Phishing and social engineering in Cybersecurity - Step-by-Step Execution

Concept Flow - Phishing and social engineering

Attacker plans attack

↓

Crafts deceptive message

↓

Sends message to target

↓

Target receives message

↓

Target decides to trust?

No→Ignore message

Yes↓

Target shares sensitive info or clicks link

↓

Attacker gains access or info

↓

Attack success or failure

This flow shows how an attacker creates a fake message to trick a person into giving sensitive info or access, leading to a successful phishing or social engineering attack.

Execution Sample

Cybersecurity

1. Attacker sends fake email pretending to be bank
2. Email asks user to click link and enter password
3. User clicks link and enters password
4. Attacker captures password
5. Attacker uses password to access account

This example traces a phishing attack where a fake email tricks a user into giving their password.

Analysis Table

Step	Action	Target's Response	Result
1	Attacker sends fake email	User receives email	User sees message from 'bank'
2	Email asks for password via link	User reads email	User considers if email is real
3	User clicks link	Browser opens fake site	User sees login page
4	User enters password	Password sent to attacker	Attacker captures password
5	Attacker uses password	Accesses user's bank account	Attack successful
6	User ignores email	No action taken	Attack fails

💡 Execution stops when user either shares info (attack success) or ignores message (attack fails)

State Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	Final
User Trust Level	Neutral	Neutral	Trusted (mistaken)	Trusted (mistaken)	Compromised
Password Safety	Safe	Safe	Safe	Exposed	Compromised
Attacker Access	None	None	None	None	Gained

Key Insights - 3 Insights

Why does the user trust the fake email?

The email looks like it comes from a trusted source (bank), so the user mistakenly trusts it (see execution_table step 2 and variable_tracker 'User Trust Level' after Step 3).

What happens when the user clicks the link?

Clicking the link opens a fake website controlled by the attacker, which tricks the user into entering their password (execution_table step 3 and 4).

How can the attack be stopped?

If the user ignores the email or verifies its authenticity before acting, the attack fails (execution_table step 6).

Visual Quiz - 3 Questions

Look at the execution_table at step 4, what happens to the password?

A It is safely stored by the user

B It is deleted

C It is sent to the attacker

D It is encrypted

💡 Hint

Check the 'Result' column at step 4 in execution_table

At which step does the user mistakenly trust the fake message?

A Step 1

B Step 3

C Step 2

D Step 5

💡 Hint

Look at 'User Trust Level' in variable_tracker after Step 3

If the user ignores the email, what is the outcome?

A Attack fails

B User shares password

C Attack succeeds

D User clicks link

💡 Hint

See execution_table step 6 and exit_note

Concept Snapshot

Phishing and social engineering involve tricking people into giving sensitive info.
Attackers send fake messages pretending to be trusted sources.
Users may click links or share info, leading to data theft.
Always verify messages before acting to avoid falling victim.
Ignoring suspicious messages stops the attack.

Full Transcript

Phishing and social engineering attacks start when an attacker plans and sends a fake message to a target. The target receives the message and decides whether to trust it. If the target trusts the message, they may share sensitive information or click a malicious link. This allows the attacker to gain access or information, resulting in a successful attack. If the target does not trust the message, they ignore it and the attack fails. For example, an attacker sends a fake email pretending to be a bank, asking the user to enter their password. If the user enters the password, the attacker captures it and accesses the account. Key moments include why users trust fake emails, what happens when they click links, and how ignoring messages stops attacks. Understanding these steps helps protect against phishing and social engineering.