Social Engineering & Malware
128 cards · 10 sections
Sections▾
Social Engineering — Intro & Overview (OBJ 2.2 & 5.6)
Social Engineering
A manipulative strategy that exploits human psychology to gain unauthorized access to systems, data, or physical spaces. Targets the human element rather than technical vulnerabilities — includes both written communication and face-to-face interaction.
Pretexting
A social engineering technique where the attacker creates a fabricated scenario (pretext) to manipulate a target into divulging sensitive information or performing security-compromising actions. The attacker typically impersonates a trusted authority figure — bank official, IT support, or law enforcement.
Impersonation
Pretending to be someone else to deceive a target. The most basic form of social engineering. Enables general impersonation attacks, brand impersonation, typosquatting, and waterhole attacks.
Brand Impersonation
An attack where the attacker poses as a legitimate, trusted brand to trick victims into revealing credentials or installing malware. Commonly delivered via phishing emails, fake login pages, or cloned websites.
Typosquatting
Registering domain names that are common misspellings of legitimate sites (e.g., gooogle.com) to capture users who mistype URLs. Used to serve malware, harvest credentials, or redirect traffic. Also called URL hijacking.
Waterhole Attack (Water-Holing)
An attack where the adversary compromises a website frequently visited by the target group. Instead of attacking the target directly, the attacker poisons a site the target trusts — the 'watering hole' — and waits for victims to come to them.
Influence Campaign
A large-scale social engineering and psychological operation used to spread misinformation or disinformation targeting politics, economics, or public perception. Often state-sponsored; uses social media, fake news, and amplification techniques.
Misinformation vs Disinformation
Misinformation — false information spread without deliberate intent to deceive. Disinformation — false information spread deliberately and intentionally to deceive. The key distinction is intent.
Business Email Compromise (BEC)
A social engineering attack that uses a trusted business identity — often an executive, finance contact, vendor, or compromised business email account — to trick employees into transferring funds, redirecting payments, or disclosing sensitive data.
6 Motivational Triggers Used by Social Engineers
Social engineers exploit six psychological levers — the exam tests the complete list by name:
- Authority — perceived power/position commanding obedience; attacker impersonates manager, executive, client, or government agency (IRS, FBI)
- Urgency — compelling immediacy or time pressure that drives victims to bypass normal security procedures
- Social Proof — individuals look to others' actions as a guide; attacker uses peer posts, likes, and shares to legitimize a scam
- Scarcity — limited availability creates pressure to decide without thinking; 'only 5 spots left, sign up now'
- Likability — attacker builds rapport through friendliness, shared interests, or attraction to lower defences
- Fear — capitalizes on anxieties to compel action; often combined with Authority (FBI arrest threat, IRS payment demand)
Social Engineering Attack Categories Covered in OBJ 2.2
The exam groups human-based attack vectors under OBJ 2.2 — know every named technique:
- Phishing — deceptive email that tricks the recipient into clicking a link or revealing credentials
- Vishing — voice phishing; uses phone calls to extract information
- Smishing — SMS phishing; uses text messages
- Spear phishing — targeted phishing aimed at a specific individual using personalised details
- Whaling — spear phishing targeting senior executives (CEO, CFO)
- Business Email Compromise (BEC) — trusted business identity used for unauthorized transfers or sensitive data theft
- Pretexting — fabricated scenario to manipulate the target
- Impersonation — general pretending to be someone else
- Brand impersonation — posing as a trusted company
- Typosquatting — lookalike domain to capture misdirected users
- Waterhole attack — compromising a site the target regularly visits
- Misinformation / Disinformation — spreading false information as an influence campaign
Other Social Engineering Techniques (OBJ 2.2)
Additional named attack vectors tested in this domain:
- Diversion theft — redirecting a delivery or transaction to a different location
- Hoax — false alert or warning designed to cause panic or waste resources
- Shoulder surfing — visually observing credentials or sensitive data being entered
- Dumpster diving — searching physical trash for discarded sensitive documents or devices
- Eavesdropping — listening to private conversations or intercepting network traffic
- Baiting — leaving infected media (USB drive) for a victim to find and plug in
- Piggybacking — gaining physical access with the knowledge of an authorized person
- Tailgating — following an authorized person through a secure door without their knowledge
OBJ 5.6 — Security Awareness Practices
The primary defence against social engineering is security awareness training. OBJ 5.6 tests implementation of awareness programs:
- Anti-phishing campaigns — simulated phishing tests sent to employees to measure susceptibility and train recognition
- End user training — regular instruction on how to recognise and respond to social engineering attempts
- Reporting procedures — clear processes for employees to report suspected attacks
- Policy enforcement — acceptable use policies reinforced through training
Misinformation vs Disinformation — intent is the exam differentiator
Scenario: 'an attacker deliberately plants false news to sway an election' → Disinformation (intentional). 'A user accidentally shares incorrect information' → Misinformation (unintentional). If the scenario implies a coordinated campaign → Disinformation.
