Documented social engineering incidents targeting the not disclosed / unspecified sector, sourced and fact-checked.
A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running PowerShell themselves, deploying a rarely-seen infostealer Proofpoint dubbed suspected "Lucky Volunteer" in activity assessed to overlap with the Russia-linked espionage actor UAC-0050.
Research/advisoryESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be an NYU research prototype. What it showed.
Research/advisoryA Rapid7 penetration tester tailgated into a client's building using door-holding reciprocity and a cloned-looking badge, rode an elevator up on a bystander employee's badge scan, then posed as a new security-team hire at the help desk for 30 minutes to probe whether staff would challenge him. He was ultimately stopped, seven months later, by a guard who cited that very fake-badge incident as the reason for denying access.
DocumentedEmployees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How AT&T's SOC (now LevelBlue) traced and cleaned it up.
DocumentedA fake email posing as DTC gave JE Cleantech false wire instructions for its 2026 dividend, diverting US$794,934 and delaying shareholder payments.
Research/advisoryGoogle found PROMPTFLUX, a dropper that asks Gemini for antivirus-evasion code mid-run. Its self-rewrite feature was switched off and it hit no one.
DocumentedArgan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss, net of recovered funds and including related professional fees.
Social Engineering Examples