Social Engineering — Vishing, SMShing, and Deepfakes

What Social Engineering Is and Why It Bypasses Technical Controls

• Social engineering is the psychological manipulation of people to perform actions or disclose sensitive information. Unlike exploits that target software bugs, social engineering targets the human element — the most vulnerable component in any security architecture.
• MITRE ATT&CK maps social engineering primarily under T1566 (Phishing), with sub-techniques for Spearphishing Voice (T1566.004) and Spearphishing via Service (T1566.003). Deepfakes are an emerging attack vector that extends traditional voice/social engineering to include AI-generated impersonation.
• Social engineering attacks are effective because they bypass technical controls: email filters catch phishing, but they cannot stop a phone call. MFA stops credential theft, but it cannot stop a user who is socially engineered into approving a push notification.
• According to the Verizon DBIR, social engineering is involved in over 70% of data breaches. Vishing and SMShing attacks have increased by over 300% since 2020 as attackers adapt to better email security.

Vishing — Voice Phishing

How Vishing Works

Vishing (voice phishing) uses telephone calls or voicemail to extract credentials, financial information, or access. Attackers impersonate trusted entities — IT support, help desks, bank fraud departments, or executive leadership.

The attack flow typically follows this pattern:

1. Reconnaissance — The attacker gathers information about the target from OSINT sources: LinkedIn job titles, organizational charts, data breach dumps, or OSINT tooling
2. Caller ID spoofing — The attacker uses VoIP to spoof the caller ID, making the call appear to come from a trusted internal number or vendor
3. Social script execution — The attacker follows a script tailored to the target’s role and the desired outcome (credential reset, MFA approval, wire transfer)
4. Information extraction — The attacker extracts the target information or action during the call

Common vishing scenarios:

Detection — Vishing

Vishing is notoriously difficult to detect at the technical level because the attack happens over voice — not through email or web traffic. Detection relies on:

SPL query — detect password reset shortly after call activity:

index=windows EventCode=4724
| eval call_window = bin(_time, 900)  (15-minute window)
| lookup internal_call_log.csv call_window, TargetUserName OUTPUT CallSource, CallDuration
| where isnotnull(CallSource)
| eval alert = "HIGH — password reset for " . TargetUserName . " within 15 minutes of call from " . CallSource
| table _time, TargetUserName, CallSource, CallDuration, alert
| sort - _time

Response — Vishing

SMShing — SMS Phishing

How SMShing Works

SMShing (SMS phishing) uses text messages to deliver malicious links or request sensitive information. Mobile devices have fewer security controls than corporate laptops — no EDR, limited URL filtering, and users are conditioned to trust text messages.

Common SMShing vectors:

Detection — SMShing

Response — SMShing

Deepfakes — AI-Generated Voice and Video Attacks

How Deepfake Social Engineering Works

Deepfake technology uses generative AI to create realistic voice or video impersonations. An attacker needs as little as 3-10 seconds of a target’s voice — from a voicemail greeting, a YouTube interview, or a conference recording — to generate convincing audio.

Deepfake attack scenarios:

In 2024, a finance worker in Hong Kong was tricked into transferring $25 million after attending a video call with deepfake versions of the company’s CFO and colleagues.

Detection — Deepfake Attacks

Prevention — Deepfake Social Engineering

The key principle: any request involving money, credentials, or access changes must be verified through a second channel. A phone call is not a second channel if the attacker is the one making the call.

Detection — Cross-Channel Correlation

The most effective detection approach for social engineering is cross-channel correlation: tracking the same user across voice, SMS, email, and authentication events.

KQL query — cross-channel social engineering correlation:

// Find users who received a suspicious call AND had authentication anomalies
let suspicious_calls = (
    // Replace with call log data source
    datatable(CalledUser:string, CallTime:datetime, CallerNumber:string)
    [ ]
);
let auth_anomalies = (
    SigninLogs
    | where TimeGenerated between (datetime(now-24h) .. datetime(now))
    | where ResultType != "0"  (failed or anomalous)
);
suspicious_calls
| join kind=inner auth_anomalies on $left.CalledUser == $right.UserPrincipalName
| where datetime_diff('hour', SigninLogs.TimeGenerated, CallTime) < 2
| project CallTime, CalledUser, CallerNumber, SigninTime=SigninLogs.TimeGenerated, ResultType, ResultDescription
| sort by CallTime asc

Prevention — Defense in Depth for Social Engineering

Related

• Phishing — detection and response for T1566 techniques
• Business Email Compromise Response — detection and response for T1566, T1114, T1098, T1586 techniques
• Insider Threat — detection and response for T1078 techniques
• Credential Theft Incident Response — detection and response for T1558.001, T1003.001, T1134 techniques
• MFA Fatigue — detection and response for T1110.004, T1621 techniques

Sources

• Verizon DBIR 2024
• FBI — Deepfake Fraud
• MITRE ATT&CK T1566
• CISA — Social Engineering Awareness
• Hong Kong deepfake fraud case