Pretexting = fabricated story; Impersonation = false identity
Pretexting always involves a made-up scenario or backstory to justify why the attacker is asking. Impersonation is the identity claim itself (I am the IT helpdesk). They often appear together — but pretexting is the broader technique; impersonation is the mechanism within it.
Urgency/scarcity = most reliable social engineering trigger on the exam
When a scenario describes an email saying 'your account will be locked in 24 hours unless you verify now' → urgency/scarcity trigger. This is the most common motivational trigger tested. Combine with authority impersonation (IT department, CEO) for BEC and executive fraud scenarios.
Waterhole attack targets the victim's trusted site — not the victim directly
Key distinction: in a direct phishing attack the attacker sends the malicious content. In a waterhole attack the attacker compromises a third-party site and waits. Scenario: 'the attacker infected an industry forum used by employees of the target company' → waterhole attack.
Typosquatting vs brand impersonation — the delivery mechanism differs
Typosquatting captures users who mistype a URL — passive; the victim navigates there. Brand impersonation involves the attacker actively sending emails or messages posing as the brand. Both abuse brand trust but via different vectors.
OBJ 2.2 vs OBJ 5.6 — attack knowledge vs defence implementation
OBJ 2.2 tests whether you can identify and name the attack type from a scenario. OBJ 5.6 tests whether you can recommend the correct awareness or training control to defend against it. If the question asks 'what type of attack is this?' → OBJ 2.2. If it asks 'what should the organization implement?' → OBJ 5.6.
Anti-phishing campaigns = simulated phishing, not just training videos
OBJ 5.6 explicitly tests anti-phishing campaigns. These are controlled simulated phishing emails sent to employees to measure click rates and train recognition — not just slideshow training. If the scenario asks 'what best tests employee phishing awareness?' → simulated phishing / anti-phishing campaign.
Motivational Triggers — 6 Types (OBJ 2.2 & 5.6)
Authority
Perceived power or position that commands obedience or respect from others. Attacker impersonates a manager, executive, important client, or government agency (IRS, FBI) to pressure compliance.
Urgency
A compelling sense of immediacy or time sensitivity that drives individuals to act quickly without following normal security procedures. Goal: bypass deliberate thinking and skip verification steps.
Social Proof
A psychological phenomenon where individuals look to the behaviors and actions of others to guide their own decisions. Attacker drives traffic or compliance by using likes, shares, and peer posts to make a scam appear legitimate.
Scarcity
Psychological pressure created by perceived limited availability of a product, opportunity, or resource. Forces quick decisions before critical thinking can intervene. Example: 'only 5 spots left, sign up now.'
Likability
An attribute of being pleasant, friendly, or agreeable that makes targets more willing to cooperate. Social engineers are deliberately likable — they use shared interests, humour, and attraction to build rapport and lower defences.
Fear
Capitalising on an individual's anxieties or concerns to compel them to act in a specific way. Examples: ransomware demanding payment to decrypt files, FBI/IRS impersonation threatening arrest. Often layered with Authority for greater effect.
