2.2 Social Engineering Tactics and Psychological Pretexts

🎯 Key CompTIA Security+ Exam Takeaways

• Phishing casts a wide net via email; spear phishing targets specific individuals or departments using detailed reconnaissance.
• Whaling specifically targets high-profile C-level executives or high-net-worth individuals to authorize fraudulent financial transactions.
• Vishing uses voice telephone calls (VoIP spoofing); smishing executes attacks via SMS text messaging.
• Watering hole attacks compromise legitimate third-party websites heavily frequented by target personnel to deliver drive-by exploits.
• Physical social engineering includes tailgating (unauthorized entry behind an authorized person), shoulder surfing, and dumpster diving.

Adversaries frequently bypass multi-million-dollar perimeter firewalls by exploiting the human element through social engineering. Social engineering exploits psychological triggers: authority, urgency, social proof, scarcity, fear, and helpfulness. By manufacturing believable pretexts, attackers trick users into disclosing passwords, clicking malicious links, or wiring company funds.

Email remains the primary initial access vector. While generic phishing broadcasts broad spam lures, spear phishing targets specific organizations or individuals using open-source intelligence (OSINT) gathered from LinkedIn and corporate directories. Whaling is an elite subset of spear phishing targeting senior executives (CEOs, CFOs), often spoofing executive leadership to pressure accounting personnel into initiating emergency wire transfers (Business Email Compromise).

Attackers also exploit alternative channels. Vishing utilizes voice telephone calls with voice cloning or caller ID spoofing to impersonate IT support desks. Smishing uses SMS text alerts claiming packages cannot be delivered or bank accounts have been frozen. In watering hole attacks, adversaries compromise industry-specific websites commonly frequented by target engineers, injecting drive-by malware that infects visitors automatically.

⚠️ Common Pearson VUE Exam Traps

• Confusing spear phishing with whaling; whaling is an exclusive subset of spear phishing aimed specifically at senior corporate executives (C-suite).
• Assuming watering hole attacks originate from malicious emails; watering hole attacks infect legitimate third-party websites visited by target employees.