Documented social engineering incidents targeting the legal services sector, sourced and fact-checked.
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.
DocumentedPosing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts. BBC reporting said roughly £512,000 had been withdrawn and remained unrecovered at the time of reporting. The solicitor was suspended, declared bankrupt, and faced losing her home.
DocumentedGootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that delivered malicious JavaScript loaders, some of which escalated via Cobalt Strike into REvil ransomware attacks, a pattern CFC's Incident Response Team documented after seeing it hit multiple insured legal services firms.
DocumentedeSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023, from two separate campaigns: SEO-poisoned fake "agreement" downloads delivering GootLoader, and a compromised Notary Public website serving a fake Chrome update to deliver SocGholish to law firm employees and other business professionals.
DocumentedAir Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from outside the home of WestJet's co-founder and vice-president of strategic planning (a collection his own affidavit says involved the investigators walking onto his driveway, a claim IPSA disputed) and had shredded documents digitally reconstructed by a Houston forensic firm, as part of its corporate-espionage suit against WestJet, a fight that ended in a CAD 15.5 million WestJet settlement and public apology.
DocumentedGootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to cease on March 31, and returned on November 5, 2025 with a lure page that redraws for visitors who pass its gates into an impersonation of a real institution built from Cyrillic lookalike letters, a glyph-swapping WOFF2 web font that keeps malicious filenames out of the page source, and a deliberately malformed ZIP that the built-in Windows extractor turns into a working JScript loader while 7-Zip, WinRAR, Python and VirusTotal either fail on it or produce a .txt of the same name, spread over 100 websites and thousands of keywords, feeding the Supper SOCKS5 backdoor and, via Storm-0494 and Vanilla Tempest, ransomware staging.
Social Engineering Examples