Spearphishing tradecraft
The mass-phishing model (one lure to a million addresses, hope for 0.1%) is now mostly automated nuisance. The high-value model is targeted: a small number of recipients, each with a pretext crafted from public data.
Reconnaissance sources: LinkedIn (org chart, recent hires), GitHub (tech stack, internal hostnames in screenshots), conference talks (project names, vendor lists), data-broker dumps (personal phone, home address), company blog (current initiatives that an attacker can reference).
A good pretext aligns with the target's current week: a recent press release about a partnership, an upcoming board meeting, a recently filed 10-Q. Generic urgency (UPS delivery, password reset) is the floor; specific urgency is the standard.
Business Email Compromise
BEC outranks ransomware in dollar losses globally (FBI IC3 reports $2.9B in 2023 for BEC vs less for ransom payouts). Three subtypes:
- CEO fraud: spoofed or compromised executive email instructs finance to send an urgent wire. Often executed during travel, when verification is harder.
- Vendor invoice fraud: attacker compromises a vendor mailbox, watches for a real invoice, intercepts and re-sends with attacker bank details. The legitimacy of the underlying invoice makes this devastating.
- Payroll redirect: HR receives a request from a "current employee" to change their direct-deposit account. Often slips through if HR processes the change with only email confirmation.
The wire-recovery window is hours. Once funds reach the receiving bank and get split across mule accounts, recovery is near impossible. The FBI's Financial Fraud Kill Chain works best within 48 hours; rapid victim reporting is the bottleneck.
Deepfake voice
Cloning a voice from 30 seconds of public audio is now consumer-tooling. Two demonstrated cases:
- UK energy firm (2019): $243K wired after a call from the "parent company CEO" with cloned voice. First public case.
- Arup (2024): $25M wired by a Hong Kong finance officer after a video conference with deepfaked CFO and several deepfaked colleagues. The video call itself was the legitimacy signal that defeated the standard "call to verify" control.
Defensive shift: out-of-band verification needs to use a channel the attacker cannot also fake. Calling back to a number from the corporate directory (not the number that called) and verifying with a pre-agreed code phrase are basic controls now.
MFA fatigue
Push-based MFA (approve this login?) is convenient until an attacker with stolen credentials sends 50 prompts at 2 AM. The Uber 2022 breach used exactly this: Lapsus$ bought a contractor's password, hammered Duo prompts, then messaged the contractor on WhatsApp posing as IT to convince them to approve.
Scattered Spider (UNC3944) systematized the playbook for English-speaking SaaS targets: identify a target employee, find their personal phone via OSINT, vish IT pretending to be that employee, get a password reset and an MFA reset.
Defenses: number-matching (user types a code shown on screen rather than just tapping approve), FIDO2 hardware keys (no shared secret to push), risk-based step-up (approve from a recognized device automatically; require hardware key from a new one).
Vishing the helpdesk
The MGM breach (September 2023) cost $100M+ and started with a 10-minute phone call. Scattered Spider called the Okta helpdesk impersonating an employee whose name they got from LinkedIn, asked for a password reset, got it, and pivoted to ransomware (BlackCat affiliate).
The pattern: low-cost reconnaissance produces a plausible employee identity; the helpdesk has a ticket-velocity target; verification is checkbox theater (last 4 of SSN, manager name, both findable). The attacker gets the keys to the kingdom for the cost of a phone call.
Mitigation requires friction the helpdesk hates: in-person reset for sensitive roles, video-call verification with a corporate ID held up, callback to the corporate-directory number, and removing reset-self-service for privileged accounts entirely.
Why awareness training is mostly theater
Annual computer-based training reduces click-through rates by maybe 20% for a quarter. The realistic targets are:
- Engineering controls: DMARC enforcement (p=reject), authenticated banner injection for external mail, phishing-resistant MFA mandatory for high-risk roles.
- Process controls: dual approval for wire transfers above $X, callback to known number for any change of bank details, no self-service MFA reset for admins.
- Detection: lookalike-domain monitoring (typo-squat alerts), inbox rules that auto-forward externally (classic post-compromise IOC), unusual mailbox login locations.
Training matters at the margin. The system matters more.