Urgency — 3 Exam Scenarios Where It Bypasses Security
In every case, urgency causes the victim to skip a normal security procedure:
- Attacker at the door with arms full of boxes claims they're late for a meeting → victim swipes their own badge to let them in without checking the attacker's ID (piggybacking enabled by urgency)
- Attacker hands USB drive to front desk, claims a 5-minute presentation deadline → victim skips the malware scan policy and plugs in the device
- Caller claims account lockout with a critical deadline → help desk skips in-person ID verification and resets password over the phone
Combining Triggers Creates More Effective Attacks
Social engineers layer triggers together — identify all applicable triggers when analysing a scenario:
- Fear + Authority: 'I'm from the FBI — pay this fine now or you will be arrested' — two triggers reinforce each other
- Authority + Urgency: 'I'm the CEO and this must be done in the next 10 minutes' — seniority eliminates pushback, deadline removes thinking time
- Scarcity + Urgency: 'Only 3 left and the offer expires tonight' — limited quantity plus time limit drives impulsive action
- Rule: when a scenario contains multiple psychological pressures, name all applicable triggers in your answer
Social Proof — How Attackers Manufacture Legitimacy Online
An attacker does not need real endorsements — manufactured social signals are enough:
- Create a scam website → use phishing to get one person to post about it
- That post generates likes and shares → friends of friends see it as trusted
- People visit the site because peers appear to have endorsed it
- Mechanism: social proof replaces individual judgment with crowd behavior — if others did it, it must be safe
Urgency vs Scarcity — time pressure vs quantity pressure
Urgency: the pressure is TIME ('do it now', 'expires in 24 hours', 'deadline approaching') — no mention of limited supply. Scarcity: the pressure is LIMITED QUANTITY ('only 5 spots left', 'limited stock') — may also have a time element but quantity drives the decision. Both may appear together: 'only 3 left and the sale ends tonight' = Scarcity + Urgency.
'Attacker at the door with arms full of boxes' → Urgency (not just tailgating)
This scenario tests TWO concepts simultaneously. The physical bypass is piggybacking or tailgating; the motivational trigger that made the victim cooperate is Urgency. If the exam asks 'which trigger did the attacker use to convince the employee to open the door?' → Urgency.
Fear + Authority together → name both triggers
Scenario: 'An email claims to be from the FBI saying you owe a fine and will be arrested if you don't pay within 24 hours.' Both Fear (arrest threat) and Authority (FBI impersonation) are present — and Urgency is also layered in (24-hour deadline). The exam may accept any of the three; if asked to identify all triggers, list all three.
Social Proof scenario recognition
Scenario: 'An attacker created a fake investment site and drove traffic to it by getting social media posts liked and shared by compromised accounts.' → Social Proof. Key signal: the attack relies on OTHER PEOPLE'S apparent endorsement to make the target trust the site, not a direct phishing email. Compare: phishing = direct delivery; social proof = peer-driven trust manufacturing.
OBJ 5.6 — countermeasure for ALL six triggers is security awareness training
If the exam asks 'what control best mitigates social engineering that uses urgency/authority/fear?' → security awareness training (OBJ 5.6). Specifically: train employees to slow down when feeling pressure, verify identity before acting, and report unexpected requests from authority figures rather than complying immediately.
Impersonation Attacks (OBJ 2.2)
Impersonation
A social engineering attack where an adversary assumes the identity of another person to gain unauthorized access to resources or steal sensitive data. Success depends on prior reconnaissance — the more specific the details (name, department, floor, known issue), the more believable the deception.
Brand Impersonation
A targeted form of impersonation where an attacker poses as a legitimate company or brand using its logo, marketing language, and visual identity. Delivered via phishing emails, fake login pages, or cloned social media accounts to trick users into revealing credentials or sensitive data.
Typosquatting (URL Hijacking / Cyber-squatting)
Registering a domain name that closely mimics a legitimate site but contains deliberate typographical errors (e.g., gnail.com instead of gmail.com). Also called URL hijacking or cyber-squatting. Targets users who mistype a URL. Fraudulent domains are also called cousins, lookalikes, or doppelganger domains.
Watering Hole Attack
A targeted attack where the attacker compromises a website or service that the target group is known to visit regularly. Instead of attacking the target directly, the attacker poisons a trusted third-party site and waits for victims to come to them. Classified as a passive attack — no direct contact with the victim.
Doppelganger Domain (Cousin / Lookalike Domain)
A fraudulent domain name designed to visually resemble a legitimate one — used in typosquatting attacks. Common techniques: character substitution (0 for O, 1 for l), missing or added letters, homoglyphs. Can also exploit trusted cloud subdomains (e.g., brand.azure.com).
4 Forms of Impersonation Attacks
The exam tests all four by name — know the definition and delivery mechanism of each:
- Impersonation — adversary assumes a specific identity (IT helpdesk, co-worker, authority figure) using prior research to earn trust
- Brand impersonation — attacker mimics a legitimate company using logos and marketing language; delivered via email or fake website
- Typosquatting — attacker registers a misspelled domain to catch users who mistype URLs; passive — victim navigates there
- Watering hole attack — attacker compromises a trusted third-party site the target regularly visits; passive — victim comes to the attacker
Reconnaissance Enables Impersonation
A successful impersonation attack requires prior information gathering. Generic claims ('I work at your company') are easily identified as suspicious. Specific details — name, department, floor, known issues affecting other employees — dramatically increase believability and victim compliance.
