2.2 Advanced Social Engineering Tactics

As security awareness improves, attackers continuously adapt. Modern social engineering attacks exploit new technologies, alternative communication channels, and human trust.

• Quishing (QR Code Phishing): Attackers embed malicious links inside QR codes, commonly placed in PDF attachments or printed documents.

  Because email security tools cannot easily scan QR codes, these attacks often bypass traditional filters. Victims typically scan the code using personal mobile devices, which may lack corporate security protections.

• Smishing (SMS Phishing): Fraudulent text messages designed to trigger urgency or fear.

  Common examples include messages such as “Package Delivery Failed” or “Bank Fraud Alert”. SMS messages have an estimated 98% open rate, compared to approximately 20% for email.

• Vishing (Voice Phishing) & Deepfakes: Attackers use artificial intelligence to clone a trusted individual’s voice, such as a CEO or senior executive.

  The attacker calls a finance or HR employee and demands an urgent action, such as a wire transfer. This form of Deepfake Vishing is a rapidly growing threat targeting high-value corporate transactions.