Absolutely everything on this blog pertaining to the term “hacking” is meant for training and educational purposes only. WE DO NOT ENGAGE IN NOR PROMOTE ANY ILLEGAL HACKING ACTIVITY!

In this article we’ll be going over one of the most crucial steps threat actors take when they set out to infiltrate an organization- Social Engineering.

Despite organizations having the latest and greatest in Zero Trust Architecture, Social Engineering remains effective because it isn’t the systems that are being attacked and hacked, it’s the humans in an organization.

And, although it’s said so much at this point that it’s almost cliche, the human is still the weakest link and the number one vulnerability within any organization.

For anyone who is not yet familiar, Social Engineering is known as the art of Human Hacking. (and we’re not talking like in the sense of “bio-hacking either.)

Actually, if you search around the web or call upon the prompt of your favorite AI assistant, you’re likely find many so-called formal definitions of SE.

However, put simply in layman’s terms, Social Engineering entails tricking people into giving up confidential information or manipulating them into doing something, which, in the case of infiltrating an organization…that “something” usually always has a malevolent outcome.

For instance, clicking on a link that redirects the user to a malicious website, downloading a file that will install malware, or possibly even providing an attacker remote access to a system within the organization. 

Now granted, it’s also worthy to note that the art of SE isn’t exclusive to only threat actors seeking to infiltrate an organization.

SE involves the use of tactics that are also used in roles such as Sales and Marketing, Law Enforcement, Private Investigators, Security Specialist, Lawyers, Negotiators, surprisingly children to parents and vice-versa, and of course, you guessed it- penetration testers.

I’m sure there are many more that could be added to the list but these are just to get some working examples of roles that you’re readily familiar with. (Some may even argue that even psychologists use these tactics to get their patients to open up about what’s going on inside them.)

But, what all of these roles have in common, however, is that they employ using what we’ll call here, “Tactical Social Engineering.”

Tactical Social Engineering is basically a set of SE tactics used for getting immediate but short-term results.

The results are short-term in the sense that although the techniques used to carry out the SE engagement will make a powerful impact on the target, the influence itself won’t last long.

For example, these techniques can be used to get a yes out of someone in a negotiation, convince someone to make a purchase, illicit a confession from a criminal but.. after some time has passed, the person will regret their decision and oft-times try to retract or walk everything back if possible.

But how does this work?

Well, tactical SE is based on the main principle that a high-emotional state depresses critical thinking.

The scheme works like this: The Social Engineer will trigger an emotion in their target -> this in turn sends the target into emotional arousal -> which causes the target to turn off all critical thinking = once this happens the target is more inclined to break the rules, reveal a secret, cause harm to themselves or others, etc.

Here’s an outline of how this looks in action:

 Trigger an Emotion 🧠⚡

• Fear (“Your account has been compromised!”)

• Urgency (“Act now or lose access!”)

• Trust (“I’m from IT, here to help!”)

• Greed (“You’ve won a prize!”)
• Guilt (“Did you forget to pay your invoice?”)

 Emotional Arousal 🔥

• Fight or Flight response activated

• Heightened stress or excitement

• Increased cognitive load

Turns Off Critical Thinking 🚫💭

• Logical reasoning is suppressed

• Impulse-driven decision-making

• High susceptibility to manipulation

Consequences ⚠️

• Breaking Rules (Bypassing security protocols, ignoring policies)
• Unveiling a Secret (Leaking credentials, sharing confidential data)
• Harm to Self or Others (Financial loss, reputational damage, exploitation)

Now, there are 6 main risky emotions that come into play here when dealing with tactical Social Engineering: 

1. Joy (Happiness)
2. Sadness
3. Anger
4. Sensual arousal
5. Fear
6. Obsession

And, along with these 6 risky emotions there are around 8 emotional triggers, these are:

1. Authority
2. Reciprocation
3. Sensual topics
4. Greed
5. Curiosity
6. Scarcity
7. Envy
8. Significance

Now let’s take a look at how some of this all functions when they’re combined. 

The Power of Authority

For example, parents, state authorities, the bank, the president or CEO of an organization can all use the power of authority to ignite the emotional state of fear.

The authority figure tactic is very effective because the habit to obey an authority figure has been wired into our brains since childhood.

When we were kids the authority of our parents or the adults figures in our lives was limitless.

In order to survive, it was a must that we obeyed their orders and when we were kids we hadn’t developed the ability to think critically. That only came to us as adults. 

However, even though we’ve acquired that ability as adults, it is still a subconscious habit to blindly obey authority. Importantly, we all have a bias to obey different kinds of authority.

For instance, in most cases, if someone driving an unmarked Ford Taurus or Mercury Topaz with a flashing light gets behind us and pulls us over, flashes a badge, uses the correct jargon and asks us for some identification, it’s not so much our first inclination to challenge whether this is a real law enforcement agent and ask the officer to first show us some identification of theirs to prove that they are indeed an officer.

Especially, if they have on a bullet-proof vest and a visible gun in their holster.

Our subconscious mind habitually reacts to the symbols it’s processing. (If it looks like a duck, walks like a duck, quacks like a duck then it must be a duck, right?)

