Malware of the Mind - Disinformation and Manipulation via Social Platforms
Where
Track 2 Friday
CactusCon 10
Duration
51 min
Draws parallels between how malware compromises a system and how biases are exploited during disinformation campaigns.
Summary
Mike Manrod opens by describing how he began connecting malware with disinformation after a long flight in 2015, when he noticed that the way false information moves through people resembles how attackers move through a compromised system. He treats software as expressed ideas and malware as a bad idea packaged in a format machines can run.
The middle of the talk turns to human cognition as the target. Drawing on research into cognitive dissonance, conformity, heuristics and biases, and the limits of group size, he argues that people carry exploitable weaknesses such as fast, fear-driven reactions, trust, and conditioning. He maps these onto vulnerabilities and privilege escalation through emotional triggers, and explains how social platforms give a bad idea a reach that a local pub never could. He then sketches a disinformation kill chain: defining objectives, building accounts and infrastructure, mapping a target audience's fears, delivering content, and tuning the campaign based on its results.
He closes by suggesting where the chain could be broken. Options include sharing threat intelligence, platform-level disruption of fake accounts, personal integrity checks that pause to question strong emotional reactions, and filtering information sources. The talk is largely conceptual, presented as a set of thought experiments rather than a tested model, and it leaves room for audience questions on the topic.
Related talks
Talks·45 min
Ell Marquez
Uses Brothers Grimm fairy tales to reframe advanced persistent threats as patient, people-driven attacks and social engineering.
Track 1 Friday·25 min
Parzival
Shows how COVID-19 themed pretexts shifted phishing and vishing results during remote work, and the ethical choices behind them.
Physical Security Village·25 min
Andrew Lebedinsky
Shows how to turn physical red team findings into realistic threat evidence and dollar-based impact that persuades executives to fund fixes.


