NetSec Phishing and Social Engineering

Social engineering attacks manipulate people rather than exploiting technical vulnerabilities. The most robust firewall in the world cannot stop an employee who willingly hands over their password to someone pretending to be IT support. Phishing is the most common form of social engineering and the starting point of the majority of network breaches reported globally.

Why Social Engineering Works

Social engineering exploits fundamental human psychological tendencies. Attackers study these tendencies and engineer their attacks to trigger them deliberately.

Psychological Trigger    | How Attackers Use It
-------------------------|----------------------------------------------
Authority                | "This is your CEO. I need this done now."
Urgency                  | "Your account gets deleted in 30 minutes."
Fear                     | "Your computer has a virus. Call us immediately."
Curiosity                | "See who viewed your profile: [link]"
Greed                    | "You have won a $500 gift card. Claim here."
Trust/Familiarity        | Spoofed email from a known colleague's name
Reciprocity              | Attacker does a small favor first, then asks

Phishing

Phishing uses deceptive emails, text messages, or web pages to trick recipients into revealing credentials, installing malware, or transferring funds. The name comes from "fishing" — casting a broad net and seeing who takes the bait.

Anatomy of a Phishing Email

FROM:    security@paypa1.com  ← "l" replaced with "1" — easy to miss
TO:      user@company.com
SUBJECT: Your account has been suspended - Immediate action required

Dear Valued Customer,

We detected suspicious activity on your PayPal account.
Your account has been SUSPENDED to protect you.

[VERIFY YOUR ACCOUNT NOW]   ← link goes to: paypa1-security-verify.com/login

Failure to verify within 24 hours results in permanent closure.

PayPal Security Team

---
Red Flags:
1. Sender domain: paypa1.com (not paypal.com)
2. Urgent threat: suspension within 24 hours
3. Link domain: not paypal.com
4. Generic greeting: "Valued Customer" (real PayPal uses your name)

Spear Phishing

Spear phishing targets a specific individual with a personalized message. The attacker researches the target on LinkedIn, company websites, and social media to craft a believable pretext. The email references real colleagues, real projects, or real recent events to lower the target's guard.

GENERIC PHISHING:
"Dear Customer, your bank account is suspended."
→ Low success rate, easy to spot

SPEAR PHISHING targeting CFO Karen Smith:
"Hi Karen, it's Mike from IT. Following up on the Q3 audit John mentioned 
in the board meeting last Tuesday — can you log into the finance portal 
and verify the year-end figures? [link]"
→ References real people, real meeting → much harder to detect

Whaling

Whaling targets senior executives — the "big fish." CEOs, CFOs, and board members are high-value targets because they have authority to approve large transfers and often have fewer IT controls applied to their accounts (due to complaints about productivity impact).

Business Email Compromise (BEC)

The attacker either compromises or spoofs a business email account and sends instructions to employees, vendors, or partners. The most damaging BEC attacks impersonate a CEO directing the finance department to wire funds to a new bank account urgently and confidentially.

BEC Attack Example:
From: ceo@company.com (spoofed or hacked real account)
To:   finance@company.com
Subject: Urgent - Confidential Wire Transfer

Sarah, I'm in a board meeting and cannot be reached by phone.
Please wire $485,000 to our new acquisition partner immediately.
Do NOT discuss with anyone until the deal closes.

Bank: [attacker's account details]

Do this before 3pm today.
- James (CEO)

Result: Finance wires money. CEO was not involved. Money gone.

Other Social Engineering Techniques

Vishing (Voice Phishing)

Attackers call targets by phone, impersonating IT support, bank fraud departments, or government agencies. Voice creates urgency and personal authority that email cannot fully replicate. AI voice-cloning tools now allow attackers to impersonate specific real people's voices using a few seconds of recorded audio.

Smishing (SMS Phishing)

Phishing attacks via text message. Common smishing messages claim to be from delivery companies, banks, or mobile operators. Mobile users are more likely to tap links quickly on small screens without scrutinizing the URL.

Pretexting

The attacker fabricates a scenario (pretext) to extract information. "I'm from facilities management and I need your login to update your workstation remotely" is a pretext. Pretexting often precedes other attacks — gathering initial information used to craft more convincing follow-up attacks.

Baiting

An attacker leaves a USB drive labeled "Salary Review 2024 — Confidential" in a company parking lot or lobby. Curiosity drives someone to plug it in. The USB installs malware automatically when inserted.

Defending Against Phishing and Social Engineering

Defense                           | What It Stops
----------------------------------|----------------------------------------------
Security awareness training       | Teaches employees to spot and report attempts
Phishing simulation exercises     | Tests and measures employee vigilance
Email authentication (SPF, DKIM)  | Blocks spoofed sender domains
Anti-phishing email filters        | Catches known phishing URLs and attachments
MFA everywhere                    | Stolen passwords alone are not enough
Verify out-of-band               | Call the CFO's real number before wiring funds
Report button in email client     | Makes reporting phishing easy for employees
URL inspection before clicking    | Hover over links, check actual destination
Zero-trust wire transfer policy   | No single email authorizes large transfers

The Phishing Kill Chain

Step 1: Attacker researches target (LinkedIn, company site, social media)
Step 2: Attacker crafts convincing pretext
Step 3: Attacker sends phishing email/SMS/call
Step 4: Victim clicks link / provides credential / installs attachment
Step 5: Attacker gains initial access (credential, session, or malware)
Step 6: Attacker moves laterally through network
Step 7: Attacker reaches target data or executes final objective

Breaking any link in the chain stops the attack.
Most cost-effective link to break: Step 3-4 (awareness training + MFA).

No technical control replaces a security-aware user. Regular phishing simulations, clear reporting procedures, and a culture where employees feel comfortable reporting suspected attacks without embarrassment form the human layer of defense that technology cannot fully replicate.