Typosquatting Techniques
Multiple methods are used to create convincing lookalike domains:
- Character substitution — replace a letter with a visually similar character (0 for O, 1 for l, rn for m)
- Missing/extra letters — gooogle.com, amazzon.com
- Hijacked subdomains — register a subdomain under a trusted cloud provider (brand.azure.com) when the legitimate company uses a different provider
- Defensive registration — organizations counter this by pre-registering common misspellings and redirecting to the real site
Countermeasures by Attack Type
Each impersonation variant has specific mitigations the exam may test:
- Impersonation — security awareness training; verification procedures before fulfilling sensitive requests
- Brand impersonation — secure email gateways; user education; brand monitoring services to detect fraudulent accounts
- Typosquatting — register common misspellings defensively; domain monitoring services; user awareness training
- Watering hole — keep systems and software patched; threat intelligence services; advanced malware detection tools
Eli Lilly Brand Impersonation — Real-World Example
November 2020: a fake Twitter account impersonating Eli Lilly tweeted that insulin would be free for all customers. The tweet went viral. Investors sold shares believing it authentic, causing a 4% stock price drop in under 24 hours — resulting in billions in lost market capitalisation from a single tweet.
Watering hole = passive attack — attacker does not contact the victim directly
Scenario: 'an attacker infected an industry forum commonly visited by employees of the target company and waited for them to browse the site' → watering hole attack. Key signal: poisoned third-party site, attacker waits. Direct phishing sends the attack to the victim; watering holes lure the victim to the attacker.
Typosquatting vs brand impersonation — delivery mechanism differs
Typosquatting is passive: the victim mistypes a URL and lands on the attacker's site. Brand impersonation is active: the attacker sends phishing emails or creates fake social media accounts. If the scenario says 'mistyped URL' or 'wrong domain' → typosquatting. If it says 'email from the company' or 'fake account' → brand impersonation.
Impersonation succeeds through specificity — generic claims fail
Exam scenarios will describe an attacker using specific details (name, role, department, known incident) to gain trust. The attack type is still impersonation regardless of how convincing it sounds. Specificity is the technique, not a separate attack category.
OBJ 2.2 — all four are human-based social engineering vectors
Impersonation, brand impersonation, typosquatting, and watering hole attacks all appear under OBJ 2.2 (Threats, Vulnerabilities and Mitigations). They are human-targeting techniques, not technical exploits. If the scenario describes deceiving a person about identity or site legitimacy → OBJ 2.2 territory.
Security awareness training = primary mitigation for all impersonation variants
Scenario: 'what is the most effective control to prevent employees from falling for impersonation attacks?' → security awareness training. It applies across all four types. Technical controls (email gateways, domain monitoring) are secondary — the human element is the primary attack surface.
Pretexting — Demonstration & Mechanics (OBJ 2.2)
Core Mechanic — the Wrong-Guess Technique
Attacker states a plausible but incorrect detail; the target corrects it, revealing real information. No prior knowledge of the target is required to start.
- Step 1 — Establish cover: pose as a known vendor, IT support, or other trusted authority
- Step 2 — State a plausible but incorrect operational detail relevant to the target's environment
- Step 3 — Target corrects the wrong detail, revealing real information in the process
- Step 4 — Escalate: use the new credibility to request more sensitive data (IP address, credentials)
Pretexting as Reconnaissance — No Data is Innocent
Information extracted via pretexting feeds the next attack stage. Low-sensitivity data closes the intelligence gap:
- Device or software model → look up known CVEs and exploit that specific asset
- Internal IP address or hostname → direct target for network scanning or exploitation
- Confirmed vendor relationship → makes the pretext more credible for a follow-up call
- Rule: any organizational detail (model numbers, extensions, IP ranges) must be treated as sensitive
Pretexting Escalation Pattern
Each step in a pretexting call builds credibility for the next, more sensitive request:
- Open with a plausible, low-stakes reason to call (order fulfilment, vendor support)
- Extract low-risk info first (device model, department name) to establish insider-knowledge credibility
- Mirror the extracted data back to the target to reinforce trust and signal familiarity
- Escalate to high-value data (IP address, credentials, network layout) only after credibility is established
'Microsoft calling — your Windows machine is infected' → Pretexting + Vishing
Classic exam pretext scenario. Caller claims to be Microsoft, says the machine is reporting malware, asks the target to follow steps granting remote access or payment. Answer: pretexting (fabricated scenario) delivered via vishing (voice call). Both terms may be correct answers depending on what the question tests.
