In 2025, the fastest way into most organizations is still through a person. Attackers do not need a zero-day if they can persuade an employee to approve an MFA prompt, a help desk to reset a password, or a finance clerk to change bank details. Social engineering exploits trust, authority and urgency, and it bypasses many technical controls because the victim performs the action on the attacker’s behalf.
What has changed is the sophistication. Deception now spans email, phone, text, collaboration tools, fake browser prompts and increasingly AI-generated voice and video. Defending against it requires more than annual awareness training. It requires business processes, identity controls and detection that assume someone will eventually be fooled.
Why social engineering remains a top intrusion vector
Palo Alto Networks’ Unit 42 published a Social Engineering Edition of its 2025 Global Incident Response Report, based on more than 700 incident response cases. Between May 2024 and May 2025, social engineering was the initial access vector in 36% of incidents. Phishing accounted for about 65% of those social engineering intrusions, and 23% used callback or voice-based techniques. Two-thirds targeted privileged accounts, 45% involved impersonating internal staff, and 60% led to data exposure.
The report also described how fast a skilled operator can move. In one case, an attacker went from initial access to domain administrator rights in under 40 minutes without deploying any malware, using only legitimate tools and stolen trust. Unit 42 highlighted Muddled Libra, the group widely known as Scattered Spider, as a leading practitioner of help desk manipulation and MFA abuse; see our analysis in Scattered Spider Isn’t Gone.
A newer technique, ClickFix, shows how deception is moving beyond email. Victims see a fake CAPTCHA or error message instructing them to copy and paste a command into Windows to “fix” the problem, which installs malware such as information stealers. ESET’s H1 2025 Threat Report found ClickFix use had grown by 517% since the second half of 2024, making it the second most common attack vector it tracked after phishing.
Common techniques and why they work
| Tactic | Description | Why it works |
|---|---|---|
| Phishing, spear phishing and clone phishing | Fraudulent emails or messages that lure users into clicking links or disclosing credentials. | Personalization, increasingly AI-assisted, makes them hard to distinguish from legitimate messages. |
| Business email compromise (BEC) and CEO fraud | Impersonation of executives, vendors or partners to authorize payments or obtain confidential information. | Uses authority, urgency and real business context to pressure victims. |
| Pretexting and whaling | A fabricated scenario, such as an internal audit or urgent compliance issue, aimed at a specific senior target. | Combines research and storytelling to build credibility. |
| Vishing and smishing | Phone calls or texts impersonating IT, banks, suppliers or service providers. | Mobile channels have weaker filtering and invite quick, spontaneous responses. |
| Help desk and credential reset abuse | Attackers pose as employees and persuade support staff to reset passwords or enroll new MFA devices. | Exploits weak identity verification in support processes. |
| ClickFix and fake browser prompts | Fake CAPTCHAs or error pages instruct users to run a command that installs malware. | The user performs the “fix” themselves, bypassing download protections. |
| Deepfake voice and video | AI-generated audio or video impersonating executives or colleagues. | A familiar voice or face lowers suspicion, especially under time pressure. |
Augmented reality and multimodal AI attacks that blend visual, audio and contextual deception remain largely theoretical, but the building blocks, such as real-time voice cloning, already exist. For more on the deepfake threat, see Deepfakes Are on the Rise.
Real-world example: “Payroll Pirates”
In October 2025, Microsoft Threat Intelligence described a financially motivated actor it tracks as Storm-2657, nicknamed “Payroll Pirates,” targeting U.S. organizations, particularly universities. The attackers sent phishing emails with adversary-in-the-middle links that captured both passwords and MFA codes, took over Microsoft 365 accounts, and then used single sign-on to reach the victims’ Workday HR profiles. There they changed direct deposit details to divert salaries, and created inbox rules to delete Workday’s notification emails so victims would not notice.
Microsoft reported that 11 accounts at three universities had been compromised since March 2025 and used to send phishing emails to nearly 6,000 addresses at 25 universities. The lesson is that traditional MFA, such as codes or push approvals, can be relayed by an attacker in real time. Microsoft’s recommendation was phishing-resistant MFA, such as FIDO2 security keys or passkeys, plus monitoring for new MFA devices and suspicious inbox rules.
How to defend against social engineering
- Move to phishing-resistant authentication. Use FIDO2 security keys or passkeys, starting with administrators, finance, HR and IT support staff, rather than SMS or push-based MFA.
- Harden help desk and identity recovery processes. Require strong verification for password resets and MFA enrollment, such as a video call with ID or a callback to a number on file, and alert on new MFA device registrations.
- Verify high-risk requests out of band. Any change to payroll, vendor bank details or a wire transfer is confirmed through a separate, pre-agreed channel.
- Train continuously with realistic scenarios. Short, frequent training that includes vishing, ClickFix-style prompts and deepfake requests is more effective than an annual video.
- Detect behavior, not just malware. Monitor for impossible travel, unusual inbox rules, new OAuth grants, lateral movement and changes to payroll or payment data.
- Test with red teaming. Run authorized social engineering tests against the help desk and finance processes to find weak points before attackers do.
- Limit blast radius with zero trust. Apply least privilege and segmentation so a single compromised user cannot reach everything.
Our earlier article on how social engineering is outsmarting tech defenses covers additional examples.
Frequently asked questions
Doesn’t MFA stop phishing?
Traditional MFA helps, but codes and push approvals can be captured by adversary-in-the-middle phishing kits or approved by a tricked user. Phishing-resistant methods such as FIDO2 keys and passkeys are bound to the real site and cannot be relayed.
What is ClickFix and how do we block it?
ClickFix tricks users into running a malicious command themselves via a fake CAPTCHA or error. Training users never to paste commands from websites, restricting PowerShell and the Windows Run dialog for standard users, and endpoint detection all help.
Who is most likely to be targeted?
Help desk staff, finance and payroll teams, executives and their assistants, and administrators, because they can reset access or move money. They should get priority for phishing-resistant MFA and specialized training.
Closing the human gap
Delana Technologies helps organizations harden identity, help desk and payment processes against social engineering, and run realistic testing and training, aligned with the frameworks in our cybersecurity compliance services. Call 239.414.5126 or contact us.
Sources: Palo Alto Networks Unit 42, 2025 Global Incident Response Report: Social Engineering Edition; ESET H1 2025 Threat Report; Microsoft Threat Intelligence on Storm-2657 “Payroll Pirates” (October 2025), as reported by The Hacker News.