Internal Authority Impersonation

Attackers pose as high-ranking executives (CEO, CFO, COO) to pressure employees into urgent actions, such as transferring funds or sharing confidential documents.

Adversaries deceive employees into divulging credentials by impersonating IT staff and claiming that urgent security updates require the victim’s password or trick users into entering credentials on fake IT portals. These tactics exploit employees' trust in IT departments and their role in managing access control.

Phishing emails disguised as HR communications trick employees into revealing sensitive personal details, such as Social Security numbers, tax information, or payroll credentials. These attacks may involve performance reviews or urgent requests related to employment benefits.

Attackers pose as finance staff to request invoice payments, payroll changes, or banking updates, exploiting trust in internal financial roles.

Attackers pose as peers to request files, credentials or approvals, leveraging users' trust at their coworkers.

Attackers impersonate supervisors to demand urgent tasks or document access, exploiting both authority, and urgency.