A corporate finance officer receives an urgent SMS message on their personal mobile phone claiming that a critical vendor invoice is past due and requiring immediate review via a provided shortened link. Upon clicking the link, the officer is directed to a login page and receives a follow-up call from an individual claiming to be a senior IT auditor. The caller uses authoritative technical terms and pressures the officer to disclose their multi-factor authentication (MFA) verification code to resolve an apparent account lock. Which of the following social engineering attack vectors and principles of influence were directly employed in this scenario? (Select TWO.)
- SmishingAnswer
- BWatering hole attack
- PretextingAnswer
- DTyposquatting
Answer
The attack involved Smishing (using SMS to deliver a phishing link) and Pretexting (fabricating an IT auditor identity to manipulate the employee into sharing MFA credentials).
Smishing is used because the initial social engineering attack vector was delivered via text message (SMS). Pretexting is present because the attacker created a fabricated persona and scenario (a senior IT auditor resolving an account lock) to trick the target into revealing sensitive MFA credentials over the phone.
Step-by-Step Solution
Key Concept
Social Engineering Attack Vectors and Influence Tactics
Estimated Time:1m 30s