How Hackers Use Your Social Media for Social Engineering Attacks
Social media connects billions of people – both friends & family… and hackers & scammers.
Cybercriminals are increasingly leveraging platforms like Twitter, Facebook, and LinkedIn to perform “social engineering” attacks, where they manipulate human trust to steal information or money.
In this article, we’ll explore real-world examples of how these attacks play out on each platform, why oversharing on public profiles can make you a target, and what you can do to reduce the risk. Finally, we’ll discuss how you can protect your online presence by removing old or risky content.
What is Social Engineering?
Social engineering (in the context of cybercrime), involves manipulating and tricking people into sharing personal or business information that can be used to exploit the target person or company.
Rather than technical hacking or breaking into systems, social engineering is focused on ‘hacking’ human behavior. Often, social engineering and technical hacking are used in tandem to carry out more sophisticated attacks.
Generally, social engineering takes place via fake emails, phone calls, social media messages, or even in-person. It can be used to target individuals and companies.
How Personal & Business Social Media Drives Up Risk for Social Engineering Attacks
Most social engineering attacks start with searching. Hackers may comb through your social media posts for pieces of information they can use to impersonate you, guess passwords, or answer account recovery questions.
Even things you posted years ago – like your high school mascot, your favorite team, or your first job – can be useful to a threat actor targeting you or your business.
Oversharing doesn’t mean telling your life story in one post. It’s about the gradual accumulation of small, personal details over time. One tweet about your favorite concert, a Facebook photo from vacation, a LinkedIn post about your promotion, the date of your anniversary – they all add up.
The more data available publicly, the easier it becomes for attackers to craft believable scams. And since old posts often slip your mind, they’re the last thing you think to protect.
Social Engineering Targeting Businesses
For businesses, the risks are even more significant – the bigger the company, the more risk they’re exposed to. A successful social engineering attack can lead to data breaches, leaked customer information, financial fraud, and even regulatory fines for the victim company.
To attack a business, threat actors will often target employees with sophisticated social engineering attacks, designed to get the cybercriminal access to internal systems. Because social engineering relies on humans rather than technical exploits, system security simply isn’t enough to mitigate the risk of an attack any more.
Social Engineering attacks are also leveraging AI to deploy social engineering tactics, coupled with deepfake technology and voice cloning. Using generative AI, threat actors can create compelling pressure campaigns. In Hong Kong, this method was used to extract $25.6 million from a finance company, through one of their workers who believed he was acting on the wishes of multiple executives at the company.
Now, businesses need to train their teams on the risks, and manage the entire digital footprint of their business – comprised of digital traces left by the company, and their employees.
An employee sharing a little too much information on public social media can create opportunities for social engineering – targeting the individual directly, or as a proxy for their place of work.
Social Engineering Targeting Individuals
While companies are a common target for sophisticated attacks, individuals are at risk of social engineering too. Less technically savvy individuals are considerably more likely to be targeted.
Individual victims of social engineering attacks might suffer;
- Identity theft
- Financial loss
- Account takeovers
- Password theft
- Harvesting private messages or data
In some cases, attackers may use sensitive, embarrassing (and often fabricated) information about the target to extort them. Similarly to social engineering targeting businesses, the success of the attack hinges on the attackers ability to manipulate the individual – often to share sensitive information.
If you know someone that might be vulnerable – please take the time to educate them on this subject.
How Redact.dev Helps Reduce Social Engineering Risk
We’ve established the social engineering risk generated by social media content – for both individuals, and the organizations they work for. Going back through ~10+ years of content, and looking for details a threat actor might leverage is a long, tedious task – especially for large companies.
Our app, redact.dev makes reducing social engineering attack surfaces easy – for both individuals and companies. With Redact, you can quickly and permanently delete old content across all major social media platforms, and work and productivity platforms (like Slack and GitHub).
Redact gives you the tools to easily bulk delete content with as much (or as little) precision as you want. You can:
- Delete almost any type of content, from almost all social platforms
- Filters your deletion to delete only content with specific keywords
- Filter your deletion based on specific days, months, or years
- Automate ongoing, regular deletion from your socials
For companies and teams looking to reduce their social engineering attack surface – all of this functionality (and more) is available to you too.
Take back control of your online footprint.
Start cleaning up your history with Redact.dev.