 2024

In January 2024, KrebsOnSecurity broke the news that Urban had been arrested in Florida in connection with multiple SIM-swapping attacks.

Identity Theft

Doctor Chaos

DECEMBER 20, 2022

Instead, it uses legitimate system tools and functions to carry out malicious actions, making it difficult to detect and prevent.Fileless malware attacks often start with a phishing email or other social engineering technique that tricks the victim into clicking on a malicious link or opening a malicious attachment.

Malware

The Hacker News

MAY 13, 2025

Attackers now leverage large language models (LLMs) to impersonate trusted individuals and automate these social engineering tactics at scale. The cybersecurity landscape has been dramatically reshaped by the advent of generative AI. The Most Powerful Person on the

Social Engineering

eSecurity Planet

OCTOBER 22, 2024

Cybercriminals employ social engineering techniques to trick you into believing you must resolve fictitious technical issues. The hallmark of ClickFix campaigns is their clever use of social engineering.

Scams

Krebs on Security

DECEMBER 29, 2024

How to Lose a Fortune with Just One Bad Click told the sad tales of two cryptocurrency heist victims who were scammed out of six and seven figures after falling for complex social engineering schemes over the phone.

Scams

The Hacker News

JUNE 26, 2025

The ClickFix social engineering tactic as an initial access vector using fake CAPTCHA verifications increased by 517% between the second half of 2024 and the first half of this year, according to data from ESET.

Social Engineering

SecureWorld News

FEBRUARY 25, 2025

One of the report's most pressing concerns is the role of Generative AI in social engineering attacks. From the report: "Generative AI is being used to create highly convincing phishing emails, fake voices, and even deepfake videosmaking social engineering attacks more difficult to detect.

Cybersecurity

Hacker's King

DECEMBER 26, 2024

Educate Yourself on Social Engineering Tactics Hacking isnt always about code; social engineeringmanipulating users into sharing sensitive informationis one of the most effective tools for cybercriminals. Common Social Engineering Techniques: Fake messages from accounts posing as Instagram support.

Accountability

Security Affairs

JANUARY 21, 2025

” Threat actors are attempting to use social engineering techniques by exploiting the trust of local entities in the authority. The threat actors need to have the victim’s AnyDesk ID to carry out the attack and the software must be active on the target systems.

Social Engineering

Security Affairs

JUNE 28, 2025

The cybercriminals are using social engineering techniques to gain access to target organizations by impersonating employees or contractors. “These actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access.

Social Engineering

The Last Watchdog

NOVEMBER 11, 2024

It could also help users identify various cybersecurity attacks, whether they are types of spoofing , phishing, social engineering, or malware. One significant risk is the potential for the technology to become a host to sophisticated social engineering attacks.

Cybersecurity

SecureWorld News

MAY 9, 2025

The method, known as "ClickFix," leverages social engineering to bypass traditional email-based defenses. The LOSTKEYS malware shows how attackers are getting smarter at tricking people and sneaking past basic security tools, especially by using fake websites and social engineering to get users to run harmful scripts," said J.

Malware

SecureWorld News

MAY 16, 2025

Scattered Spider is a financially motivated threat actor group known for its social engineering prowess, SIM-swapping attacks, and living-off-the-land (LOTL) techniques. The group is well known to employ social engineering tactics to gain access, so hardening your help desk is an immediate first step in defense," Staynings continued.

Retail

IT Security Guru

FEBRUARY 25, 2025

Other Ways Threat Actors Exploit Human Behaviour In addition to fatigue attacks, malefactors weaponise social engineering. MFA fatigue is often coupled with social engineeringan attacker might contact the victim, masquerading as IT support, and advise them to approve the prompt to “resolve an issue.”

Social Engineering

The Hacker News

JULY 10, 2025

Cryptocurrency users are the target of an ongoing social engineering campaign that employs fake startup companies to trick users into downloading malware that can drain digital assets from both Windows and macOS systems.

Cryptocurrency