Instructor definition: giving true-seeming info to extract more info
'Giving some amount of information that seems true so that you'll give us more information to fill in the gaps.' If a scenario describes an attacker providing partial facts to prompt the target to volunteer real details → pretexting. The attacker does not need to know the truth to start — a plausible wrong guess is enough.
Countermeasure → security awareness training; never correct unknown callers
Exam asks 'what control best mitigates pretexting?' → security awareness training. Employees must: (1) never disclose any information to unverified callers, (2) not correct incorrect details a caller provides — correcting is the mechanism of the attack, (3) escalate unexpected vendor or IT calls to a supervisor.
Pretexting works in any channel — not just phone calls
Instructor note: 'don't fill in the gaps for other people when they're calling you, or even if they're doing it in person.' Pretexting occurs via phone, email, or face-to-face. If a scenario describes someone supplying partial false information to prompt a correction → pretexting, regardless of the delivery channel.
Phishing Attacks — 6 Types (OBJ 2.2)
Phishing
Sending fraudulent emails appearing to be from a reputable source to trick recipients into revealing sensitive information or clicking malicious links. Uses mass campaigns targeting large numbers of random recipients — a wide-net, spray-and-pray approach.
Spear Phishing
A targeted form of phishing focused on a specific individual or organization. Attacker gathers detailed information about the target first to craft a personalized, convincing email — higher customisation means higher success rate and harder to detect.
Whaling
A form of spear phishing that specifically targets high-profile individuals — CEOs, CFOs, board members, or senior executives. Greater effort and preparation required; potential reward is larger since executives can approve major fund transfers.
Business Email Compromise (BEC)
A sophisticated social engineering attack that uses a trusted business email identity — often a compromised legitimate account or a convincingly impersonated executive or vendor — to request unauthorized fund transfers, redirect payments, or steal sensitive data.
Vishing (Voice Phishing)
An attack where the attacker tricks victims into sharing personal or financial information over the phone. Attackers impersonate legitimate organizations such as banks or government agencies using social engineering techniques.
Smishing (SMS Phishing)
An attack using text messages to trick individuals into providing personal information or clicking malicious links. Messages typically create a sense of urgency and direct victims to a fraudulent website or phone number.
Phishing is a Category — 6 Named Types (OBJ 2.2)
Phishing is not a single attack but an entire category of social engineering attacks. Know all six types by name for the exam:
- Phishing — mass untargeted email campaign; wide net, spray and pray
- Spear phishing — targeted email campaign; personalised using prior research on the specific victim
- Whaling — spear phishing aimed at executives (CEO, CFO, board members)
- Business Email Compromise (BEC) — uses a trusted business email identity for unauthorized transfers, payment redirection, or sensitive data theft
- Vishing — voice/phone-based phishing; impersonates bank or government agency
- Smishing — SMS/text-based phishing; urgency-driven link or callback number
The Targeting Spectrum: Phishing → Spear Phishing → Whaling
Each step narrows the target pool and increases customisation:
- Phishing — millions of random recipients; no prior research; some recipients will happen to be customers of the impersonated brand
- Spear phishing — hundreds of known-connected targets; attacker confirms relationship first (e.g., data breach list of bank customers); email is tailored to that connection
- Whaling — one or a few named executives; extensive prior research; email is highly personalised and the reward is access to executive-level approvals
BEC — What Makes It Different from Standard Phishing
BEC is distinct because it relies on a trusted business email identity and a business process target rather than a generic mass-phishing lure:
- Trusted identity: attacker may use a compromised legitimate account or a convincing executive or vendor impersonation
- Source of trust: recipients believe the request came from a known business contact or authorized sender
- Target: finance or HR employees who handle payments and sensitive data
- Goal: unauthorized wire transfers, payment redirection, or sensitive data disclosure
Phishing vs Spear Phishing — mass vs targeted is the exam discriminator
Scenario: 'attacker sends emails to one million random addresses impersonating Bank of America' → Phishing (mass, untargeted). Scenario: 'attacker uses a data breach list to send tailored emails only to confirmed customers of that bank' → Spear Phishing (targeted, personalised, known connection). If the scenario says 'targeted', 'personalised', or 'specific individual/group' → spear phishing.
