As cyber security threats continue to evolve, CISOs and IT professionals must stay ahead of increasingly sophisticated social engineering tactics. In this blog we take a look at some of the top social engineering threats to watch out for in 2024, with a focus on advanced AI-driven methods and traditional approaches that exploit human vulnerabilities.

1. AI-Driven Phishing Attacks

Phishing remains a significant threat, but AI has made these attacks more sophisticated and effective. Multimodal Large Language Models (MLLMs) enable attackers to craft highly personalised phishing messages that are difficult to distinguish from legitimate communications. These AI-generated emails can bypass traditional security measures by mimicking the writing style and context expected by the recipient​.

Countermeasures:

• Implement advanced email filtering solutions that leverage AI to detect phishing patterns.
• Conduct regular, targeted phishing simulation exercises.
• Train employees to recognise and report suspicious emails, even if they appear legitimate.

2. Deepfake and AI-Generated Content

Advancements in AI have enabled the creation of realistic deepfake videos and audio, which can be used to impersonate executives or public figures. These tools can spread misinformation, conduct fraud, or manipulate public opinion. The increasing accessibility of AI technology means that even low-skilled attackers can utilise these methods.

Countermeasures:

• Invest in deepfake detection technologies.
• Educate employees about the risks and signs of deepfake content.
• Verify the authenticity of video and audio communications through multiple channels.

3. Vishing and Smishing

Voice phishing (vishing) and SMS phishing (smishing) remain prevalent. Vishing involves attackers impersonating trusted entities over the phone to extract personal information, while smishing uses text messages to deliver malicious links. These methods exploit the trust people place in phone communications.

Countermeasures:

• Implement voice authentication systems for sensitive transactions.
• Use SMS filtering solutions to block known malicious links.
• Educate employees on the risks and indicators of vishing and smishing attacks.

4. Business Email Compromise (BEC)

BEC attacks involve impersonating executives or trusted partners to trick employees into transferring money or sensitive data. These attacks often include extensive research on the target to craft convincing emails. More than a quarter of the $10.9 billion in losses reported to the FBI Internet Crime Complaint Center (IC3) was directly attributable to BEC in 2023.

Countermeasures:

• Use email authentication protocols like DMARC, DKIM, and SPF.
• Implement multi-factor authentication (MFA) for email access.
• Establish strict verification procedures for financial transactions and sensitive information requests.

5. Pretexting

Pretexting involves creating a fabricated scenario to gain the victim’s trust and manipulate them into providing information. Attackers often impersonate authority figures or trusted colleagues, making the victim feel comfortable sharing confidential information.

Countermeasures:

• Develop and enforce policies for verifying identities before sharing sensitive information.
• Provide regular training on the risks and signs of pretexting.
• Encourage a culture of healthy scepticism and verification among employees.

6. Baiting

Baiting exploits human curiosity by offering something enticing to lure victims into a trap. This could be a free download or a physical item like a USB drive labeled with something intriguing. Once the bait is taken, the victim’s system is infected with malware​ (AuraSafe)​.

Countermeasures:

• Use endpoint protection solutions to detect and block malware.
• Educate employees about the risks of unknown devices and unsolicited offers.
• Implement policies for handling found devices and reporting suspicious items.

7. Bribery of Employees

Bribery involves offering monetary or other incentives to employees in exchange for sensitive information or access to secure areas. This tactic exploits the financial vulnerabilities or dissatisfaction of employees, making it a potent threat​ (AuraSafe)​​ (CommSec Cyber Security)​.

Countermeasures:

• Foster a positive work environment to reduce employee dissatisfaction.
• Implement anonymous reporting mechanisms for bribery attempts.
• Conduct regular ethics training to reinforce the importance of integrity.

8. Quid Pro Quo Attacks

In quid pro quo attacks, the attacker offers a service or benefit in exchange for information. For example, an attacker might pose as an IT support person offering to fix an issue in exchange for login credentials. This method leverages the human tendency to reciprocate favours​ (AuraSafe)​.

Countermeasures:

• Establish clear protocols for IT support requests and verifications.
• Educate employees on the risks of sharing information in exchange for unsolicited offers.
• Implement role-based access control to limit the potential impact of compromised credentials.

As social engineering threats become more sophisticated, it is crucial for CISOs and IT professionals to stay vigilant and proactive. By understanding these threats and implementing robust countermeasures, organisations can better protect themselves against the ever-evolving landscape of cyber threats.

Regular training, advanced security technologies, and a culture of awareness and verification are key to mitigating the risks posed by social engineering attacks. If you’d like to secure your organisation against social engineering threats get in contact with our experts.