Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.

Crypto-wallet drainer … a fake page of a well-known project, a message on social media, an advert, an NFT offer or a "connect wallet" button. The signature being asked for often looks …

MFA Fatigue MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second …

Phishing Phishing is the most widespread form of social-engineering attack and, in a great many cases, the first link in any serious break-in. The attacker sends a messa …

Pretexting Pretexting is social engineering with a prepared story. The attacker does not simply send a link and wait for a click; they build a scenario in which what they …

SMS phishing - Smishing Smishing is phishing over SMS or messaging apps. The attacker sends a short message with a link, a request to confirm something, or an instruction for an urgent action, counting on messages being read quickly on a phone and without much checking.

Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.

Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.

voice phishing - Vishing Vishing is phishing over the telephone. Instead of an email and a link, the attacker uses a voice, a phone number and the pressure of the moment. They present themselves as a bank, technical support, a courier, the police, the tax office, or somebody from the company, while trying to extract details or lead the victim into doing something they otherwise would not.

Account Takeover … acker changes the recovery address and phone on a social network, the owner rarely gets the account back, if at all. What usually follows is a new account and b …

Contractor Abuse External associates can hold access to code, production systems, client data, the VPN, support tools or documentation. Unlike employees they are often outside t …

Deepfake Attack … technical curiosity. Deepfakes strengthen classic social engineering because they give the attacker what used to be largely out of reach: a convincing voice, fa …

Insider Threat … ployee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin wit …

Third-Party Compromise … r, a partner, a service provider or an external associate who already holds some form of trust and authorized access. Instead of forcing the front door, the att …

Watering Hole Attack … , an internal application, a forum, an industry association, or a resource used by one specific group of people.