Social Engineering Attacks Surge in 2025, Becoming Top Cybersecurity Threat – Source: www.techrepublic.com

A new report from Palo Alto Networks’ Unit 42 highlights how attackers are shifting away from technical vulnerabilities and turning instead to manipulating people, making social engineering the most frequent cause of breaches in the past year. Cybercriminals are increasingly exploiting human psychology over digital exploits to infiltrate organizations.

The 2025 Global Incident Response Report: Social Engineering Edition found that between May 2024 and May 2025, 36% of all cyber intrusions stemmed from social engineering tactics, surpassing malware and software vulnerabilities. Rather than breach firewalls, attackers are now exploiting trust, urgency, and human error to bypass security protocols — tactics that remain difficult to detect.

Why social engineering is dominating cybercrime

According to the report, this approach is no longer just about phishing emails; threat actors now deploy search engine poisoning, voice impersonation, help desk manipulation, and even fake browser alerts to trick employees and bypass technical defenses.

High-touch attacks

One of the trends highlighted by Unit 42 is the growing use of “high-touch” attacks. In these cases, hackers do not rely on malware; instead, they impersonate staff, call help desks, and convince IT teams to reset passwords or disable multi-factor authentication (MFA).

In one case cited in the report, attackers gained full domain administrator privileges within 40 minutes, using only social tricks and native tools.

Muddled Libra, a cybercrime group tracked by Unit 42, is one of the most active players in this space. Also known as Scattered Spider, the group has infiltrated more than 100 companies since 2022.

But it is not just financially motivated hackers. Nation-state actors are also turning to social engineering. North Korean operatives, for example, have posed as remote tech workers to gain employment at major corporations and funnel money back to Pyongyang.

Unit 42 has tracked similar activity from Iranian-aligned groups such as Agent Serpens, which uses fabricated institutional identities to distribute malware via spoofed emails and shared document platforms.

While these attacks serve geopolitical purposes, the methods mirror those used by profit-driven hackers, signaling that social engineering has become the go-to tool for most threat actors, regardless of motive.

Fake updates and ClickFix campaigns are widespread

The report also details a rise in at-scale attacks like ClickFix, a campaign that tricks users into downloading malware through deceptive update pop-ups, SEO-boosted malicious links, and tampered installer prompts.

In several confirmed cases, employees unknowingly downloaded credential-harvesting tools like RedLine or Lumma after clicking on what looked like legitimate update messages. These campaigns exploit user trust and blend into regular browsing habits.

AI adds a new layer of danger

The game is changing even further with artificial intelligence. According to Unit 42, threat actors now use generative AI to create personalized emails, deepfake executive voices in phone scams, and simulate real-time chat interactions.

In advanced cases, attackers employed agentic AI, a more autonomous form of AI that can carry out multi-step attacks, such as building fake LinkedIn profiles or creating convincing CVs to land jobs inside targeted firms. These AI-powered campaigns are faster, more realistic, and much harder to identify.

Real-world damage: Social engineering’s cost

In a standout case from Unit 42’s incident log, an attacker impersonated a locked-out employee, passed identity checks, and gained access to over 350 GB of sensitive data, without using any malware. All actions mimicked normal behavior, evading endpoint detection.

According to the report:

• 60% of social engineering attacks led to data exposure.
• 66% targeted privileged accounts.
• 45% involved internal impersonation.

Social engineering continues to succeed not because hackers are using sophisticated malware, but because of fundamental human and process weaknesses. Unit 42 attributes the problem to excessive access rights, overlooked system alerts, and weak identity verification processes.

Missed or ignored alerts accounted for 13% of successful intrusions. Excessive permissions and lack of MFA contributed to 10% each. In many cases, attackers reused credentials within 48 hours to access cloud systems or sell them on the dark web.

The report urges companies to move beyond traditional awareness training and treat social engineering as a systemic threat.

A customizable social engineering policy

As outlined in Unit 42’s report, social engineering isn’t just a clever tactic — it’s the primary way attackers are breaching modern organizations. That’s why organizations must stop viewing human error as incidental and begin treating it as a core security vulnerability.

In TechRepublic Premium’s Social Engineering Awareness Policy, we provide a customizable framework that equips employees to spot threats before they escalate — whether it’s a phishing email or a voice on the phone impersonating the CEO. The policy includes granular access control strategies, training protocols, and tools that align with NIST guidelines to harden the human layer of defense.

For more cybersecurity news, see our coverage of researcher Mikko Hypponen’s Black Hat conference keynote tracing the history of malware.