First appeared on AGBI
A majority of cyber attacks in the Middle East rely on social engineering, malware, or exploitation of software vulnerabilities – 83% of successful attacks have a targeted nature, according to Cyber-Threat Landscape Report by Positive Technologies, an industry leader in results-oriented cybersecurity and a major global provider of information security solutions.
So why do we click? Given that October is the Cybersecurity Awareness month, let us look at the reasons that make us click and how we can ensure not to be tricked by cybercriminals.
Our personal and professional lives are entangled in the vast networks of the internet, and social engineering exploits this entanglement, often with a single, well-placed deception. Over the years, I have become increasingly intrigued by the psychology that underpins these deceptions, particularly as they’ve evolved with the advent of disinformation and generative AI (see my previous article here).
The landscape of phishing and social engineering attacks is not what it used to be. Once characterised by poorly written emails from a supposed prince, today’s attacks are sophisticated, tailored and believable. The rise of disinformation campaigns and generative AI has added another layer of complexity. These technologies can generate realistic and personalised messages that can easily deceive an unsuspecting individual. This evolution reflects a deep understanding of human psychology and our sociable nature.
What makes us click? At the heart of social engineering lies a profound understanding of human behaviour and psychology. Attackers prey on our innate tendencies – trust, curiosity, fear and sense of urgency.
Trust is our social glue, yet, in the digital realm, it can lead to mistakes. An adeptly created email impersonating a trusted colleague or a reputable organisation can catch us off guard, and we fall into the trap.
Curiosity is another aspect of human nature that phishers exploit. An exciting proposition or a message with a cliffhanger exploits our inquisitive nature, and we unknowingly click.
Fear is a potent tool that cybercriminals misuse. A fabricated tale of a security breach or a compromised account compels us to delve further and we click open the malicious email.
Creating a sense of urgency is often the coup de grâce in the phisher’s scheme. A concocted narrative of a fleeting opportunity or an imminent threat compels us to act hastily, and we ignore our instinct and the feeling of scepticism that might have otherwise saved us.
A well-crafted phishing email may impersonate a trusted colleague, stoke fear about a supposed security breach, or spark curiosity with a “too-good-to-be-true” proposition and before we know it, we’ve clicked, and the malicious cycle begins.
Recent years have seen a spate of successful social engineering attacks that underscore the effectiveness of these psychological exploits. Take the Twitter Bitcoin scam of 2020, for instance. High-profile accounts were hijacked to solicit Bitcoin under the guise of a charitable giveaway. The attackers exploited the trust and recognition associated with these high-profile individuals to lure people into parting with their cryptocurrency.
Another glaring example is the exponential rise in phishing-related scams during the COVID-19 pandemic. Cybercriminals preyed on the global fear and uncertainty, crafting emails impersonating health organisations or offering essential supplies. The psychological underpinning was clear: exploit the pervasive fear and urgency to prompt a click, a download, or a share of sensitive information.
The psychological sophistication of these attacks begs the question: How do we safeguard against an enemy that understands us so well? Education and awareness are crucial first steps. Understanding the psychology of social engineering and the tactics employed by cybercriminals can foster a healthy sense of scepticism and caution. It is also important to avoid haste and distractions when dealing with technology, even if it is just an email. If the email is from a colleague or an organisation, verify with them directly on a separate communication platform before responding to their initial communication channel. Trust your instinct, there will be a red flag if you read carefully and examine the message.
Moreover, it is important for individuals and organisations to adopt robust cybersecurity measures and stay abreast with the evolving threat landscape.
The marriage of psychology and technology in the realm of social engineering presents a formidable challenge. As the line between the real and the digital continues to blur, so does the line between trust and deception. The onus is on us to remain vigilant, to question the too-good-to-be-true, and to foster a culture of cybersecurity awareness that can withstand the psychological onslaught of social engineering. Do remember that you don’t just win without doing anything and hardly anything comes for free. Be especially careful with links and downloads.
In an era where disinformation and sophisticated digital deceit are the norm, understanding the “why” behind our clicks is not merely a matter of intellectual curiosity, but a crucial step towards protecting our digital lives against the ever-evolving threat of social engineering.
