Social Engineering

Social Engineering & Phishing Attacks 🎭🔒

🔹 What is Social Engineering?

Social Engineering manipulates people into revealing confidential information through deception, urgency, and impersonation rather than hacking systems.

---

1️⃣ Types of Social Engineering Attacks

📧 Phishing (Email Scam)

Attackers send fake emails pretending to be from legitimate sources to steal login credentials, credit card details, or install malware.
✅ Example: Fake PayPal email asking you to reset your password via a malicious link.
🔹 Prevention: Verify senders, avoid suspicious links, and use email security tools.

📞 Vishing (Voice Phishing – Phone Call Scam)

Scammers impersonate banks, government, or IT support over the phone to trick you into sharing sensitive details.
✅ Example: "Your bank account is compromised! Share your OTP to secure it."
🔹 Prevention: Never share sensitive info over calls. Call back using official numbers.

📲 Smishing (SMS Phishing – Text Scam)

Fake text messages with malicious links pretending to be from banks, delivery services, or government agencies.
✅ Example: "Your Amazon order is on hold! Click here to confirm." (Fake login page)
🔹 Prevention: Don’t click links in suspicious messages. Verify with the official source.

---

2️⃣ Other Phishing Variants

🎯 Spear Phishing (Targeted Attack)

Customized phishing attack targeting individuals with personal details.
✅ Example: Fake HR email asking you to update payroll info.

🐋 Whaling (CEO Fraud)

Scammers impersonate executives to trick employees into wire transfers or sharing sensitive business data.
✅ Example: Fake CEO email asking finance to send urgent payment.

🔄 Clone Phishing

Attackers replicate legitimate emails but replace links with malicious ones.
✅ Example: A duplicate security alert from Microsoft with a fake link.

🎣 Angler Phishing (Social Media Scam)

Fake social media profiles or messages with malicious links.
✅ Example: A fake Amazon support message on Twitter asking for login details.

🔍 Search Engine Phishing (SEO Poisoning)

Fake websites appear in top search results, tricking users into entering credentials.
✅ Example: A fake "Zoom Download" site installing malware instead.

🌐 DNS Poisoning (Pharming Attack) 🏴‍☠️

Attackers modify DNS records to redirect users from legitimate websites to malicious sites that steal data.
✅ Example: You enter bank.com, but due to DNS poisoning, you're sent to a fake bank login page.
🔹 Prevention:
✔ Use DNSSEC (DNS Security Extensions).
✔ Clear DNS cache regularly.
✔ Avoid public or unsecured DNS servers.

---

🛡️ How to Stay Safe?

✅ Verify before clicking – Check links before opening.
✅ Enable Multi-Factor Authentication (MFA) – Even if passwords leak, attackers can’t access accounts.
✅ Use email & call security filters – Block suspicious emails and calls.
✅ Never share sensitive details via email, SMS, or phone.
✅ Use VPN on public Wi-Fi to avoid MitM attacks.
✅ Report phishing attempts to IT security teams or anti-phishing organizations.

---