Testing Your Organization's Social Media Awareness

Overview: Jacob Wilkin, a cybersecurity consultant and red teamer, addresses the escalating threat of social media-based social engineering and corporate profiling. Highlighting the global shift toward mobile-first social media consumption and Bring Your Own Device (BYOD) enterprise models, Wilkin illustrates why attackers increasingly bypass hardened corporate email gateways in favor of social media phishing. To empower security teams to identify vulnerabilities and educate employees, he introduces two open-source red teaming tools released at Black Hat Arsenal: Social Mapper, an OSINT reconnaissance tool utilizing facial recognition, and Social Attacker, an active phishing simulation framework.

Key Topics: - Surge in social media phishing vs. traditional corporate email phishing - The enterprise threat of BYOD, mobile device usage, and password reuse across corporate Active Directory - Social Mapper: Automated open-source intelligence (OSINT) and cross-platform facial recognition - Social Attacker: Designing and executing realistic, active social engineering awareness simulations

Technical Details: The presentation examines data from HootSuite and Proofpoint revealing that with over 3.4 billion active social media users—representing approximately 80% of the world's internet-connected population—social media has become the primary communication medium for enterprise employees. Crucially, Proofpoint threat intelligence documented a 500% increase in social media phishing attacks in 2017, followed by an additional 100% surge in 2018, representing a tenfold expansion over three years. Furthermore, click-through rates on social platforms average 33%, triple the 11% average observed in corporate email phishing. As organizations embrace Bring Your Own Device (BYOD) policies and mobile workplace connectivity, personal social media activity directly bridges into enterprise environments.

Attackers exploit this dynamic through multiple vectors. While malicious file downloads and browser exploits face sandboxing barriers on mobile operating systems like Android and iOS, credential harvesting remains exceptionally effective. Employees routinely reuse social media passwords across corporate Active Directory, VPNs, and Single Sign-On (SSO) gateways. When an attacker compromises an employee's social media account or sets up a convincing spoofed pretext, the barrier to extracting enterprise credentials diminishes dramatically.

To address this exposure, Wilkin developed and open-sourced Social Mapper, a Python-based intelligence gathering tool designed for passive organizational profiling. By feeding the tool a target company name, Social Mapper scrapes employee rosters and headshots from LinkedIn or user-supplied image lists. It then instruments a headless Firefox browser to search target names across major platforms—including Facebook, Twitter, and Instagram—applying automated facial recognition algorithms to verify and correlate profiles across networks. The tool can correlate profiles for over 1,000 corporate targets within 24 hours, generating comprehensive dossier reports. Building on this passive reconnaissance, Wilkin introduces Social Attacker, a platform that automates active outreach—dispatching connection requests, direct messages, and tracking employee click-through interactions to identify at-risk personnel for tailored awareness training.

Key Takeaways: Social media platforms represent an unmonitored back-channel into enterprise networks that easily bypass corporate email defenses and spam filters. Security awareness programs must evolve beyond traditional email simulations to measure employee susceptibility to social media phishing and OSINT scraping. Security leaders should enforce multi-factor authentication to nullify credential reuse, implement robust BYOD security policies, and leverage automated open-source tools like Social Mapper to assess organizational exposure across public networks.

(AI summary — Gemini Flash)