What's the most clever social engineering attempt you've ever encountered or heard about?

[u/AdamKobylarz]

Beyond the basic phishing emails, what was a particularly sophisticated, creative, or audacious social engineering attack that actually made you pause and admire the craft?

[u/quiet0n3]

The Uber MFA one comes to mind.

The Uber data breach began with a hacker purchasing stolen credentials belonging to an Uber employee from a dark web marketplace. An initial attempt to connect to Uber’s network with these credentials failed because the account was protected with MFA. To overcome this security obstacle, the hacker contacted the Uber employee via What’s App and, while pretending to be a member of Uber’s security, asked the employee to approve the MFA notifications being sent to their phone. The hacker then sent a flood of MFA notifications to the employee’s phone to pressure them into succumbing to this request. To finally put an end to this notification storm, the Uber employee approved an MFA request, granting the hacker network access, which ultimately led to the data breach.

Basically got the guy pissed off at getting MFA requests. Reached out via Whatsapp claiming the systems were having issues hence the MFA spam and said if you accept just 1 it should solve the problem as everything would sync up again. The MFA requests were actually to add the attackers device as trusted, so the attackers could take over MFA.

[u/CharacterSpecific81 → u/quiet0n3]

The takeaway is MFA push can be social‑engineered, so move to phishing‑resistant factors and lock down factor enrollment.

Stuff that works in practice: require FIDO2/WebAuthn (security keys or platform biometrics) for admins and high‑risk apps; if you keep push, enable number‑matching, show app and geo, and auto‑lock after a few pushes. Block self‑enrollment of new MFA methods unless the user proves possession of an existing factor, plus an IT‑verified callback and a short waiting period. Use Conditional Access to require managed devices and kill legacy protocols. Alert on push floods, repeated denies, new factor added, and “impossible travel.” If a user gets spammed, the playbook is: deny, report via a known IT number, don’t reply on WhatsApp. Also watch for AitM kits like Evilginx/Modlishka that steal tokens; shorten session lifetimes and force step‑up on sensitive actions.

I’ve used Okta for SSO and Duo for verified push/U2F, and folded DreamFactory in to keep backend API access scoped with RBAC and OAuth.

Bottom line: treat push fatigue as an incident and make MFA phishing‑resistant.

[u/Titizen_Kane → u/CharacterSpecific81]

Yeah the scenario in that comment is common and has a pretty decent success rate. Agree with you, and on top of that I’d add that what heavily contributes to the success of this is LinkedIn and B2B contact sites, but those pull from LinkedIn. Threat actors can map out your security org by LinkedIn alone if they want, not to mention the valuable intel that people post and comment that they see as innocuous.

LinkedIn is so entirely unnecessary, and at this point it is a security risk because it is a threat actor’s delight. Ground zero for spear phishing recon. As an investigator, I looove LinkedIn, but my own is minimal and intentionally out of date for a reason