You’ve done your due diligence, practice good security hygiene and have the best security tools available. Now, your security posture is strong. But, your plan is only as good as your employees, and they may be letting you down when it comes to being ready for social engineering.  

While employees clicking on phishing links still presents a risk for the enterprise, the use of social media introduces its own set of issues, too.  

Social engineering has always been one of the easiest methods with which bad actors can infiltrate your network. In 2019, for example, about half of the attacks reported by Trustwave analysts were caused by phishing or other social engineering methods, up from 33% of attacks in 2018.

Enter Social Media Phishing

What is a common method used in social engineering? Social media phishing. The use of social media only makes problems worse. Whether they’re at work or at home, your employees may be revealing private company data on social media and not even know they’re doing anything wrong.  

Every social media post and photo may contain important data threat actors could use for social engineering. For example, that team selfie you took after the strategic boardroom meeting could divulge intellectual property or confidential business data.

Other social media phishing examples aren’t so obvious. What about a public LinkedIn message praising a coworker for a new role? On its own, that information isn’t significant. But the more personal information threat actors obtain about you and your coworkers, something seemingly harmless like a LinkedIn post can be used against you. 

Cybercriminals are efficient and thrive on gathering data on their targets. By combing through public employee social media profiles, they collect valuable data on a person’s interests, job, activities and other history. Much like how marketers create personas for their customers, phishers establish rich profiles of their future victims.

What is Social Engineering and How It Works Against You

Armed with a deeper knowledge of their target, the cybercriminal contacts the would-be victim and offers specific details about their job or interests.

In some cases, threat actors may go as far as impersonating a co-worker by creating a fake social media profile. This strategy, known as profile cloning, is an offshoot of identity theft. 

Profile cloning attempts to create identical profiles to existing accounts so information can be extracted from a friend or co-worker of the cloned profile. Although profile cloning results in two almost identical user profiles, most of us wouldn’t check to confirm that more than one profile exists.

What does this have to do with your network’s security? Let’s say your employee gets a message from a cybercriminal posing as a co-worker. Because trust has been established, they’ll be much less careful about clicking a malicious link masquerading as a real video, photo or software. This social media phishing method is much more effective than your typical email phish — after all, the employee thinks they’re conversing with a trusted friend. 

Social Media Security Tips

While keeping your employees off social media is next to impossible, taking proactive measures pays dividends. A few tips:

  • Think twice before posting anything. Even if you delete it, posts can live forever in screen captures and may lose context.
  • When away from home for extended periods, don’t reveal your location. Watch out for the information you share in photos.
  • Customize your privacy settings to be as restrictive as possible regarding who can read and see posts. Consider an account for people you trust and another for public use.
  • Use multifactor authentication.
  • Don’t click on links, files, games or applications within the confines of social media. While it’s difficult to mitigate the risk of being victimized by profile cloning, ensuring your company’s antimalware tools are up to date is a step in the right direction. Try to foster a culture of not clicking on links, even from people employees know.

Balancing user-friendliness with security is an ongoing dilemma for IT and security departments. When employees are involved and invested in the security process, and they don’t feel restricted, your chances of success get a serious upgrade. 

More from Fraud Protection

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…