2025 Unit 42 Global Incident Response Report: Social Engineering Edition

Unit 42 finds social engineering to be the dominant initial access vector (36% of IR cases) in 2024–2025, highlighting two models — high-touch, real-time impersonation (help-desk/MFA bypass) and at-scale ClickFix-style web/browser deception — that enabled rapid credential theft, privileged escalation and data exposure (60% of social-engineering cases). The report profiles financially motivated and state-aligned actors (Muddled Libra, Agent Serpens, DPRK-linked groups), documents common payloads (credential stealers like RedLine and Lampion, silent loaders, RATs), describes AI-assisted scaling and agentic tooling, and recommends identity-centric defenses (ITDR/UEBA, Zero Trust, hardened recovery workflows and network-layer controls).