Annual Cyber Threat Report 2025-26

Social engineering is a longstanding and evolving threat to individuals and organisations within Australia, and one that enables malicious cyber actors to compromise accounts, devices, systems or sensitive information.

Malicious cyber actors often go to great lengths to make their communication seem legitimate and trustworthy, increasing the chances that a targeted person will follow their instructions. Recent advancements in Al have amplified the effectiveness of social engineering techniques. For example, malicious cyber actors can use Al to write effective phishing emails, free from grammar and spelling errors, and automate targeted spearphishing attacks. To achieve their goals, malicious cyber actors have weaponised empathy, urgency, and trust to trick individuals or staff into circumventing regular processes to achieve their goals. These communications may appear to come from someone known to the victim, such as a relative, colleague, or senior manager, or an authoritative part of their organisation. AI lowers the skill barrier and increases scale, but does not fundamentally change the nature of social engineering attacks.

While social engineering attempts can be received by anyone, malicious cyber actors often prioritise individuals who have access to sensitive information, the ability to make changes to systems, the authority to perform financial transactions, or those whose roles require regular interaction with unknown or external parties. Anyone can be a target of social engineering, from an employee to the CEO.

The Australian Securities and Investments Commission (ASIC) has seen a sharp rise in online scams using deepfake videos of celebrities and politicians to encourage Australians to part with their money, with criminals increasingly exploiting topical issues in the news to deceive consumers. In June 2026, an Australian broadcaster publicly reported that scammers generated a fake version of their website, along with misleading articles and false images of prominent Australians, to advertise a fraudulent investment platform.

Image

1. The bait

   Malicious cyber actors research your organisation and employees, then target them with an attack that appears to come from a trusted source. Information posted on social media sites can be leveraged by malicious actors to get to know their target. AI can help malicious actors rapidly analyse publicly available information and create highly tailored approaches, making them seem more trustworthy and authentic.

2. The hook

   Using social connection, sympathy, imposed urgency, threats, or a disarming tone, a malicious actor hooks the victim into their scheme. AI can be used to generate convincing emails, messages, images and even voice recordings, increasing the likelihood that users believe the scenario or request presented is real and that the malicious actor is authentic.

3. The attack

   Users are tricked into giving up sensitive information about themselves or their organisation by clicking on a malicious link or changing a password that gives the malicious actor access to accounts and networks, or by opening a malicious attachment. This provides the malicious actor with the key to unlock and steal your information.

4. The long game

   Once a malicious actor has convinced the user to complete a task, or has the information they want, they may disappear, however, they may also maintain access to an account for extended periods, using their access to conduct further malicious acts.