Documented social engineering incidents targeting the cross-sector / multiple industries sector, sourced and fact-checked.
Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that up to 98% were picked up and 45% were plugged in and opened, with the first connection occurring in under six minutes, the first rigorous, quantified real-world proof that USB-baiting works.
Reported/allegedA job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What happened, what's verified and what to check.
DocumentedSomeone used the White House chief of staff's phone contacts and an AI-like voice to call senators and executives, asking for a pardon list and cash.
DocumentedIn the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a barcode or QR code arrives by text or email, with orders to pay it at a store checkout. By the middle of 2026, PG&E customers had reported more than $211,000 in losses, and the company suspects the barcode trick is part of why.
DocumentedFraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it, the logins were dead. What that tells us.
Research/advisoryNoma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5 expired domain. A lab demo, fixed in Sept 2025.
Research/advisoryTask scams start with a job text and end with crypto deposits to unlock fake earnings. FTC: reports rose from 5,000 to 20,000; $223M lost in six months.
DocumentedA victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of the usual ClickFix paste-and-run trick, abused the Windows search-ms protocol to pull a disguised LNK/PDF from an attacker SMB share, ultimately installing an MSI that fingerprinted the host and dropped the MetaStealer infostealer.
Research/advisoryThe FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the number means and what it doesn't.
Research/advisoryThe FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the FBI says to do about each.
DocumentedIn 2025 the US sanctioned North Korean fronts that place fake IT workers abroad, and a US laptop farm operator got 102 months. How the scheme works.
DocumentedTwo New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen identities of real Americans to hold remote jobs at more than 100 US firms, generating over $5 million for the DPRK regime and enabling theft of ITAR-controlled defense data before both were sentenced to federal prison in April 2026.
DocumentedNearly 200 "missed voicemail" emails from hijacked Office 365 accounts carried QR codes to fake Microsoft logins. Why email gateways missed them.
DocumentedGootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to cease on March 31, and returned on November 5, 2025 with a lure page that redraws for visitors who pass its gates into an impersonation of a real institution built from Cyrillic lookalike letters, a glyph-swapping WOFF2 web font that keeps malicious filenames out of the page source, and a deliberately malformed ZIP that the built-in Windows extractor turns into a working JScript loader while 7-Zip, WinRAR, Python and VirusTotal either fail on it or produce a .txt of the same name, spread over 100 websites and thousands of keywords, feeding the Supper SOCKS5 backdoor and, via Storm-0494 and Vanilla Tempest, ransomware staging.
DocumentedThe SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses at nine public companies and examined how internal accounting controls should account for cyber-related fraud.
Social Engineering Examples