Whaling = spear phishing + C-suite target — same technique, different victim
Whaling is NOT a separate attack technique from spear phishing. The method is identical — personalised, targeted email using prior research. The differentiator is the victim's seniority: CEO, CFO, board member, or senior executive. If the scenario names an executive as the target → Whaling.
BEC = compromised real account, not a fake/spoofed account
Key exam distinction: phishing and spear phishing typically use spoofed or lookalike sender addresses. BEC uses an actual compromised internal email account. Scenario: 'an attacker gained access to the CFO's email account and used it to instruct finance to wire funds' → BEC (not phishing). The real account is what makes BEC harder to detect.
Vishing vs Smishing — delivery channel is the only differentiator
Both are phishing. Vishing = Voice (phone call). Smishing = SMS (text message). Scenario: 'attacker calls victim pretending to be the bank' → Vishing. Scenario: 'victim receives a text with a link claiming their account is locked' → Smishing. The social engineering technique (urgency, impersonation) is the same in both — only the channel differs.
If exam asks 'what type of phishing targets executives?' → Whaling (not BEC)
Whaling targets executives via a phishing email. BEC impersonates or compromises an executive's account to target other employees (finance, HR). Scenario: 'CFO received a highly personalised email tricking him into wiring funds' → Whaling. Scenario: 'attacker used the CEO's compromised email to instruct finance to transfer funds' → BEC.
Preventing Phishing Attacks (OBJ 5.6)
Anti-phishing Campaign
A controlled simulation program that sends mock phishing messages to users to measure susceptibility and reinforce recognition/reporting behavior. It is an ongoing security awareness control, not a one-time event.
Phishing Indicators
Observable warning signs that suggest a message is malicious, such as urgency, unusual requests, mismatched URLs, suspicious sender identities, and language quality issues.
Remedial Security Training
Targeted follow-up instruction for users who fail simulations or click suspicious content. It reduces repeat risk by correcting specific behavior gaps.
Anti-phishing campaigns are simulated testing plus training
OBJ 5.6 expects organizations to run recurring anti-phishing campaigns, not one-time awareness sessions.
- Run baseline user awareness training on phishing, spear phishing, whaling, Business Email Compromise (BEC), vishing, and smishing
- Conduct controlled simulated phishing campaigns to measure click and reporting behavior
- Provide remedial follow-up training for users who fail simulations
- Track trends over time and update content as threat tactics evolve
Five common phishing indicators
Users should treat these indicators as immediate warning signs in enterprise email triage:
- Urgency or pressure to act immediately
- Unusual requests for credentials, payment data, or other sensitive information
- Mismatched URL display text versus actual destination link
- Suspicious sender addresses, spoofed display names, or non-official domains
- Poor spelling/grammar or otherwise unprofessional message quality
Operational response flow after a reported phishing message
Preventing phishing attacks requires a combination of effective training, vigilance in recognizing phishing attempts, and a swift response to reported suspicious messages.
- Train users continuously and run anti-phishing simulations
- Teach users to recognize indicators: urgency, unusual requests, mismatched URLs, suspicious senders
- Report and triage suspicious messages quickly, then improve security controls based on lessons learned
Primary control for reducing phishing success -> Security awareness training
Scenario asks for the primary defense against social engineering or phishing in an enterprise -> choose ongoing user security awareness training (OBJ 5.6), reinforced with recurring anti-phishing campaigns.
Primary method to test user phishing awareness -> Simulated phishing campaign
If choices include policy memo, annual video, and simulated phishing email tests, the exam-aligned answer is anti-phishing campaign using controlled simulation.
Displayed link and destination URL do not match -> phishing indicator
Scenario shows a trusted brand URL in the displayed text (for example, paypal.com/login) but hover reveals a different domain -> treat as a phishing attempt and report using the defined process.
Conducting an Anti-Phishing Campaign (OBJ 5.6)
Anti-phishing Campaign
A controlled phishing simulation used to measure user susceptibility and improve security awareness behavior through follow-up training.
Simulated Phishing Email
A benign test message designed to mimic real phishing tactics so organizations can assess recognition and reporting behavior.
Remedial Training
Targeted user training provided after a phishing simulation failure to correct risky behavior and reduce repeat clicks.
