TLDR: Palo Alto Networks’ 2025 Unit 42 Global Incident Response Report reveals that 36% of cyber incidents between May 2024 and May 2025 originated from social engineering tactics. Beyond traditional phishing, attackers are leveraging sophisticated methods like SEO poisoning, fake system prompts, and help desk manipulation. The report highlights the increasing role of generative AI in scaling and enhancing the realism of these attacks, with 23% involving voice-based or callback techniques. Financial gain remains the primary motivation for 93% of these incidents, emphasizing the critical need for human vigilance in cybersecurity defenses.
A new report from cybersecurity leader Palo Alto Networks underscores a significant shift in the threat landscape, identifying social engineering as the leading initial access vector for cyberattacks. According to the company’s 2025 Unit 42 Global Incident Response Report: Social Engineering Edition, a striking 36% of all cyber incidents handled by its response team from May 2024 to May 2025 began with a social engineering tactic.
The report, compiled from over 700 incident response cases worldwide, reveals that threat actors are moving beyond simple phishing attempts. More than one-third of these social engineering incidents utilized non-phishing techniques, including search engine optimization (SEO) poisoning, deceptive system prompts, and manipulation of help desk personnel.
Philippa Cogswell, Vice President and Managing Partner for Unit 42, Asia-Pacific & Japan, at Palo Alto Networks, emphasized the human element in these attacks. “The biggest vulnerability in cybersecurity is not only about the technology; it is also about the exploitation of trust,” Cogswell stated. “Attackers are now using AI to scale deception, taking advantage of gaps in identity management and human interactions.”
Unit 42 identified two primary patterns in the evolving social engineering playbook: targeted, ‘high-touch’ compromises and broad, ‘at-scale’ deceptions. High-touch attacks involve highly personalized, real-time communication, often through impersonating IT support or executives via phone calls to create urgency and trust. These sophisticated methods can lead to rapid privilege escalation, with one observed case showing a threat actor gaining domain administrator access in under 40 minutes using only built-in tools and social pretexts. Conversely, large-scale deceptions rely on techniques such as SEO poisoning, fake browser prompts, and schemes like ‘ClickFix’ to trick numerous users into compromising their devices.
The influence of artificial intelligence is a critical factor in the escalating effectiveness of these attacks. The report confirms that generative AI is being actively used by threat actors to craft more believable and personalized lures, clone executive voices for convincing callback scams, and maintain live engagement during impersonation campaigns. Approximately 23% of the analyzed cases involved voice-based or callback techniques, showcasing AI’s role in enhancing both the scale and realism of social engineering.
Alarmingly, the report also found that 13% of critical security alerts related to these incidents went unnoticed or were misclassified, providing attackers with ample opportunity to exploit weaknesses in identity recovery and lateral movement within networks. The consequences are severe, with over half (60%) of social engineering incidents resulting in the exposure of sensitive data – a figure 16 percentage points higher than other initial access vectors. Other impacts included service interruptions and broader operational disruptions.
Financially motivated cybercrime remains the dominant driver, accounting for 93% of all social engineering incidents. Prominent threat groups like Scattered Spider (also tracked as Muddled Libra), which has infiltrated over 100 businesses since 2022, and North Korean state-sponsored operatives, are actively employing these tactics.
Also Read:
- Escalating Cyber Threats: AI Platforms and Software Supply Chains Amplify Risk
- Cybersecurity Alerts: Microsoft Thwarts AI-Generated Phishing, WestJet Discloses Data Breach, and Harrods Faces New Customer Data Exposure
These findings serve as a powerful call to action, reinforcing the message that a robust cybersecurity posture begins with a well-informed and vigilant human ‘firewall.’ The report emphasizes that awareness is not a passive activity but a critical, active defense against an increasingly sophisticated and AI-augmented threat landscape.
