What is social engineering?

How it works

Social engineering attacks use various methods to gain people's trust and prompt them to disclose sensitive information or perform malicious actions. These methods include phishing, vishing, manipulation through workplace communication platforms, and fake software updates.

Defense checklist5

1. 01

   Implement Multi-Factor Authentication (MFA)

2. 02

   Conduct regular training for employees on social engineering attacks

3. 03

   Implement measures to identify suspicious emails and messages

4. 04

   Regularly update and review security policies

5. 05

   Use Endpoint Detection and Response (EDR) solutions

Real-world evidence

The attack on Carnival Corporation, the rise of Teams-based social engineering attacks following Microsoft's disruption of the Tycoon2FA phishing platform, UNC6692 group's use of social engineering to deploy custom malware, and the installation of ScreenConnect via fake Adobe and Zoom updates demonstrate the effectiveness of social engineering.

Sources

• ▸1st June – Threat Intelligence Reportcheckpoint
• ▸The continuing effects of Microsoft's disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques during Q2 of 2026 (April-June), including QR code phishing and CAPTCHA-gated phishing. https://msft.it/6017vA9QT At the same time, threat actors continued to diversify delivery channels. Microsoft Threat Intelligence observed continued growth in Teams-based social engineering, particularly vishing, as threat actors expanded beyond email into trusted workplace communication platforms. Notable campaigns demonstrated how threat actors combine automation, trusted services, and multi-stage delivery chains to scale operations, including a high-volume automated BEC campaign and a phishing campaign that ultimately delivered malware through a multi-stage attack chain. Get detections, mitigation guidance, and deeper insights into phishing techniques, malicious payload trends, BEC activity, and more from this Microsoft Threat Intelligence blog post.x_msftsecintel
• ▸RT by @TheHackersNews: Attackers are getting faster. Their infrastructure is cheaper. Their targeting is automated. Their campaigns improve with every interaction. Playing whack-a-mole with domains, profiles, and lures will not stop an industrialized attack operation. Defenders need to target the metric threat actors care about most: profit. In a new article in The Hacker News, Doppel’s Vice President and Global Head of Threat Intelligence, Joshua Bartolomie, breaks down how security teams can make social engineering unprofitable by: → Disrupting reconnaissance ROI → Trapping malicious AI agents in compute-heavy conversations → Feeding false signals into attacker telemetry Takedowns remove assets. Economic disruption forces adversaries to waste time, infrastructure, and budget. Which removes the incentive to keep targeting you. Read more: https://thehackernews.com/expert-insights/2026/07/how-to-make-social-engineering.htmlx_thehackersnews
• ▸Email threat landscape: Q2 2026 trends and insightsmsft_security
• ▸Seeking Counsel: Ongoing Targeted Campaign Against US Law Firmsmandiant
• ▸Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suitemandiant
• ▸China-nexus Threat Actor Targets Arabian Gulf Region With PlugXzscaler
• ▸CIOsr_cybersecurity
• ▸Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Accesshackernews
• ▸AI developers targeted via trojanized GitHub repositorieshelpnetsecurity
• ▸AI researchers let models off the leash – then watched as they tried to add malware to a FOSS projecttheregister_sec
• ▸OpenAI, Anthropic AI agents targeted real people and systems in cyber testsbleepingcomputer