Operational workflow for a phishing simulation campaign
a practical campaign flow from target setup to post-click training:
- Create a campaign and define target recipients
- Select a realistic phishing template (for example, social-network invitation theme)
- Configure sender display/domain cues and campaign schedule
- Choose training trigger timing (immediate when phished or at campaign end)
- Launch campaign, analyze results, and assign remedial training
Detection behaviors being tested in the simulation
The campaign checks whether users identify common phishing indicators before clicking:
- Misspelled or suspicious sender addresses/domains
- Displayed link text that does not match destination URL
- Brand impersonation with lookalike visual formatting
- Credential-harvest intent after link click
Safe user action pattern for suspicious emails
Users should avoid in-message links and navigate directly to known trusted domains to verify requests.
- Do not click embedded links in unexpected messages
- Open a new browser session and enter the known legitimate site manually
- Authenticate and validate request status from the trusted platform directly
Primary control for testing phishing awareness -> Simulated anti-phishing campaign
Scenario asks how to measure whether users can detect phishing in practice -> use a controlled phishing simulation campaign, not only policy reminders or static training.
Link display text differs from destination URL -> Phishing indicator
Scenario shows trusted brand wording but hover reveals an unrelated domain -> treat as phishing and follow reporting procedures.
Primary safe response to suspicious email link -> Navigate directly to known site
Scenario asks what user should do instead of clicking a suspicious embedded link -> open a new browser and access the known legitimate domain directly.
Frauds and Scams (OBJ 2.2)
Fraud
A wrongful or criminal deception intended to result in financial or personal gain. In social engineering contexts, the victim is manipulated into handing over money or information.
Identity Fraud
Unauthorized use of another person's personal information to deceive, commit crime, or obtain benefit. CompTIA commonly uses identity fraud as the umbrella term.
Identity Theft
A form of identity abuse where the attacker attempts to fully assume the victim's identity. Often used interchangeably with identity fraud in practice.
Invoice Scam
A scam in which a target is tricked into paying a fake invoice for goods or services not legitimately ordered.
Fraud vs direct theft
Fraud relies on deception and victim participation, while direct theft typically involves unauthorized taking without victim consent.
- Fraud: victim is manipulated into approving payment or disclosing sensitive information
- Direct theft: attacker bypasses controls and takes assets directly
- Exam signal: if deception prompts user action, classify as social engineering-driven fraud
Invoice scam pretext flow
A common business social engineering pattern follows this sequence:
- Attacker initiates call and establishes pretext using operational details
- Victim confirms/corrects details and provides verbal acknowledgment
- Goods arrive, then inflated invoice is issued using recorded 'yes/okay' as pressure
- Goal is financial payment through manipulated business process
Low-tech and technical variants can coexist
Invoice scams may be executed by phone/social pretexting or by spear-phishing with malware-laced attachments.
- Low-tech variant: social pretexting and fraudulent billing
- Technical variant: spear-phishing invoice PDF with embedded malicious code
- Potential payload outcome: remote access trojan (RAT) installation
User tricked into paying fake bill -> Invoice scam
Scenario describes payment request for goods/services never legitimately ordered, often after deceptive confirmation call -> classify as invoice scam.
Unauthorized card use vs full identity assumption -> Identity fraud vs identity theft
Scenario shows attacker making charges with victim payment details -> identity fraud. Scenario shows attacker using full victim identity for employment/credit/accounts -> identity theft.
Unexpected invoice PDF from untrusted sender -> Analyze before opening
Scenario includes invoice-themed spear-phishing attachment -> treat as potential malware delivery, not routine billing workflow.
Influence Campaigns (OBJ 2.2)
Influence Campaign
A coordinated effort to shape public perception or behavior toward a cause, person, or group. Campaigns may be benign or malicious.
Misinformation
False or inaccurate information shared without intent to cause harm or deceive.
Disinformation
Deliberately created and distributed false information intended to deceive, mislead, or manipulate.
Intent is the core differentiator: misinformation vs disinformation
Both involve false information, but exam classification depends on intent:
- Misinformation: false information spread without malicious intent
- Disinformation: false information spread with deliberate deceptive intent
- If scenario includes coordinated manipulation goals, classify as disinformation
Social media amplifies influence operations
Modern platforms increase speed, scale, and reach of influence campaigns while reducing effective pre-publication verification.
- Rapid distribution to large audiences
- Algorithmic amplification of divisive content
- Low-friction account creation enabling fake personas and coordinated posting
Motivations include political and financial outcomes
Influence campaigns are not limited to election interference; they can also be used for fraud and direct monetary gain.
- Political motivation: manipulate public opinion or election narratives
- Financial motivation: exploit trust in high-profile accounts for scams
- Operational overlap: compromised accounts plus deceptive messaging
Mitigation strategy is multi-layered
Defensive response requires both user-level and platform/system-level controls.
