The relentless evolution of cybersecurity tools and protocols can paint a promising picture for businesses. However, despite these stronger defenses, attackers are keenly aware of a persistent vulnerability that’s difficult to eliminate: employees.

The human element presents a complex challenge in cybersecurity. Unlike software code or network configurations, human behavior is not easily patched or automated. With regular education and instruction, humans can effectively adapt – but, inevitably, bad actors do too.

Here are three ways cybercriminals are exploiting the human attack surface this year.

1. Trapping business travelers

While virtual business meetings have become the norm following the pandemic, frequent travel is still a reality for many professionals. Yet travel can expose them — and their employers — to a unique set of cyber threats, including:

• Malicious networks. Most professionals need to remain connected and responsive when they’re on the road, and free Wi-Fi can be tempting. Cybercriminals often set up fake networks designed to trick users into connecting, enabling bad actors to conduct “man-in-the-middle" attacks. By positioning themselves between the user's device and the internet, criminals can eavesdrop on communications to steal login credentials, emails and financial information, or infect the victim’s device with malware.
• “Juice jacking.” Public charging stations offer a convenient way to keep devices powered, but they can also pose security risks. That’s because the connections used to recharge a mobile device often enable the transfer of data. Juice jacking involves tampering with charging stations or setting up fake charging stations to steal data. Fraudsters often install malware on any devices that connect to the station, such as a keylogger that captures login credentials.

2. Perfecting email cons

While phishing emails have been a staple of attackers’ arsenals for years, newer pretexting techniques have introduced a level of planning and premeditation that can catch even the savviest professionals by surprise.

Pretexting is a form of social engineering that involves gathering detailed personal and contextual information about a target and the company they work for. Attackers use this information to craft highly believable emails that appear to come from a legitimate source, such as a CEO, colleague or even a trusted vendor.

Pretexting attacks have made recent headlines for the financial damage and disruption bad actors have caused. Reasons these attacks have been so effective include:

• Highly tailored messages using information gleaned from data breaches, social media and other sources. The personalization makes the email seem more legitimate.
• Creating plausible and believable scenarios, such as impersonating a trusted figure like a colleague, CEO, client or vendor. This fabricated trust makes the recipient more likely to let down their guard.
• Urgent requests that pressure the recipient to take immediate action, such as approving a fraudulent invoice connected to a legitimate project or process.
• More convincing communications that spoof the sender’s address and incorporate accurate information to appear genuine. Attackers increasingly use artificial intelligence to eliminate the traditional red flags of phishing such as spelling, grammar and punctuation mistakes, and enhance a message’s narrative to be more relevant.

3. Exploiting trust and credentials

Cybercriminals have become more adept at targeting specific professions where trust and licensing play a crucial role. Doctors, pharmacists, lawyers and engineers are key targets for these attacks as they often have access to valuable personal information or hold positions of authority within their organizations. Here's how these scams can play out:

• Credential revocation threats: A phishing email claiming to be from a regulatory body or licensing board threatens the recipient's professional license if they don't comply with a fraudulent request. The request could involve updating "outdated" license information on a malicious website or providing personal details to verify their identity — both of which reveal information the criminals can use for fraud later.
• Fake legal threats: Lawyers and engineers might receive emails purporting to represent opposing counsel or clients in ongoing legal or project disputes. These emails may contain malware-laden attachments or links requesting sensitive information related to the case.
• Data breach extortion: Hospitals and healthcare providers are frequently targeted by cyber attacks. After a potential breach, attackers might send phishing emails to specific doctors or admin personnel threatening to release the information publicly unless a ransom is paid.

Strengthening a human firewall

Security vulnerabilities around trust, urgency, and fear are uniquely human, and — at least for now — there’s no technological solution that can eliminate them. That’s why cybercriminals constantly refine their tactics and find new ways to exploit human error.

Cybersecurity will never be a one-time fix; it's a continuous process of staying on top of trends and adjusting your defenses. Remaining informed about the latest threats to the human attack surface and fostering a culture of security awareness within the organization can help reduce the odds you or your employees will be the entry point for a devastating cyberattack.