Master10
Cybersecurity & Digital Safety Module

Phishing & Social Engineering

Social engineering manipulates human cognitive biases rather than exploiting hardware flaws to breach secure systems. Threat actors deploy targeted vectors such as spear phishing against corporate executives, voice-based vishing, and SMS-driven smishing to execute unauthorized credential harvesting. These deceptive communications impersonate trusted banking portals, government departments, or enterprise administrators using homograph domain spoofing and forged cryptographic certificates. Defensive architectures rely on multi-factor authentication (MFA) via FIDO2 hardware tokens, DMARC email authentication protocols, and strict identity verification workflows. In modern competitive examinations, questions assess threat classification, social manipulation techniques, and preventative authentication protocols.

Key Concepts & Examination Highlights

  • Spear phishing targets specific individuals using tailored personal information, distinguishing it from untargeted mass phishing campaigns.
  • Vishing utilizes voice telephone communications and VoIP spoofing, whereas smishing exploits SMS channels to deliver malicious links.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents email spoofing by verifying SPF and DKIM records.
  • FIDO2 authentication standards enforce public-key cryptography via hardware tokens to prevent credential harvesting attacks.
  • Pretexting is a social engineering tactic where an attacker invents a fabricated scenario or pretext to manipulate a victim into releasing confidential information or granting unauthorized access.
  • Baiting involves tempting victims with physical or digital lures—such as malicious USB flash drives left in public areas or free software downloads—to compromise systems.
  • Quid pro quo attacks occur when an attacker requests critical information directly from a target in exchange for a promised service or benefit, such as fraudulent IT technical support.
  • Multi-Factor Authentication (MFA) mitigates phishing risks by requiring two or more independent authentication factors: something you know (password), something you have (OTP/token), and something you are (biometrics).
  • Typosquatting (URL hijacking) involves registering domain names that are slight misspellings of popular legitimate websites to deceive users into visiting fraudulent phishing portals.
  • Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC are standard email authentication protocols designed to prevent email spoofing and phishing domains.
  • Business Email Compromise (BEC) is a sophisticated form of cyber fraud where attackers compromise or spoof legitimate corporate email accounts to authorize fraudulent wire transfers.
  • Whaling is a specialized form of spear phishing that specifically targets high-profile corporate executives, politicians, or military leaders to extract trade secrets or financial approvals.
  • Clone phishing involves intercepting a legitimate, previously delivered email containing an attachment or link and creating an identical cloned copy with malicious links replacing genuine ones.
  • Angler phishing is a social engineering attack where fraudsters create fake customer support accounts on social media platforms to intercept consumers complaining publicly about brand issues.
  • Water-holing is a targeted cyber attack where an adversary identifies websites frequently visited by a specific organization, compromises those sites, and infects visiting employees with malware.
  • Shoulder surfing is a physical social engineering technique where an attacker observes a victim's keyboard, phone screen, or keypad in public places to capture passwords, PINs, and sensitive data.
  • Dumpster diving involves searching through an organization's physical trash bins or discarded electronics to recover confidential documents, hard drives, printed passwords, or system diagrams.
  • Tailgating (piggybacking) is a physical security breach where an unauthorized individual closely follows an authorized employee through a secure access control door without presenting credentials.
  • Deepfake vishing uses AI voice cloning algorithms to simulate the exact voice of a company executive, family member, or bank official to instruct urgent fraudulent wire transfers.
  • Reverse social engineering occurs when an attacker establishes an authoritative position so that victims spontaneously reach out to the attacker for help, such as via fake IT warning popups.
  • Pharming is an advanced phishing technique that exploits DNS cache poisoning or local host file manipulation to redirect users from legitimate URLs to fraudulent websites without their knowledge.
  • Security Information and Event Management (SIEM) platforms aggregate log data and user activity across corporate networks to detect anomalous phishing and data exfiltration patterns.
  • DMARC policies specify actions for failing emails: p=none (monitor only), p=quarantine (send to spam folder), and p=reject (block delivery completely at the recipient mail gateway).
  • Security awareness training and simulated phishing campaigns test organizational resilience by exposing employees to controlled phishing scenarios to reduce click-through rates on real attacks.
  • The Principle of Least Privilege (PoLP) dictates that users and processes must be granted only the minimum necessary access rights required to perform their specific job functions, minimizing blast radiuses.
  • Smishing exploits Short Message Service (SMS) text messages containing fraudulent links or urgent spoofed security warnings to lure victims into revealing credentials.
  • Vishing (voice phishing) uses Voice over IP (VoIP) caller ID spoofing and interactive voice response (IVR) phone systems to trick victims into revealing financial data and OTPs.
