Illustration Absmeier foto freepik

Die neue Social-Engineering-Edition des 2025 Global Incident Response Report von Unit 42 zeigt: Social Engineering ist 2025 das häufigste Einfallstor für Cyberangriffe [1]. In mehr als einem Drittel der über 700 analysierten Fälle weltweit nutzten Angreifer Social Engineering als Einstieg, also den gezielten Versuch, Menschen durch Täuschung zu bestimmten Handlungen zu verleiten und so Sicherheitskontrollen zu umgehen.

Die zentralen Erkenntnisse auf einen Blick:

36 Prozent aller untersuchten Vorfälle begannen mit Social Engineering. Phishing bleibt mit 65 Prozent die weitverbreitetste Taktik, um sich Zugriff zu verschaffen. 35 Prozent nutzen Malvertising, SEO-Poisoning, Smishing oder MFA-Bombing.
High-Touch-Angriffe nehmen zu. Gruppen wie Muddled Libra umgehen Multi-Faktor-Authentifizierung und erlangen innerhalb weniger Minuten Administratorrechte – ohne den Einsatz von Malware.
Schwache Erkennungsmechanismen und Alarmmüdigkeit innerhalb der Sicherheitsteams begünstigen diese Angriffe. Warnsignale werden oft übersehen oder falsch eingestuft, insbesondere in Prozessen zur Wiederherstellung von Identitäten oder bei lateralen Bewegungen im Netzwerk.
Über die Hälfte der Vorfälle führte zu Datenabfluss, andere zu Unterbrechungen kritischer Dienste oder zu einer spürbaren Beeinträchtigung der Unternehmensperformance.
Künstliche Intelligenz (KI) beschleunigt und personalisiert Social-Engineering-Kampagnen. Bedrohungsakteure nutzen generative KI, um täuschend echte Köder zu erstellen, Stimmen von Führungskräften zu imitieren und in Echtzeit Gespräche während Täuschungskampagnen zu führen.

Der Bericht macht deutlich: Social Engineering erfordert einen technischen Sicherheitsansatz, der Identitätsmissbrauch systematisch erkennt, Prozesse absichert und Benutzerinteraktionen konsequent überprüft.

Weitere Informationen entnehmen Sie dem (englischsprachigen) Blogpost:

How Cybercriminals and Nation-State Actors Are Leveraging Sophisticated Social Engineering Techniques to Attack Global Organizations at Scale

Today, Palo Alto Networks Unit 42 released the 2025 Unit 42 Global Incident Response Report: Social Engineering Edition. This report explores the top initial attack vector we observed over the past year – social engineering. During this period, over a third of all Unit 42 Incident Response cases began with a social engineering tactic.

The report analyzes how attackers are exploiting trust to breach organizations, leading to business disruption and financial loss. Insights are derived from Palo Alto Networks telemetry, over 700 incident response case studies, and Unit 42 threat research.

Social Engineering Data Reveals How Human Vulnerabilities Are Exploited

Social engineering is the most common initial access vector observed by Unit 42, with phishing accounting for 65% of social engineering-driven cases. These attacks often target privileged accounts (66%), utilize impersonation of internal personnel (45%) and involve callback or voice-based techniques (23%), which are becoming more sophisticated as attackers leverage AI.

The success of social engineering stems from exploiting human behavior and weak controls, rather than technical vulnerabilities. Our data reveals several key patterns driving the success of these social engineering attacks:

Business Disruption: Social engineering attacks resulted in data exposure in 60% of cases, 16 percentage points higher than other initial access vectors. Business email compromises (BEC) accounted for roughly half of all social engineering cases, with nearly 60% leading to data exposure.
Novel Vectors: While phishing leads, 35% of social engineering cases use methods like SEO poisoning, malvertising, smishing and MFA bombing. Attackers are expanding beyond email to other platforms and devices.
Control Gaps: Ignored alerts (observed in 13% of all social engineering cases), excessive permissions (10%) and lack of MFA (10%) are common weaknesses. Overwhelmed security teams often miss or deprioritize alerts.

AI Fuels a New Era of Social Engineering

AI has the power to reshape social engineering threats. While traditional methods persist, attackers are now using AI tools for speed, realism and scale. Unit 42 has observed three levels of AI-enabled tooling in incidents:

Automation tools accelerate intrusion steps.
Generative AI creates human-like content for personalized lures, voice cloning and adaptive interactions.
Agentic AI autonomously executes multistep tasks, including cross-platform reconnaissance and creating synthetic identities for targeted campaigns.

This indicates a shift where AI components support conventional social engineering, increasing the scale, pace and adaptability of attacks.

Social Engineering Can Be Both Highly Targeted and Highly Scalable

In the report, Unit 42 outlines two top observed social engineering models, both designed to bypass controls by mimicking trusted activity:

High-touch compromise targets specific individuals in real time. Threat actors impersonate staff, exploit help desks and escalate access without deploying malware. This often involves voice lures, live pretexts and stolen identity data, as seen in Muddled Libra and various nation-state activities. These white glove attacks are highly targeted and tailored, employing help desk impersonation, voice spoofing and technical reconnaissance to achieve deep access, broader system control and higher potential for monetization.

At-scale deception includes ClickFix-style campaigns, SEO poisoning, fake browser prompts and blended lures that trigger user-initiated compromise across multiple devices and platforms. Large-scale ClickFix campaigns trick users into executing malware through fraudulent system prompts and CAPTCHA tests. We’ve observed these attacks across healthcare, retail and government sectors, often resulting in widespread credential compromise and operational downtime.

How Organizations Become Low-Hanging Fruit for Social Engineering

Social engineering persists due to overpermissioned access, gaps in behavioral visibility and unverified user trust in human processes. Threat actors exploit identity systems, help desk protocols and fast-track approvals by mimicking routine activity. To counter this, security leaders must shift beyond user awareness, recognizing social engineering as a systemic threat. This requires:

Implementing behavioral analytics and identity threat detection and response (ITDR) to proactively detect credential misuse.
Securing identity recovery processes and enforcing conditional access.
Expanding zero trust principles to encompass users, not just network perimeters.

As technology evolves, attackers exploit human trust and productivity. The nature of trust, verification and defense is changing. This report reflects trends and attacker innovations observed over the past year. By contextualizing these findings, security leaders gain tools to recalibrate defenses, protect business continuity and maintain an edge in an evolving threat environment.

For a deeper dive into these evolving tactics and Unit 42’s comprehensive analysis, download the full report here.

[1] Den vollständigen Report finden Sie hier: https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/

1029 Artikel zu „Social Engineering“

Trends 2025 | News | Trends Security | Favoriten der Redaktion | IT-Security | Kommunikation

Die Zukunft von Social Engineering – KI, Wearables und VR kurbeln Cyberkriminalität an

31. März 2025

Der neue Bericht von Trend Micro zeigt auf, wie Cyberkriminelle KI, Wearables, Virtual Reality (VR) und Augmented Reality (AR) sowie Chatbots nutzen werden, um Opfer präziser denn je zu manipulieren [1]. Die Bedrohungsforschern von Trend Micro analysierten, wie Angreifer diese Technologien nutzen, um ihre Taktiken zu verfeinern und ihre Täuschungsmanöver weiterzuentwickeln. »Social Engineering, also…