🚨 Breaking News: Humans Still Clicking on Sketchy Links! 🚨

You’ve trained your employees. You’ve deployed cutting-edge security. You’ve implemented MFA. And yet… someone still clicked on the “Free iPhone 15” link in their email. 🎣
Welcome to Human Factor Security, where the greatest vulnerability isn’t your software—it’s Dave from Accounting.
From phishing emails to TOAD (no, not the Mario Kart one—Telephone-Oriented Attack Delivery), cybercriminals are weaponizing human gullibility faster than you can say “reset your password.” And if you think MFA is your ultimate shield, well… let me introduce you to Adversary-in-the-Middle (AitM) attacks.
In my latest article, I dive into: 🔹 Why phishing still reigns supreme (despite years of training)
🔹 Real-world scams that cost millions (Twitter Bitcoin scam, anyone?)
🔹 How initial access brokers sell your hacked credentials like hotcakes
🔹 The infamous social engineering stunts of Lazarus Group, Cobalt Group, and Conti
And, of course, the one question we all need to ask before clicking:
“Do I really have a long-lost Nigerian uncle?” 🤔
📖 Read more here:

Let’s face it: cybersecurity is, more often than not, an expensive Band-Aid trying to cover up the gaping wound that is human fallibility. No matter how many firewalls you build, how many endpoint protections you deploy, or how many MFA policies you enforce, the weakest link in the security chain remains the same—people. That’s right. Those lovely, well-meaning, yet spectacularly gullible creatures who will, inevitably, click on the link that promises a free iPhone 15 or an unclaimed inheritance from a long-lost Nigerian prince. Enter the realm of human factor security, where we acknowledge that cybersecurity isn’t just about securing systems but about mitigating the inevitable mistakes of the people who use them.

Phishing: The Fine Art of Baiting Humans

Among the many ways attackers exploit the human factor, phishing remains the undisputed king. It’s simple, scalable, and—thanks to automation and AI—it’s more convincing than ever. You’d think by now people would recognize the classic “Your account has been compromised, click here to reset your password” email, yet every year, organizations lose billions because Dave in Accounting still falls for it. But phishing has evolved far beyond emails—why limit yourself to inboxes when you have an entire digital playground at your disposal?

Attackers have diversified their strategies, taking their scams to:

Social Media: Fake profiles, fake customer service accounts, deepfake videos—everywhere you scroll, there’s a scammer lurking, waiting to slide into your DMs with a “limited-time investment opportunity.” A famous example is the Twitter Bitcoin scam of 2020, where attackers compromised high-profile accounts (Elon Musk, Bill Gates, Barack Obama) and posted fake investment opportunities, stealing over $100,000 in cryptocurrency.
Messenger Apps: WhatsApp, Telegram, Signal—even the supposedly secure channels aren’t immune. A known example was the WhatsApp CEO impersonation scam, where attackers posed as company executives to request sensitive information from employees.
Web Pages: Spoofed login pages, fake PayPal sites, and malware-laden pop-ups. One of the most infamous cases was the 2017 Google Docs phishing scam, where users received fake document-sharing requests, granting attackers full access to Gmail accounts.
Phone Calls (Vishing): “Hello, this is Microsoft Support! We’ve detected a virus on your computer.” No, they haven’t. A significant example was the 2022 Coinbase vishing attack, where hackers impersonated employees and gained access to internal systems.
SMS (Smishing): “Your bank account has been frozen! Click this link to verify your identity.” One well-documented case was the 2021 FedEx SMS scam, where fraudulent delivery messages tricked users into entering credentials.
TOAD (Telephone-Oriented Attack Delivery): A sophisticated phishing technique that combines phone-based scams with email. A major example occurred in the Robinhood 2021 breach, where attackers tricked a customer support employee over the phone, gaining access to five million user accounts.

The Initial Access Brokers: Phishing’s Evil Big Brother

If phishing is the digital equivalent of throwing a fishing net into the ocean, Initial Access Brokers (IABs) are the guys selling premium access to the best fishing spots. They don’t necessarily launch full-scale attacks themselves. Instead, they specialize in breaking into accounts, gathering credentials, and then selling access to those accounts to bigger, meaner threat actors—ransomware gangs, nation-state hackers, you name it.

The process is simple:

Phishing attack lands—whether via email, social media, SMS, or a fake login portal.
Credentials get stolen—maybe even via keyloggers for good measure.
Account is sold—on dark web marketplaces for the price of a fancy cup of coffee.
Bigger attacks begin—ransomware deployments, data exfiltration, corporate espionage.

Social Engineering: Where Psychology Meets Cybercrime

One might think hacking is all about fancy exploits and zero-days. But why break through a steel door when you can convince someone to hand you the key? This is the magic of social engineering, where manipulation trumps malware. Every time an attack uses a dictionary (of leaked passwords, common phrases, or known credentials), it’s a sign that the attacker is evaluating human psychology as much as technical defenses.

Some well-known examples of actors who mastered this craft:

The Lazarus Group (TA505, North Korea): Responsible for the 2014 Sony Pictures hack, where they used fake job offers and phishing campaigns to compromise internal networks.
Cobalt Group (TA505): Notorious for targeting financial institutions. One of their most impactful attacks was the Carbanak campaign, where they stole over $1 billion from global banks by impersonating bank employees.
Conti Ransomware Gang: Known for using double extortion tactics. A major attack was the Costa Rica ransomware attack in 2022, which disrupted government services and led to a national emergency.

A notable recent case was the 2023 MGM Resorts cyberattack, where social engineering played a key role. Attackers simply called the IT helpdesk, impersonated an employee, and gained access to critical systems. The breach led to millions in damages and massive operational disruptions—proving, yet again, that human gullibility is a hacker’s best friend.

The Rise of AitM (Adversary-in-the-Middle)

With the rise of multi-factor authentication (MFA), attackers have adapted. Enter Adversary-in-the-Middle (AitM) attacks, where criminals intercept authentication processes, effectively bypassing MFA protections. These attacks allow cybercriminals to steal session cookies, hijack accounts, and carry out unauthorized transactions without ever needing a victim’s static credentials.

A major example was the EvilProxy campaign in 2023, where attackers leveraged proxy phishing techniques to bypass 2FA protections on high-value accounts.

A Balance Between Security Engines and Policies

While strong security engines are crucial, policies remain just as important. One example of a simple yet effective practice is enforcing multi-channel verification. Suppose an employee receives an email requesting a funds transfer or a password reset. In that case, they should verify through a separate, secure channel like a direct phone call or an internal messaging system before taking action. This approach significantly reduces the risk of falling victim to impersonation attacks.

Human Factor Security: More Than Just Cybersecurity

Cybersecurity is just one piece of the human factor puzzle. Security extends into compliance, regulatory frameworks, and how organizations manage people as a risk factor. Consider:

Physical Security: That USB stick left on a café table? Goldmine for an attacker.
Regulatory Compliance: GDPR, CCPA—user data protection depends on how well people handle sensitive information.
Insider Threats: Internal risks remain a significant threat, whether it’s a disgruntled employee or an unwitting one.

Conclusion: We Are the Problem (And the Solution)

As long as humans remain an integral part of technology, security will always be a people problem. Phishing, social engineering, and identity-based attacks exploit our trust, habits, and (sometimes) astonishing lack of caution. The only way forward? A combination of education, AI-driven defenses, and a healthy dose of skepticism.

So next time you get an email saying you’ve won an all-expenses-paid trip to Dubai—ask yourself: “Would I even enter such a contest?” And if the answer is no, well, congratulations! You may just be too bright to get phished today.v