Social Engineering: Exploiting Human Psychology in Offensive Security

What it is

A Hackers Arise primer on the psychology behind social engineering, aimed at pentesters and defenders. It is conceptual, with no tooling or commands. A few specifics go beyond the catalog summary.

How it works

• Who gets targeted: The page argues that neither age nor intelligence is a reliable protector. Europol figures for fraud victims who reported to police: 18-34 made up 27.7%, 35-54 23.4%, 55-64 21.7%, and 65+ 18.5%. A joint study of 1,220 participants found no meaningful correlation between cognitive ability and becoming a fraud victim.
• Channel choice: Phone calls are called the most effective vehicle. A caller can guide the victim step by step and react to hesitation, whereas email has less room to adapt. The page says the best phishing messages fit the target's mental state at the moment of delivery, not that they are the loudest.
• Two-step sequencing: A short, safe first interaction lowers suspicion, and a second one carries the real pressure. The page says this is often more effective than opening aggressively.
• Frame-shifting past rules: A "never share passwords" rule can be sidestepped by presenting a password generator, an IT support request, or a command "for verification". Verification habits can be bypassed with fake signatures or familiar names. A USB drive framed as a personal gift avoids the suspicion an unknown device on a desk would attract.
• Overload: Fear, stress, strong excitement, or many simultaneous channels push people into automatic reaction. Even a meaningless justification raises compliance almost as much as a real one.

What to do

• Organisations: Combine training, technical controls to limit damage after a mistake, and incident response procedures for when a message, call, or request gets through. Training alone is not enough.
• Individuals: Feel free to refuse and don't feel obliged to be polite. Stop and think if a call creates stress. Don't make important decisions while overwhelmed. Don't keep a suspicious conversation going because the caller sounds official. Hanging up is often the safest choice.
• Red teams: Build scenarios around the target's trigger, not a single universal trick. Consider the phone, and the two-step approach.

Caveats

• The section titled "the 7% rule" never states a figure. The text says the baseline varies by organisation, so don't treat 7% as a sourced benchmark.
• No source is given for the "baseline click rate" claim, and it is presented as the author's experience.
• The page offers no guaranteed technique or defence.