A security professional was approached by an unknown, likely fake social-media profile offering $300 for a short “digital transformation” phone consultation. The pitch was a confidence trick designed to screen for useful access and then escalate into requests for non-public information that could push the target to misuse internal access and relationships. It’s a reminder that flattery and small-but-tempting payments can be used to turn trusted professionals into inadvertent insiders.
According to Cisco Talos, the attack began with an unsolicited social media message from an unknown profile offering $300 for a one hour phone consultation on digital transformation. The offer was framed as a simple, low effort way to earn money, which made it feel plausible rather than alarming at first glance. Talos describes this initial contact as a confidence trick rather than a technical exploit, since it relied entirely on persuasion rather than malware or credential theft in its opening stage.
The key finding in this case is that the paid consultation itself was not the real goal. Instead, it functioned as a screening process to determine whether the target had access or knowledge the attacker could later exploit. If the target seemed to have limited value, the interaction likely would have ended there. But if the target appeared useful, the attacker moved to the next stage: commissioning a written report and then a so called special report, which pushed the target toward sharing non-public insights.
This scam worked because it exploited trust and ego rather than technical weaknesses. The profile contacting the target was described as remarkably sparse, lacking the usual accumulated activity of a real professional account, yet the offer of payment for a simple service was tempting enough to lower guard. Talos points out that security professionals often assume they would recognize manipulation, and that this overconfidence is precisely what attackers count on. Flattery played a role too, with the target praised professionally before being asked to provide information that was not publicly available.
Organizations can reduce risk by training staff to verify unsolicited consulting or job offers independently before engaging, and by reinforcing that legitimate work never requires bypassing internal policy to gather non-public data for an outside party. Talos also notes that similar variants exist, including fake recruiter or job offers that push candidates toward installing trojanized software, so awareness training should cover the broader pattern of payment or opportunity based lures, not just this single scenario. Techniques referenced include spearphishing via service (T1566.003) and gathering victim information (T1598).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An unsolicited social media profile offered a security professional $300 for an hour long phone consultation on digital transformation. The call was actually a screening step to see if the target had access or knowledge the attacker could exploit.
If the target seemed useful, the attacker asked them to produce a written report and then a special report requesting non-public insights, which could require contacting coworkers or probing internal systems.
Warning signs include a sparse or fake looking social media profile, an unqualified stranger offering a tempting payment for a simple task, and gradual pressure to share information that is not publicly available.
The article notes that flattery and overconfidence remain a common vulnerability, since professionals often believe they would recognize social engineering, which is exactly the weakness attackers rely on.
You get a LinkedIn DM: “We’ll pay $300 for a one‑hour digital transformation call.” Sounds flattering, right? Here’s the trick: that paid call is just a screening test. They use the chat and phone to see what systems you know, who you can reach, and how much internal detail you’ll share. If you seem useful, it escalates: they commission a ‘special report’ and nudge you to ping coworkers, probe internal systems, and write up non‑public insights so you can ‘earn’ the fee. One move: if an unsolicited paid ‘consulting’ or expert call asks for anything non‑public, stop and route it through our security or compliance team before you answer.
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
