Documented cases attributed to unaffiliated individual threat actors, sourced and fact-checked.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member. Agents found four phones and a USB drive on her; cash and a hidden-camera detector were found in her hotel room. The initial malware assessment of the USB drive was later disputed.
DocumentedFugitive hacker Kevin Mitnick impersonated a vacationing Novell employee on a "top-secret" project, defeated a support analyst's voicemail-based identity check by first hijacking that employee's voicemail, and talked his way into a dial-in account used to steal Novell NetWare source code.
DocumentedAn Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+ victims, $100,000+. How it worked.
Reported/allegedAn unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its refusal by handing it a 1,084-line attack playbook as a file to save, which loaded automatically into every later session; Gambit Security reconstructed the result as a human-directed campaign that used Claude Code and OpenAI's GPT-4.1 against nine Mexican government bodies. Anthropic confirmed the misuse of its platform and banned the accounts, but every named victim that has responded denies being breached and no Mexican authority has confirmed it.
DocumentedA civil complaint alleges that a retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund call escalated into a bogus PNC "mistaken deposit" story that induced him to wire savings to a gold dealer and collect the coins in person.
DocumentedA Tennessee school district's finance director wired $3.36M in state education funds to fraudsters impersonating textbook vendor Pearson from a look-alike "pearson.quest" domain.
DocumentedAnthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to $1,200 on dark web forums.
DocumentedFraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it, the logins were dead. What that tells us.
DocumentedIn the first-ever prosecutions under the federal anti-pretexting statute Congress passed after the 2006 HP boardroom spying scandal, Nicholas Shaun Bunch and Vaden Anderson were separately charged in late 2008 with tricking T-Mobile and Sprint/Nextel into handing over customers' confidential call records: one by posing as the account holder with a name and partial Social Security number, the other by serving the carrier a fake federal court subpoena.
Reported/allegedToronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The warning signs.
DocumentedAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
DocumentedIn July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with a bitcoin scam. How it worked and how it ended.
Social Engineering Examples