The Lifecycle of a Social Engineering Attack
The 4 phases of a social attack
A social engineering attack is rarely improvised: it usually follows a cycle with four recognizable phases. First, research, where the attacker gathers public information about the victim or organization, often from social networks or corporate websites. Then comes building rapport, where they make contact and create a relationship of apparent trust or authority. Next, exploitation, the moment they ask for the concrete action: clicking a link, transferring money or revealing a password, relying on urgency or fear. Finally, the exit, where the attacker withdraws, trying to leave no trace or raise immediate suspicion. Recognizing which phase a suspicious interaction is in helps cut the attack short before it reaches the point of exploitation.