Email-based social engineering attacks remain one of the most significant cyber threats to organisations. These attacks directly target employees, exploiting human factors such as urgency, trust, emotional responses, or lack of awareness. A single unrecognised malicious email can result in data breaches, financial losses, or unauthorised access to organisational networks and information systems.
Why social engineering remains a major threat
Social engineering attacks are commonly carried out using deceptive links, malicious attachments, or spoofed sender identities. Increasingly, attackers leverage compromised email accounts, including personal or Office 365 accounts. According to the ENISA 2024 Threat Landscape, phishing remains one of the most prevalent threats, targeting organisational users to steal credentials or distribute malicious code within networks and information systems.
A lack of awareness and improper handling of suspicious emails are among the main reasons these attacks succeed. Therefore, it is essential not only to recognise malicious emails but also to respond correctly and preserve evidence for investigation.
Common types of social engineering attacks
Organisations most frequently encounter the following attack types via email:
- Phishing, where users are tricked into visiting fake websites, entering credentials, or downloading malicious attachments.
- Business Email Compromise (BEC), aimed at financial fraud through fake payment requests or altered bank details.
- Spear phishing, which targets specific employees with access to sensitive information systems.
- CEO fraud (whaling), where attackers impersonate senior executives to request urgent or confidential actions.
Email structure and indicators of malicious intent
To effectively identify malicious emails, it is crucial to understand their structure. Key elements to analyse include email headers (SPF, DKIM, DMARC), discrepancies between “From” and “Reply-To” fields, urgent or threatening subject lines, content tone, attachments, and embedded links.
Attachments such as ZIP, HTML, PDF, or macro-enabled Office files pose a particularly high risk, as do links that appear legitimate but redirect to different domains or use URL shortening services.
Identifying social engineering indicators
Suspicious emails often contain:
- ● domains resembling legitimate ones but with subtle differences;
- ● urgent, threatening, or enticing language;
- ● generic greetings;
- ● unusual requests for login credentials or financial information;
- ● inconsistencies in writing style or tone, even when language appears correct.
Actions to take when a malicious email is identified
When a suspicious email is detected, it should not be deleted or forwarded normally. The message must be preserved in its original format (.eml or .msg), attachments and links must not be opened, and the sender should not be contacted. The incident should be reported to internal cybersecurity teams or SOCs. If an incident occurs, it must be reported to the National Cyber Security Centre (NKSC) in accordance with legal requirements.
Prevention and incident management
Effective prevention of social engineering attacks requires a combination of technical controls (email filtering, SIEM, SOAR, DLP, MFA) and organisational measures, including employee training, phishing simulations, clear reporting procedures, and a tested incident response plan. A well-prepared and regularly exercised plan significantly reduces the impact of cyber incidents and supports business continuity.
Summary
Email-based social engineering attacks are an unavoidable aspect of the modern cyber threat landscape. Continuous employee awareness, well-defined response procedures, proper investigation of malicious emails, and a balanced implementation of technical and organisational controls are essential to effectively reduce the associated risks.
Have more questions or want to know more about social engineering? Let's talk!