2025 Unit 42 Global Incident Response Report: Social Engineering Edition
Summary: Unit 42's incident response caseload between May 2024 and May 2025 found that 36% of all incidents began with a social engineering tactic, with more than one-third of those involving non-phishing techniques such as SEO poisoning, fake system prompts and help desk manipulation. In one case an attacker moved from initial access to domain administrator rights in under 40 minutes using only built-in tools and social pretexts, and over half of social engineering incidents led to sensitive data exposure.
Bottom line: Attackers like Muddled Libra are bypassing MFA by convincing help desk staff to reset credentials, and one intrusion reached domain administrator in under 40 minutes without deploying any malware - meaning your identity recovery and support workflows, not your endpoint controls, are the exposed surface.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026