  • Spear phishing emails are customized using reconnaissance information gathered from social media profiles, company directories, and public records to target specific individuals.
  • Watering hole attacks identify and compromise specific legitimate websites known to be visited frequently by employees of a targeted enterprise, planting drive-by exploits.
  • Credential harvesting attacks use lookalike phishing login portals to capture and record submitted usernames, passwords, and multi-factor authentication codes.
  • Homograph attacks (IDN homograph attack) use lookalike internationalized domain characters from different scripts (such as Cyrillic 'а' for Latin 'a') to deceive users into visiting fraudulent websites.
  • Tabnabbing is an attack where an inactive background browser tab secretly navigates to a fake login page of a popular service, prompting the user to re-enter credentials upon returning.
  • Consent phishing tricks users into granting malicious third-party cloud applications OAuth permissions to access their email, cloud files, and contacts without revealing passwords.
  • Brand impersonation attacks create fake social media profiles, customer support handles, and mobile apps imitating reputable financial institutions and e-commerce companies.
  • Invoice fraud (mandate fraud) occurs when attackers intercept corporate billing communications and instruct finance departments to redirect vendor payments to fraudulent accounts.
  • Executive impersonation fraud (CEO fraud) uses spoofed executive email addresses to demand urgent, highly confidential wire transfers from accounting personnel.
  • Baiting attacks can involve mailing infected USB flash drives disguised as promotional materials or company hardware directly to corporate employees.
  • Shoulder surfing can be mitigated in public environments by using polarized privacy screen filters on laptops, automated ATM keypad shields, and biometric unlocking.
  • Dumpster diving risks are countered by implementing mandatory cross-cut document shredding policies and certified physical degaussing/destruction of retired hard drives.
  • Tailgating in corporate facilities is prevented physically through mantrap access doors, turnstiles, optical security turnstiles, and mandatory visitor badge escorts.
  • Sender Policy Framework (SPF, RFC 7208) publishes authorized mail sending IP addresses in DNS TXT records to allow receiving mail servers to verify sender authenticity.
  • DomainKeys Identified Mail (DKIM, RFC 6376) attaches a cryptographic digital signature to outgoing emails, allowing receiving servers to verify that the email body has not been altered in transit.
  • Domain-based Message Authentication, Reporting, and Conformance (DMARC, RFC 7489) binds SPF and DKIM mechanisms together, specifying explicit policies for handling unauthenticated emails.
  • BIMI (Brand Indicators for Message Identification) allows organizations that have implemented strict DMARC policies to display verified brand logos next to incoming emails in supported inboxes.
  • FIDO Alliance (Fast IDentity Online) develops open authentication standards (FIDO2 and WebAuthn) utilizing public-key cryptography and hardware security keys to eliminate passwords.
  • Passkeys are digital credentials based on FIDO2/WebAuthn standards that replace passwords with cryptographic key pairs stored securely in device hardware enclaves and biometrics.
  • Security awareness training (SAT) programs utilize automated phishing simulation platforms (such as KnowBe4 and PhishMe) to measure and improve employee susceptibility to social engineering.
  • The Human Firewall concept emphasizes continuous training, institutional security culture, and clear incident reporting procedures to empower employees as active defense assets.
  • Zero Trust Architecture (ZTA), defined in NIST SP 800-207, operates on the foundational principle 'never trust, always verify', enforcing continuous authentication for every access request.
  • Dark patterns in user interface design are deceptive design layouts engineered to manipulate users into taking unintended actions, such as subscribing to recurring fees or granting data permissions.
Curriculum & Reference Sources: CERT-In Guidelines, National Cyber Security Policy, NIST Special Publication 800-63B

Sample Solved Questions & Concept Explanations

8 Verified Concept Questions
Q1.EASY

What type of cyber attack involves fraudulent communications designed to appear from a trusted entity to trick victims into revealing sensitive data like passwords and credit card numbers?

Q2.EASY

What specific term describes a highly targeted phishing attack customized with personal information to deceive a specific individual or organization?

Q3.EASY

What is the term for a phishing attack executed specifically through Short Message Service (SMS) text messages on mobile phones?

Q4.EASY

What form of social engineering fraud relies on voice telephone calls to impersonate bank officials or government authorities to extract financial OTPs?

Q5.EASY

What term is used for a targeted spear-phishing attack directed specifically against high-profile executives such as CEOs, CFOs, or board members?

Q6.EASY

Which security measure mandates that users provide at least two distinct authentication factors (e.g. password plus OTP or biometric fingerprint) before gaining access?

Q7.EASY

What physical social engineering technique involves observing a victim's keyboard or phone screen in a public place to steal their PIN, pattern, or password?

Q8.EASY

Leaving an infected, malware-loaded USB flash drive in a company parking lot hoping an employee plugs it into an office workstation is an example of which attack?