CEOs Are the Top Targets: How Phishing and Social Engineering Take Down Companies

## The "Hoodie Hacker" Myth vs. Reality

Forget cinematic hacking with green code on a black screen. **91% of successful cyberattacks** start with an email. Not a generic email — a personalized one, written with real data about the victim.

### Anatomy of a Spear Phishing Attack Against a CEO

1. **Reconnaissance (OSINT)**: The attacker researches the CEO on LinkedIn, Instagram, articles, and events. Discovers they attended a conference last week.
2. **Pretext Construction**: Creates an email pretending to be the conference organizer, attaching the "official event photos" in a ZIP file.
3. **Payload**: The ZIP contains an .lnk file (shortcut) disguised as a PDF that executes a reverse PowerShell.
4. **Compromise**: The attacker now has access to the CEO's corporate email.
5. **BEC (Business Email Compromise)**: From the CEO's email, sends instructions to finance to transfer $50k to a "new vendor account."

### Warning Signs (Red Flags)

- **Artificial urgency**: "I need this NOW," "The meeting is in 30 minutes."
- **Bank account change**: Any request to change payment details should be confirmed by phone.
- **Nearly identical domain**: `company.com` vs `cornpany.com` (m → rn).
- **Unexpected attachments**: Especially from contacts who normally don't send files.

### Cultural Defenses (More Important Than Technology)

- **Two-channel verification**: Any financial request requires confirmation through a different medium.
- **"No fear of asking" culture**: The intern should feel comfortable questioning an email from the CEO.
- **Monthly simulations**: Simulated phishing with reports on who clicked.
- **DMARC/SPF/DKIM**: Email policies that prevent spoofing of your domain.

> **The biggest vulnerability of any company is human trust. At RET, we train teams to operate with "healthy paranoia" — verify everything, trust nothing by default.**