Documented social engineering incidents targeting the technology & software sector, sourced and fact-checked.
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push prompts, then posed as tech support to get one approved, opening the door to Uber's internal network.
DocumentedIn 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How it happened, the tells, and what was recovered.
Reported/allegedA job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What happened, what's verified and what to check.
DocumentedSysdig says an AI agent ran the JADEPUFFER ransomware attack end to end: unpatched Langflow, stolen secrets, 1,342 configs destroyed. What happened.
DocumentedA phishing attack resulted in disclosure of 2015 W-2 data for several thousand US employees, exposing SSNs and earnings to an unauthorized party.
DocumentedA Snap Inc. payroll employee emailed the W-2 and payroll data of roughly 700 current and former employees to an attacker who spoofed the identity of Snap Inc.'s chief executive, part of a nationwide spring-2016 wave of spoofed-executive W-2 phishing that prompted an IRS public alert.
DocumentedA '2011 Recruitment Plan' email with a booby-trapped Excel file breached RSA in 2011. SecurID data was stolen and later used against Lockheed Martin, RSA said.
DocumentedA fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the rest: 27 crypto accounts hijacked. What happened.
DocumentedEvaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam worked and what came back.
DocumentedA fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
DocumentedChinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other US tech and defense firms in a campaign that stole intellectual property, targeted Gmail accounts of human-rights activists, and led Google to publicly confront China and stop censoring its search results.
DocumentedFugitive hacker Kevin Mitnick impersonated a vacationing Novell employee on a "top-secret" project, defeated a support analyst's voicemail-based identity check by first hijacking that employee's voicemail, and talked his way into a dial-in account used to steal Novell NetWare source code.
DocumentedA tech-support operator used fake Microsoft/Apple security pop-ups to scare consumers, often older Americans, into calling an India-based support line that sold bogus multi-year tech-support packages, resulting in a partially suspended $4.9M FTC judgment plus a separate DOJ prosecution and prison sentence for the operator.
Research/advisoryOpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool. How it worked.
DocumentedOpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't work how they thought. Full timeline.
DocumentedSpoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas account for a bogus acquisition.
DocumentedIn March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that one account was compromised, with limited access and no customer code or data involved. It has never put a figure on the loss. A documented incident.
DocumentedAn attacker sent a LastPass employee WhatsApp calls and a voicemail using an AI copy of the CEO's voice. The employee reported it. What gave it away.
DocumentedA fake 'reactivate your MFA' email with a QR code targeted a US MSP employee in 2023, routing through a fake security scan to a Microsoft 365 login copy.
DocumentedThe HP spying scandal began with a hunt for a boardroom leaker. Hewlett-Packard's investigators hired contractors who posed as directors and journalists to get their phone records from carriers. When it came out in 2006, it cost HP a $14.5M civil settlement with California. Then came a congressional hearing, felony charges against five people (chairwoman Patricia Dunn among them), and federal guilty pleas from three contractors.
Research/advisoryImperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script. A lab demo, now patched.
DocumentedA scammer posing as GCI's CFO emailed payroll and, after the employee's initial pushback, persuaded them to hand over 2015 W-2s for every GCI, Denali Media, UUI and Unicom worker.
DocumentedAnthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to $1,200 on dark web forums.
DocumentedFraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it, the logins were dead. What that tells us.
Research/advisoryNoma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5 expired domain. A lab demo, fixed in Sept 2025.
Research/advisoryRussian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
DocumentedThe EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to get into Electronic Arts' Slack. Posing as an employee who'd lost a phone, they got IT support to issue an MFA token. They took game source code, including FIFA 21, and asked $28 million for it. EA said no player data was accessed. A documented incident.
DocumentedA convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a real chatgpt.com/s/ URL -- used malvertising and SEO poisoning to push Windows visitors to a credential-stealing loader and Mac visitors to Odyssey Stealer (an AMOS/Atomic Stealer fork) that also swapped in trojanized Ledger and Trezor wallet apps.
DocumentedIn 2025 the US sanctioned North Korean fronts that place fake IT workers abroad, and a US laptop farm operator got 102 months. How the scheme works.
DocumentedTwo New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen identities of real Americans to hold remote jobs at more than 100 US firms, generating over $5 million for the DPRK regime and enabling theft of ITAR-controlled defense data before both were sentenced to federal prison in April 2026.
Reported/allegedToronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The warning signs.
DocumentedNorth Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed malware. How ClickFake works.
DocumentedIn August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset their passwords and MFA, phone number for SMS codes included, without checking who was calling. Operations were disrupted for weeks. Clorox wants $380 million from Cognizant. That's a claim, not a proven loss, and a March 25, 2026 ruling let three of its four claims go ahead.
DocumentedAnthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most of an espionage campaign. Critics doubt it.
DocumentedAttackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A reviewer cleared it. How it worked.
DocumentedIn 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was breached; Cloudflare's keys held.
DocumentedIn July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with a bitcoin scam. How it worked and how it ended.
Social Engineering Examples