27. Social Engineering Awareness
27.2 Types of Social Engineering
| Type | Channel | Example |
|---|---|---|
| Phishing | A fake "your KYC expired" email with a link to a lookalike bank site | |
| Spear phishing | Email, targeted | A personalised mail to one employee, using their real name and role |
| Vishing | Voice call | "Bank officer" asking for OTP to "stop a fraudulent transaction" |
| Smishing | SMS | "Your parcel is held, pay ₹15 here: [link]" |
| Pretexting | Any | A made-up story ("I am from IT support") to gain trust |
| Baiting | Physical/USB | A malware-loaded USB left where someone will plug it in |
| Tailgating | Physical | Following an employee through a secure door without a badge |
| Quid pro quo | Any | "Free tech support" in exchange for access |
Most real attacks start with one of these, then use the technical tools from earlier chapters. The human is the entry point.
Ravindra Bagale's Tip
"Phishing only happens by email" is a misconception. These days most fraud happens over SMS (smishing) and WhatsApp – courier, electricity bill, KYC. Whatever the channel, the rule is the same: don't click links in a hurry, and never give your OTP to anyone.
Ravindra Bagale's Tip – मराठी
"Phishing फक्त email मध्ये असते" हा गैरसमज आहे. आजकाल SMS (smishing) आणि WhatsApp वर सर्वात जास्त फसवणूक होते – courier, electricity bill, KYC. Channel कोणताही असो, नियम एकच: link वर घाईने click करू नका, आणि OTP कोणालाही देऊ नका.
Ravindra Bagale's Tip – हिंदी
"Phishing सिर्फ़ email में होती है" यह गलतफ़हमी है. आजकल SMS (smishing) और WhatsApp पर सबसे ज़्यादा धोखाधड़ी होती है – courier, electricity bill, KYC. Channel कोई भी हो, नियम एक ही: link पर जल्दबाज़ी में click मत करो, और OTP किसी को मत दो.
Practice task
Match each of these to its type: a call claiming to be from the electricity board threatening disconnection; a USB drive found in the parking lot; an SMS about a held courier. Write the type and the trigger for each.
Real incident: Central Ohio Primary Care – vishing leads to Chaos ransomware claim and 1.4 million patient records exposed (Oct 2026)
1. What happened
On 15 October 2026, Central Ohio Primary Care (COPC), one of the largest primary-care groups in the U.S., told patients that a cyberattack discovered on 25 August 2026 may have exposed personal and health-related data for about 1.4 million current and former patients and employees. COPC said the incident began with a vishing (voice phishing) social-engineering attack that let a criminal threat actor reach certain files with protected health information. Data that may have been involved includes names, addresses, Social Security numbers, limited health-related patient data, financial information and other identifiers — not every person had every field exposed. COPC said the incident was contained, that MyChart (Epic) was not impacted, and that it knew of no misuse of the data for identity theft so far. It is offering credit and dark-web monitoring and is working with law enforcement. Public reporting and class-action notices attribute the intrusion to the Chaos ransomware group, which researchers have linked to Microsoft Teams IT-support impersonation (vishing) campaigns. Educational framing only.
2. How the hack happened (public reporting only – high-level)
- Attackers used vishing — a voice call (often through collaboration tools such as Microsoft Teams) pretending to be IT or helpdesk support.
- They pushed the victim to trust them and open a remote-support session (tools such as Quick Assist or other remote-access apps are commonly abused in this class of attack, per public research).
- With that foothold they ran further tools on the workstation, stayed persistent, and moved toward more systems (high-level pattern documented for Chaos-linked Teams campaigns by Sophos and others).
- In Chaos-linked cases, operators often steal data and may deploy ransomware within hours of first access.
- At COPC, files with protected health information were reached; the group later disclosed the scale (~1.4 million people) and began notifying affected individuals.
3. How to stop it / defend (this lesson: types of social engineering – vishing)
- Treat unexpected Teams / Zoom / phone "IT support" calls as hostile until proven otherwise — real IT almost never cold-calls staff to install remote tools.
- Block or restrict consumer remote-assist tools (Quick Assist, AnyDesk, similar) for normal users; allow only managed RMM for the helpdesk.
- Verify on a second channel: hang up and call the real IT number from the company directory, never the number the caller gives.
- MFA and Conditional Access on Microsoft 365 so a social-engineered session cannot freely roam mail and files.
- EDR that alerts on unusual remote-access tools, PowerShell download cradles, and new persistence (registry Run keys).
- Train staff that voice + Teams is the same social-engineering family as email phishing (this chapter's table: vishing + pretexting).
4. How to take care so it won't happen again (checklist)
- [ ] Written rule: never grant remote control from an inbound Teams/phone "IT" call.
- [ ] Application control: block unapproved remote-assist tools on endpoints.
- [ ] MFA everywhere for Office 365 and VPN; prefer phishing-resistant methods for admins.
- [ ] Tabletop once a quarter: fake helpdesk Teams call — staff must refuse and report.
- [ ] If someone did grant access: isolate the PC, reset passwords from a clean device, review mail forwarding and new accounts, preserve logs for IR (Ch.31).
- [ ] India students: the same pattern shows up as fake "IT se call" / WhatsApp video — verify on the official office number, and report org incidents to CERT-In on time (Ch.34).
Source: COPC / local U.S. reporting (ABC6 WSYX, Cincinnati Enquirer / USA TODAY Network, 10TV), disclosures dated 15 October 2026 (incident discovered 25 August 2026); Sophos, Morgan Demboski, "Chaos in Teams vishing" (STAC4749 campaign research on Chaos-linked Microsoft Teams vishing); educational summary only — COPC has not published a full technical root-cause write-up.
Check if you're safe: Phishing Link Checker · Password Strength Checker
Types mapped to defences
| Type | Example | Defence |
|---|---|---|
| Phishing / smishing | Fake bank SMS | Check the official app/domain; report |
| Vishing | Fake KYC call | Hang up; call the number on your card |
| Pretexting | "IT needs your password" | IT never needs your password |
| Baiting | USB drops in the parking lot | Never plug in unknown media |
| Tailgating | Following someone through a badge door | Politely ask strangers to badge in |
Workplace tip
Reception and helpdesk staff get the most attempts. Give them a clear "when in doubt, escalate" rule and praise them when they stop a fake request.
Recap
- Learn the types so you recognise them in the moment.
- Verification beats trust when money or data is involved.
Defender's worksheet (do this today)
- Write the lesson title and date in your notebook.
- List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
- Run one safe command or checklist item from the lesson on a lab system only.
- Paste the command and its output under an Evidence heading.
- Write one fix you would give a teammate in two sentences.
- Write one mistake students make with this topic and how to avoid it.
More real-world pictures
Indian workplace (sample data)
Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.
Global practice
Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.
Home and family
Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.
Connect to earlier chapters
Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.
Common mistakes
- Skipping written permission just for a quick scan.
- Practising on hostel or office Wi-Fi targets without authorisation.
- Collecting tool output without writing the fix.
- Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Teach one other person the warning from this lesson.