This is exactly the tactic that threat actors use in phishing emails when they purport to be a representative from their target’s bank, claiming there’s been an issue with the person’s account that requires urgent action or else the account will be suspended or worse yet, the target stands to lose all of the money in their account. Or something to that nature.

Better yet, how about when they purport to be the head of the IT department claiming there’s an issue with the target’s account and that the target needs to click on a link to change their password in order to avoid being locked out of the system, etc.

There’s all sorts of variations but the tactic is all the same- Some authority figure ignites fear into the target in an attempt to have them obey their demands. 

You may be thinking that you’re immune to the above examples, I get it.

But how about if you received a subpoena purporting to be from the United States District Court, or the Internal Revenue Service regarding an issue with your tax information? 

How Scarcity can make you obey

Have you ever seen those sales ads that say something to the nature of “Today Only!” or “Limited Time Offer”?

One of the tricks being used here is employing the use of deadlines.

And although deadlines can be real, very often they are artificially made and used just to influence human behavior because people view them as a point in time after which, when that time has expired, something they deemed as valuable will no longer be available to them. 

A perfect example that comes to mind here is an inmate being informed by their attorney that the DA’s offer of a considerably lenient plea bargain deal must be accepted by a certain date or else otherwise it will no longer be on the table as an option. 

In the cyber-world, imagine receiving an email stating the instructions to delete your account has been received and will be processed in 24 hours, after which, all features associated with your account will be lost and in order to retain your account you must click on the provided link to cancel the request.

Signed… Thank You, Truly Yours, The Account Team.

And of course, clicking the link will initiate something incredibly malicious. 

The examples above were just two of the emotional triggers that work on one of the risky emotions but I’m sure you can imagine the scenarios and combinations can add up to be astronomical when a crafty Social Engineer gets creative.

So the next logical thing to discuss here should be: How can someone protect themselves from falling victim to these tactics? 

Is There a Bullet-Proof Vest To Stop Social Engineering?

After gaining some knowledge about what Social Engineering is and how some of the tactics are used, one of the main questions that most people ask is “are there any technical devices or some sort of protective screen that can be used to thwart these types of attacks?”

Unfortunately, the short answer is simply, “no”. Here’s why.

Remember, a Social Engineering Attack isn’t launched against a system, it’s launched against a human’s brain.

And as much as we like to think of our brains as computers, they’re not. Sorry!

For a SE attack to be successful the attacker must put their victim’s brain into a special state of emotional arousal.

And as you may recall, there are a lot of ways to put a victim’s brain into emotional arousal.

Not only are there a lot of triggers to cause this state of arousal, there are also numerous combinations of these triggers that a skilled SE can use on a victim. 

You see, the human brain is wired to be susceptible to these triggers and absolutely no one can suppress all of these emotions forever.

That means at any given time, one may be open to some or all of these influences, dependant upon the circumstances.

Everyone has their own weaknesses that can be exploited.

And while there aren’t any technical devices we can use to protect us from these attacks, there are some things that we can proactively do on our own to be protected. 

Our first step towards being protected is being aware.

Afterall, we can’t protect ourselves from something that we don’t even know exists. Did you know about SE and these tactics before reading this article?

If so, good for you but you’d be amazed at the number of people who never even knew it was a thing, let alone how it worked.

So awareness is the first step. 

The second and perhaps the most important step is that we must work at training our brains to think critically anytime we’re overcome by an emotional state of arousal.

There are many types of physical exercises that help with this but each individual will have a preference for what works best for them.

For instance, there’s meditation techniques that help one work with focusing on our breathing.

These can be combined with various forms of the internal martial arts such as Tai Chi and QiGong. Yoga can also help with this.

The key is to find what works for you and start training. Now!

Armed with these defensive techniques, it’s possible to reach a point in our training to where any time we receive an email that triggers an emotion, we immediately stop and take a few in and out breaths to center ourselves.

Once there, we can then break free from the emotional state and think critically before responding or worst yet “reacting” to the requests in the message.

This works kind of like the advice of writing out your feelings when you’re emotionally aroused but not sending the email until the next or a couple of days, once you’ve had time to cool down and go back over what you’ve written.

Chances are you’ll completely change what you wrote the first go round or possibly may not even feel the need to send the email out any longer. 

Lastly, there are some things that we can do on the technical side ourselves like making it a habit to never click on any links from within an email.

Especially if the message is coming from an unfamiliar source.

If it looks legit but you’re not not quite convinced that it is, make a habit of navigating to the web site directly to research the information presented in the message.

Also, make sure you’re using an Anti-Virus solution that includes a web shield.

This will most times, not always, block any suspicious url’s from even being loaded in your browser.

Also, never click on shortened links.

And although a bit more on the technical know-how side, you can also investigate the header of any emails that you deem suspicious. (But I’ll write more on this part in a later post.)

Key Takeaway

• Awareness of Social Engineering tactics and emotional triggers are the first line of defense against these type of attacks.
• Training and mindfulness help counteract manipulative tactics before they lead to harmful actions being taken.

And with that, I hope you’ve enjoyed reading this as much as I enjoyed writing it.

Most importantly I hope that you at least learned something that you can put into effect immediately to help yourself and others not fall victim to any Social Engineering schemes.

Thank you very much for your time and as always, Be Blessed! 

Hack On, Ladz & Gentz!