Proofpoint: Social engineering attacks slipping past users

Executives, administrators and network defenders overlook the severity of many of the most effective social engineering tools, Proofpoint cautions.

Some of the most effective tricks used for social engineering attacks are being overlooked or underestimated.

That’s according to security vendor Proofpoint, whose 2022 Social Engineering report concluded that many companies mistakenly assume that cybercriminals are unwilling or unable to use tactics such as extended conversations, legitimate services and hijacked email threads in order to dupe their targets into opening malware and following phishing links.

Proofpoint, which specializes in tools and services to counter social engineering, argued that these assumptions are putting companies at heightened risk for network intrusions and malware infections.

“Despite defenders’ best efforts, cybercriminals continue to defraud, extort and ransom companies for billions of dollars annually,” said Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, based in Sunnyvale, Calif. “The struggle with threat actors evolves constantly, as they change tactics to earn clicks from end users.”

In general, the report found, companies underestimate the resources attackers are willing to put into social engineering attacks. For example, many believe that hacking crews will not exchange multiple messages with their targets.

In reality, the study found that many hacking operations were not only willing to exchange multiple messages with their targets in hopes of gaining their trust, but were also looking to get the target to engage over multiple forms of communication, such as personal email messages and phone calls...