New Phishing & Social Engineering Tactics Every Business Must Know

The Quiet Shift in Social Engineering

Phishing emails used to be easy to spot: broken English, suspicious attachments, obvious urgency. Not anymore. Today's social engineering campaigns are sophisticated, targeted, and increasingly difficult to detect using traditional methods. This week's security headlines reveal a troubling pattern—attackers are exploiting trust in legitimate platforms, processes, and technologies to bypass defenses that would have stopped yesterday's threats.

The Picus Labs Blue Report 2026 confirms what many security teams are experiencing firsthand: enterprise defenses catch noisy attacks, but attackers are winning by making none. They're not battering down the front door anymore—they're walking in through side entrances we didn't know existed.

Browser Extensions: The Trojan Horse in Your Toolbar

One of the most alarming developments this week involves 737 malicious Chrome VPN extensions that impersonated legitimate VPN and proxy services. These extensions didn't just fail to protect users—they actively intercepted browser traffic and routed it through attacker-controlled SOCKS5 proxies.

The social engineering here is elegant and effective. Users searching for privacy tools to access blocked services or protect their browsing were presented with extensions that looked professional, had convincing descriptions, and in many cases, positive reviews. Once installed, these extensions gained deep access to all browser activity.

Red Flags for Browser Extensions

• Publisher verification: Check if the extension is published by the official company. Many fake extensions use names like "ExpressVPN Pro" or "NordVPN Plus" that sound official but aren't.
• Permission requests: VPN extensions legitimately need broad permissions, but compare what a suspicious extension requests versus the official version.
• Review patterns: Fake reviews often cluster around the same timeframe, use similar language, or focus on generic praise rather than specific features.
• Installation counts: While not foolproof, legitimate VPN services typically have hundreds of thousands or millions of installations.

Defense Strategy

Only install extensions directly from a vendor's official website, not by searching the Chrome Web Store. Audit installed extensions quarterly and remove anything unused. For organizations, consider using browser management policies to whitelist approved extensions and block all others.

The Hiring Process: Your New Attack Surface

A BleepingComputer analysis this week highlighted how fake remote workers exploit gaps between hiring verification, device delivery, and account access. This isn't theoretical—North Korean state actors have been running these operations for years, and the Lazarus Group's latest Windows zero-day exploitation (CVE-2026-68820) was delivered through their Operation Dream Job campaign, which targets job seekers at defense firms.

The social engineering sequence typically works like this:

1. Attacker applies with stolen or fabricated credentials
2. Passes initial screening using deepfake video interviews or coached imposters
3. Receives company laptop and access credentials
4. Uses legitimate access to exfiltrate data, plant backdoors, or conduct reconnaissance

Red Flags in Remote Hiring

• Inconsistent video behavior: Candidates who avoid turning on cameras, have unusual lag patterns, or whose mouth movements don't quite sync with audio
• Document irregularities: Background checks that come back clean but with subtle formatting differences in official documents
• Overeager acceptance: Candidates who accept offers immediately without negotiation, especially for positions requiring security clearances
• Shipping address mismatches: Equipment shipped to addresses that don't match stated residence

Defense Strategy

Implement multi-stage identity verification that includes live video interviews with multiple team members, reference checks with direct phone calls (not just email), and device attestation before granting network access. Consider requiring new remote employees to complete onboarding at a physical location for sensitive roles.

Physical Access Attacks Are Back

The "Plug and Pwn" attack research published this week demonstrates how attackers can abuse Windows Plug and Play to trigger automatic installation of vulnerable vendor software, ultimately gaining SYSTEM-level privileges. While this requires physical access or tricking someone into connecting a malicious device, the social engineering opportunity is obvious.

Attackers have long used fake USB drives labeled "Q4 Salary Data" or "Confidential" left in parking lots. Now those devices can be far more dangerous, automatically exploiting trust in the Windows hardware installation process.

Red Flags for Physical Devices

• Unknown USB devices: Any USB drive, charging cable, or peripheral from an unknown source
• Unexpected gifts: Vendors or conference swag that includes USB devices you didn't specifically request
• Found devices: Any storage device or cable found in common areas, parking lots, or mailed without clear provenance

Defense Strategy

Disable AutoRun and AutoPlay across your environment. Implement USB device whitelisting through Group Policy or endpoint management tools. Train employees never to connect unknown devices, and provide a clear process for IT to safely examine suspicious hardware.

Portal and Platform Impersonation

The City-Forum campaign targeting Salesforce and ServiceNow portals since March 2025 represents a new category of social engineering. Attackers aren't compromising user credentials—they're exploiting misconfigured guest access to enumerate and exfiltrate data from customer portals that organizations assumed were secure.

This attack succeeds because of a trust assumption: if data is in Salesforce or ServiceNow, it must be properly secured. The social engineering here targets IT administrators and developers who may not realize that default portal configurations can expose sensitive data to unauthenticated users.

Defense Strategy

Audit all external-facing portals and customer experience platforms for guest access configurations. Assume zero trust—if data shouldn't be public, verify it requires authentication. Regular penetration testing should specifically include enumeration attempts against customer portals.

The FBI's Sextortion Warning

This week's FBI warning about account takeovers for explicit image theft highlights how social engineering increasingly targets personal accounts to enable financial extortion. Attackers compromise email, cloud storage, or social media accounts, locate intimate images, and threaten to distribute them unless payment is made.

The initial compromise often uses classic phishing, but the extortion phase employs sophisticated psychological manipulation. Victims are told they have hours to pay, that law enforcement can't help, and that payment guarantees deletion (it doesn't).

Defense Strategy

Enable multi-factor authentication on all personal accounts. Use app-based authenticators rather than SMS. For organizations, include personal account security in security awareness training—compromised personal accounts often become pivots into corporate access.

What to Do Now

1. Audit browser extensions across your organization this week
2. Review remote hiring procedures for identity verification gaps
3. Test your portal configurations for unauthenticated data exposure
4. Update USB device policies and disable AutoRun if you haven't already
5. Refresh security awareness training to cover these emerging tactics

The common thread across all these attacks is that they exploit trust in legitimate processes and platforms. Traditional security controls focused on perimeter defense miss these threats entirely. Defense requires a combination of technical controls, process improvements, and ongoing education about how social engineering continues to evolve.

If your organization needs help assessing these emerging risks or implementing defenses against modern social engineering, Vici Tech Solutions offers penetration testing and security assessments designed to identify exactly these types of vulnerabilities before attackers do.