Observations from Social Engineering my way Through a Pandemic

The talk looks at how one social engineering consultant changed phishing and vishing engagements once the pandemic pushed workforces into remote work. Attackers quickly used COVID-19 as a lure, and the speaker found employees were more likely to respond to messages about the crisis, especially when new login portals, VPN changes and unfamiliar processes added confusion. Pretexts were built around the consequences of the pandemic rather than impersonating health agencies, and the speaker avoided promising bonuses that could later be revoked.

Several observations stood out. Many pre-pandemic pretexts, such as fake dress code notices and IT impersonation, still worked with little change. Some clients opted out because of budget cuts or concern about adding stress, and one point of contact clicked a test email even after being warned. Phone calls were especially effective when people were eager to talk, though that made some of the stories uncomfortable to tell. Success rates rose and fell with news about virus variants, and lures moved from health alerts to stimulus checks and student loan extensions.

The closing argument favors continued user education, preparing staff for the next crisis-themed lure, and keeping phishing emails simple, since employees often expect phishing to be full of typos. The speaker encouraged ongoing debate about the ethics of using crisis themes in testing and pointed to published research on COVID-19 phishing emails.