* [![perspectives](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2025/02/prespective-icon.png)](https://www.paloaltonetworks.com/perspectives) * Social Engineering and the Art of Fishing # Social Engineering and the Art of Fishing ![Social Engineering and the Art of Fishing](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2021/01/social-engineering-and-the-art-of-fishing.png) **By [Kevin O'Malley](https://www.paloaltonetworks.com/perspectives/author/kevin-omalley/ "Posts by Kevin O’Malley")** | **6 min read** | ![share icon](https://paloaltonetworks.com/content/dam/pan/en_US/cxo-perspectives/images/cxo-share.svg) * LinkedIn button ![linkedin-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-linkedin.svg) * Twitter share button ![twitter-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-twitter-x-black.svg) * \[Email share button ![email-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-email.svg)\](mailto:?subject=Social Engineering and the Art of Fishing\&body=Check out this article https%3A%2F%2Fwww.paloaltonetworks.com%2Fperspectives%2Fsocial-engineering-and-the-art-of-fishing%2F "Share in Email") * ![copy-icon](https://www.paloaltonetworks.com/perspectives/wp-content/themes/csp2025/dist/images/icons/icon-share.svg) [](https://www.paloaltonetworks.com/perspectives/social-engineering-and-the-art-of-fishing/?pdf=download&lg=en&_wpnonce=b83f8e29b4 "Click here to download") MEET THE AUTHOR ![](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2025/02/panw_master-twitter-profile-pic-400x400-1.png) Kevin O'Malley is Chief Information Security Officer for Lee County, Florida.... [Learn more](https://www.paloaltonetworks.com/perspectives/author/kevin-omalley/) ## IN THIS ARTICLE There are many reasons for a successful cybersecurity attack. For example, there could be a misconfiguration in the cloud or an unpatched system. However, the most common and potent source of attack today is social engineering, typically phishing. Phishing attacks account for more than 80% of reported security incidents, according to [CSO](https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html), with more than 90% of malware delivered via email. These attacks are popular methods because they are low cost, low risk for hackers and have relatively high success rates. Unfortunately, the shift to cloud and work-from-home environment caused by COVID-19 has created a dramatic increase in phishing and other social engineering attacks. According to research by [Unit 42^®^](https://unit42.paloaltonetworks.com/how-cybercriminals-prey-on-the-covid-19-pandemic/), early in the pandemic there was a 569% increase in the growth of malicious registrations, including malware and phishing. Security awareness is usually the first tool cybersecurity teams reach for in our mitigation toolbox. This is a natural instinct and certainly of great value, depending on how well it is supported and deployed. However, how do you predict the themes and language of social engineering campaigns? What will be the best lure? What will cause the lure to change? Just as fishing in the physical world requires different lures, depending on what type of fish is sought, the same is true in the virtual world of phishing. In fact, the analogy goes quite deep between catching fish and tracking the exploits of those who phish for profit or malice. I know this first-hand, not just as a cybersecurity professional, but as a person who grew up fishing on lakes and streams. ## Fishing and Phishing When I was a child, my grandfather loved to fish. I worshipped my grandfather, so I would eagerly join him on day-long fishing trips. My grandmother would pack lunches and drinks and my grandfather would equip the boat. One of the most curious items on the boat was the tackle box. It wasn't until years later that I understood that the curiosities that caught my eye were lures---and why there were so many. I was simply told different lures were used to catch different fish. I heard words like plugs, jigs, spinnerbait, and something called a spoon. I had no idea when to use what lure. However, as I got older, I got to understand that the best lure depended on what attracted the targeted prey. Now, as I am much older and in the cybersecurity world, those experiences with my grandfather make more sense. We have changed the spelling to "phishing," knowing the best lure is social engineering, and the prey is, well . . . us. So how can we use this knowledge to predict the next lure used by the virtual phisher? ## Reading Cues, Finding Clues To start, look at the calendar and watch, read or listen to the news. Talk to people about their concerns. It doesn't matter whether you want to call it real or fake news. A lure in the world of fishing is fake but it has caught many a prey. The threat intelligence source for predicting the next lure is what is happening in the real world. We in the cyber security world have to be in tune with what is in the log-files-produced human interaction. The easiest prediction model is the calendar. For example, you always have to be careful around the holidays. There will likely be emails floating about with enticing subject lines such as "free," "discount coupons," "last chance," etc. Next is the news cycle. This is a bit more intel to sift through but think of the days when we used to have current events in school. Use that same old tactic to pick the top stories and predict what is or will be the next lure. Here are some examples. When there is a natural disaster: Be ready for appeals to the heart with pictures to prove the dire plight of others. A health crisis: How many people have fallen for COVID-19 lures---vaccines, false info maps, fake testing kits, falsely (and potentially) dangerous personal protection equipment? Elections: Be ready for the echo chamber emails that promise your donation of $25 dollars will help a cause. ## Don't Get Hooked by the Phishermen Digital transformation has been a great accelerant of phishing, creating fresh waters for phishermen. As organizations increase the use of technology---whether in the cloud or in a hybrid solution---the threat landscape becomes more challenging. Often the transformation is done with little security in mind. The myth that cloud-based systems are safe harbors only adds to the successful phishing attack. Fake login pages are the new norm of capturing user credentials. Phishermen are using the same "link in the email" to get access, but they have gotten creative in developing login pages with the proper logos and even similar domain names. With the rapid adoption of software as a service (SaaS), users are unsure if they have to login or not. The confusion of something new, coupled with a lack of training, makes it easier to snatch usernames and passwords. What makes the situation worse is those credentials give attackers access to all the resources in the cloud. With their foot in the door, attackers can use the SaaS program to lure more users in the organization with the eventual result of catching a whale, i.e., someone with global administrative rights. The phishermen are creative and relentless. If you haven't already, implement some best practices to avoid becoming the catch of the day: * Be wary of emails that ask for your username or password. Credentials theft is on the rise especially as people are working from home. If in doubt, always call your help desk. * Never open a file that is attached to an email if there is the slightest doubt of its origin. If you are not expecting an email with an attachment, call the person or send a fresh email to confirm the sender and the intent of the attachment. Never just reply to an email for confirmation. * If you are asked for money to give to a charity, stop and confirm the source or, even better, go to the actual site of the charity by typing in the address of the website. * Educate users as you move into the cloud. * Use the security features of single sign-on solutions and multi-factor authentication. Always remember that you are in control. You are smarter than a fish and smarter than today's phishermen. You don't have to bite at the lures. *** ** * ** *** *Kevin O'Malley is part of* [*Plex Cyber*](https://plex-llc.com/)*and the Chief Information Security Officer of Lee County, Florida.* * [Staying Ahead of Evolving Threats](https://www.paloaltonetworks.com/perspectives/all-articles/?cat=staying-ahead-of-evolving-threats) ## Related Content ![](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2026/03/Securing-the-Wrong-Layer-featured.jpg) BLOG ### Staying Ahead of Evolving Threats **Cybersecurity in 2026: What we predicted, what surprised us, and what's next** At Palo Alto Networks, we are privileged to sit at the intersection of cybe... [Haider Pasha](https://www.paloaltonetworks.com/perspectives/author/haider-pasha/ "Posts by Haider Pasha") [](https://www.paloaltonetworks.com/perspectives/cybersecurity-in-2026-what-we-predicted-what-surprised-us-and-whats-next/) ![](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2026/02/Discover.png) BLOG ### Secure AI Usage **The Pilot Trap: Why Scaling AI is Impossible With Legacy AppSec Tools** Bridging the gap between AI innovation and AI control.... [Ian Swanson](https://www.paloaltonetworks.com/perspectives/author/ian-swanson/ "Posts by Ian Swanson") [](https://www.paloaltonetworks.com/perspectives/the-pilot-trap-why-scaling-ai-is-impossible-with-legacy-appsec-tools/) ![](https://www.paloaltonetworks.com/perspectives/wp-content/uploads/2026/01/Dawn-of-the-Autonomous-Agent-featured.jpg) BLOG ### AI **The Dawn of the Autonomous Agent: When AI Starts Attacking** How to fight back when the adversary moves at machine speed.... [Dr. Nicole Nichols](https://www.paloaltonetworks.com/perspectives/author/dr-nicole-nichols/ "Posts by Dr. Nicole Nichols") [](https://www.paloaltonetworks.com/perspectives/the-dawn-of-the-autonomous-agent-when-ai-starts-attacking/) STAY CONNECTED ## Connect with our team today Job Level Sign me up to receive news, product updates, sales outreach, event information and special offers about Palo Alto Networks and its partners. By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) and [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown). This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Reach out {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language