The Human Vulnerability: A Social Engineering Deep Dive

Overview

Social engineering remains one of the most effective attack vectors because it targets the one element every organisation has: people. Technical controls can be robust, but a single well-crafted phone call or email can render them irrelevant.

This simulation walks through a realistic social engineering campaign targeting a mid-sized organisation, from open-source intelligence (OSINT) gathering through to credential theft and lateral movement.

Phase 1: Reconnaissance — Gathering the Building Blocks

The attacker begins with zero knowledge of the target organisation and spends 48–72 hours on passive reconnaissance.

Open-Source Intelligence (OSINT) Gathering

LinkedIn is the attacker's first stop. By searching for employees by role and department, they build a target list:

- Sarah Chen — IT Helpdesk Manager (joined 2 years ago, previously at MSP)
- Marcus Williams — Finance Director (listed on company charity event page)
- Dr. Emily Torres — Head of Research (published papers with work email)
- James Rodriguez — CEO (active on industry forums, uses personal email for work discussions)

Job postings reveal technology stack. A current "Senior AWS Engineer" listing tells the attacker the organisation uses AWS, while a "SOC Analyst Level 1" posting reveals the security team is understaffed.

Data leaks and breach databases are checked for recycled passwords. Even if passwords are old, the attacker notes email formats for later crafting convincing phishing emails.

Tools Used

• theHarvester — Email and subdomain enumeration
• Google dorks — Searching for exposed documents (site:target.com filetype:pdf)
• Shodan — Identifying exposed services and VPN portals
• Maltego — Relationship mapping between employees

Phase 2: The Pretext — Building a Believable Persona

Armed with employee names, the attacker crafts a pretext — a fabricated scenario designed to elicit action.

Scenario: The IT Audit

The attacker poses as "Alex Morgan" from a third-party cybersecurity audit firm contracted by the CEO. The pretext: a mandatory security review requiring password resets and MFA re-enrolment.

The attacker creates:

1. A convincing email template using the target's actual email signature format
2. A cloned internal IT portal hosted on a lookalike domain (target-secure_audit.com vs target-secure-audit.com)
3. A phone script for vishing (voice phishing) follow-up calls

The Email

From: [email protected]
To: [email protected]
Subject: URGENT: Security Audit — Action Required by EOD

Hi Sarah,

As part of our Q3 security audit (engagement #AUD-2024-089, authorised
by James Rodriguez), all IT staff must re-enrol their MFA tokens and
reset their domain passwords via the secure portal below:

[ LINK: https://target-secure_audit.com/re-enrol ]

This must be completed by 5:00 PM today. Non-compliance will result
in account suspension.

Please contact me directly if you have questions.

Regards,
Alex Morgan
Lead Security Auditor

Phase 3: The Hook — Credential Harvesting

Sarah clicks the link. The landing page is a pixel-perfect clone of the company's internal Azure AD login page. She enters her credentials and MFA code.

The attacker now has:

• Domain username and password
• A valid MFA session token (passed through to the real Azure AD to generate a real session cookie)
• Internal knowledge of IT ticket systems

MFA Bypass Technique

The cloned portal acts as an adversary-in-the-middle (AiTM) proxy. It forwards credentials to the real Azure AD and captures the session cookie returned after MFA is satisfied. This session cookie is then used by the attacker from their own browser — MFA is effectively bypassed.

┌─────────┐     ┌──────────────┐     ┌──────────┐
│  Sarah  │────▶│  Fake Portal │────▶│ Azure AD │
│ (victim)│     │  (attacker)  │     │  (real)  │
└─────────┘     └──────────────┘     └──────────┘
                      │                     │
                      │   Session cookie    │
                      │◀────────────────────│
                      │                     │
                      │  Captured!          │
                      ▼                     │
                ┌──────────────┐            │
                │  Attacker    │◀───────────┘
                │  steals      │
                │  session     │
                └──────────────┘

Phase 4: Lateral Movement & Persistence

With Sarah's session cookie, the attacker:

1. Accesses the IT ticketing system — finds open VPN requests, network change forms, and employee personal information
2. Resets a service account password via the IT portal (using Sarah's admin privileges)
3. Creates a mail forwarding rule on Sarah's mailbox to silently forward emails containing "password" or "reset" to an external address
4. Drops a lightweight backdoor via a phishing reply to an existing ticket thread — the IT technician downloads and runs the "debugging tool"

Detection & Prevention

Red Flags Missed

• The email domain (target-cyber-audit.com) was registered 3 days ago
• The cloned portal lacked the company's internal security certificate
• Sarah bypassed the standard process by not verifying the audit via official channels
• No security awareness training covered AiTM phishing techniques

Defensive Measures

Key Takeaways

• Technical controls alone are insufficient — the human element must be addressed
• MFA is not a silver bullet — AiTM proxies can bypass TOTP and push-based MFA
• OSINT makes social engineering highly targeted — the more public information exists, the more convincing the pretext
• A verification culture (confirming requests via a secondary channel) is one of the most effective defences

"The most expensive firewall in the world can't stop an employee from clicking 'Accept' on the wrong dialog box." — Unknown