Social Engineering

Only the strings the victim typed, usually an account name and a password. The genuine site never saw the attempt, so nothing confirms the password is correct, and it stops being worth anything the moment the victim changes it.

Payment diversion: the operator changes where a genuine, already-owed payment lands. No link, attachment or malware appears anywhere in the chain, so patching, attachment scanning and endpoint controls have nothing to act on.

Almost none. SPF, DKIM, DMARC and attachment detonation all live on the mail hop, and an SMS-plus-callback lure never crosses it. What survives is account-side: the identity controls, and whatever the service desk demands before it acts.

A watering hole works by poisoning a site only the target group reads, so the readership performs the selection. No message is sent, no recipient is ever chosen, and no mail path exists anywhere on the route.

It granted one credential presentation, not a headcount. A reader releases a lock for a few seconds and cannot tell how many bodies cross the threshold. Everyone after the first entered on a badge that is not theirs.

Impersonation works where the target has no sideways check. A colleague can be confirmed by walking over or asking someone who knows them; an outsourced overnight engineer is a name nobody has met, on a rota nobody here can read.

Because the recipient has no decision to make. A routine ask matches what they already do, so it runs on habit rather than judgment, while urgency and authority are exactly the pressure cues people are taught to notice and question.

The token is issued to whoever started the device authorization flow, not to whoever authenticated. The operator starts it, the victim types the short code at the genuine page and authenticates honestly, and the operator's waiting client collects the token.

The genuine page, relayed. The operator's server terminates TLS on its own domain, fetches each response from the real login origin and forwards every field both ways, ending the exchange holding the session cookie the real service issued.

Only that the message really came from the domain shown in its From header, with that domain's blessing. It proves nothing about whether that domain is your supplier's, who typed the message, or whether the banking change is honest.

Patching removes software flaws, and a fake update prompt uses none. The page persuades a person to download and run an installer, so execution is granted by consent. Browser version, sandbox and patch level are all irrelevant to that.

AutoRun only governs how the OS handles removable storage. A device can declare itself a keyboard instead; the OS binds a keyboard driver automatically and accepts its keystrokes. No media, no setting, no prompt.

Calling-line identity is supplied by the originating side and relayed onward; nothing in a normal call path proves the caller is entitled to the number shown. The displayed name is usually just a lookup on that asserted number.

Usually the middle rung. Spear reuses one block of organisation-level research across dozens of named recipients, so success per recipient rises steeply while hours per recipient stay small. Bulk yields commodity accounts; executive stakes a week on one attempt.

Possession, or an assertion the caller cannot make for themselves: an approval signed from an already-enrolled credential, identity proofing off the phone, or confirmation on a channel the organisation controls. Knowledge checks change nothing.

Only the cheapest rung. Both tells are artefacts of lures the operator paid nothing for, and both vanish once the message is sent from a real mailbox on a real domain, where prose and address are genuine.

The organisation's own published surface: job adverts naming internal systems and approval chains, certificate transparency and DNS entries naming hostnames, regulatory filings naming who signs, and conference bios naming who reports to whom.

The ask is placed against an invoice that is real, already approved and about to be paid, shortly before the payment run. Riding an existing obligation means the change survives reconciliation, and paying early beats the supplier's chase.

Because the empty message is the point: nothing static to examine, the target dials out so no inbound call must survive a check, and a live operator can make asks no written message could make credibly.

That the fetch arrived: the file was opened, roughly when, and from which egress address. It proves some client rendered the document, not that a particular person read it — and since no code ran, there is nothing to patch.

The price, not the possibility. Voice was never an authenticator; it was a familiarity cue that used to be expensive to fake for a named person. Cheap cloning makes anyone with public audio impersonable.

The operator has a foothold in a third party's mailbox and replies to a conversation the recipient started. The threading fields, the quoted history and the sender are all genuine, so nothing is fabricated for the recipient to notice.

Almost certainly a consent grant to an application the operator registered, not a credential. The next question is whether the grant covers one user or the whole tenant, because that decides whether one mailbox or every mailbox is exposed.

Contact through a route the requester did not supply. Both changes are the same fields edited by the same authorised clerk, so only a callback to a number captured at onboarding or written into the contract separates them.

The advertisement's click-through URL points at a redirector the operator controls. It inspects the visitor - address, geography, user agent, referrer, whether they have been seen before - and hands non-matching visitors the genuine page. One URL, two destinations.

The card is a passive transponder that answers any powering field with the same fixed number, with no key and no challenge. Anything that hears it once can replay it. Only a credential that never transmits its secret removes the copy.

Only a check that consumes a fact the caller did not supply and cannot influence, reached over a path they did not choose. Shared knowledge fails - weeks of friendly contact is how that history was manufactured.

In operator hours the claim is cheap: forty recipients at two hours each is roughly two operator-weeks, and much of that reading is shared across all forty. Tailoring prices the message, not the sender.

Because a phone number is an address a carrier assigns, not a possession the user holds. Whoever talks the carrier's own recovery process into re-issuing that number receives every code routed to it.