- Promote media literacy and source validation
- Use fact-checking and verification workflows before sharing content
- Increase transparency, accountability, and oversight for sponsored/distributed content
False info shared accidentally -> Misinformation
Scenario describes users sharing inaccurate claims because they believe them to be true -> classify as misinformation.
False info spread intentionally to manipulate -> Disinformation
Scenario includes coordinated fake accounts, targeted narratives, or deliberate deception goals -> classify as disinformation.
Compromised high-profile accounts promoting crypto giveaway -> Influence-enabled scam
Scenario shows trusted public figures' accounts posting financial bait and victims sending funds -> identify influence campaign mechanics with fraud objective.
Other Social Engineering Attacks (OBJ 2.2)
Diversion Theft
A social engineering technique that creates distraction or redirects workflow/traffic so theft can occur, including physical diversion and traffic redirection to fraudulent destinations.
Hoax
A malicious deception distributed through communication channels to trigger panic, confusion, or unsafe actions. Hoaxes are often paired with phishing or impersonation attempts.
Shoulder Surfing
Unauthorized observation of sensitive information such as PINs, passwords, or other confidential data during user entry or handling.
Dumpster Diving
Searching discarded physical or digital data sources for sensitive information not securely disposed of.
Eavesdropping
Secretly listening to private communications, including voice conversations or intercepted digital traffic.
Baiting
An attack that uses enticing physical or digital bait (for example, infected USB media) to induce users to execute malicious content.
Piggybacking
An unauthorized entry attack where an authorized user knowingly or negligently allows another person to enter a restricted area.
Tailgating
An unauthorized entry attack where an attacker follows an authorized user into a restricted area without the authorized user's knowledge.
Virtual (Digital) Dumpster Diving
Searching recycle bins, deleted files, or residual digital storage artifacts to recover sensitive data that was not securely erased.
Core attack list for this objective segment
Knowthese social engineering attacks and each should be recognized by name:
- Diversion theft
- Hoaxes
- Shoulder surfing
- Dumpster diving
- Eavesdropping
- Baiting
- Piggybacking and tailgating
Diversion theft can be physical or technical
The same deception pattern appears across physical operations and network/web workflows.
- Physical variant: distraction enables accomplice theft
- Technical variant: users are redirected to attacker-controlled sites
- Example vector: Domain Name System (DNS) spoofing used to route users to counterfeit pages
Preventive controls for observation and disposal attacks
Shoulder surfing and dumpster diving require both user behavior controls and environmental controls.
- Use privacy screens and keypad shielding in open workspace layouts
- Shred sensitive paper documents and enforce clean desk policy
- Securely delete and overwrite retired digital files to reduce recoverability
Hoax recognition requires source and technical plausibility checks
Users should validate both source reliability and whether the technical claim is plausible for their operating environment.
- Verify origin before acting on urgent warnings
- Fact-check claims using trusted sources
- Reject technically impossible claims for the system in use (for example, incorrect platform malware claim)
Communication security reduces eavesdropping risk
Eavesdropping spans in-person conversations, telephony, and network interception.
- Use encrypted communication channels for data in transit
- Patch and update systems to reduce interception opportunities
- Treat on-path interception scenarios as covert listening threats
Piggybacking vs tailgating is a consent distinction
Both attacks bypass physical access control, but they differ in authorized-user awareness/assistance.
- Tailgating: unauthorized person follows without the authorized user's knowledge
- Piggybacking: authorized user knowingly or negligently allows entry
- Both result in unauthorized access; scenario wording determines classification
Redirected to fake site after entering valid URL -> Diversion theft via Domain Name System (DNS) spoofing
Scenario indicates user typed a legitimate address but landed on a lookalike credential page -> classify as diversion/redirection attack pattern.
Unknown person follows employee through secured door unseen -> Tailgating
If the authorized employee is unaware the attacker entered behind them, the correct label is tailgating.
Employee holds door for unverified delivery person -> Piggybacking
If the authorized user actively permits entry, the correct label is piggybacking.
Found USB inserted into corporate workstation -> Baiting
Scenario includes curiosity-driven use of unknown removable media leading to malware risk -> classify as baiting.
Security alert conflicts with user platform -> Hoax indicator
Scenario presents malware warning inconsistent with the user's operating system context -> treat as potential hoax and verify with trusted internal/security channels.