Evolving Social Engineering Tactics in 2026

Social engineering involves the use of psychological pressure to influence people to perform actions or give up confidential information. In the cyber security realm, attackers are using a wide range of social engineering tactics to influence individuals at home and at work to take an action that may or may not be in their best interest.

Evolving social engineering threats have seen trusted platforms, AI tools and everyday workflows be exploited. Rather than traditional phishing methods, which sees people being tricked by urgent requests, attackers are now using much more subtle, trust-based attacks.

Along with the evolving tactics, cyber security services must adapt too. Let’s look at these new cyber threats and how you can spot them before the damage is done.

Why Social Engineering Is Evolving So Rapidly

Perhaps the biggest evolving social engineering tactic and threat is the utilisation of AI tools and automation. Simple search queries on search engines now show top-level results from AI platforms like ChatGPT and Grok, with these widely-trusted platforms providing the answers users are looking for.

While many still have trepidation towards the accuracy and reliability of AI tools, they have now become one of the main ways people source their information and ask for advice. The latter especially has seen attackers adapting faster than traditional cyber defences, as they have seized this trust factor to implement their attacks.

The Rise Of AI and Search-Based Social Engineering

Search engines like Google are now ranking AI-generated content. You will recognise Google’s AI Overview as it appears at the top of the search results page, usually with a paragraph overview followed by bullet points with links to the actual sources it’s gathered the information from.

If it’s a quick answer users are looking for, they aren’t likely to click the source links to find any further information and typically will trust the AI-generated information presented to them. Cyber attackers are blurring the lines between helpful guidance and malicious instruction, exploiting this newfound trust people have, to get them to follow instructions that end up with their systems hacked and information stolen.

Real-World Example of AI-Driven SEO Poisoning Leading to Malware Infection

Here’s a real-life example of social engineering tactics in play, based on research from Huntress, where a macOS user followed instructions from ChatGPT on how to free up storage on their system.

The user searched on Google, “clear disk space on macOS.” Google provided two highly ranked results which directed the user to either a ChatGPT or Grok conversation.

The results appeared completely legitimate, as they were hosted on trusted domains and formatted clearly like standard troubleshooting guidance you may find on Apple’s customer service pages.

The user read and followed the information provided by ChatGPT, and executed a command that downloaded an AMOS stealer, which went on to steal their password and install malware.

This attack was highly effective because it relied entirely on user trust. There was no suspicious phishing email, detectable malicious download or any type of warning from security software. Just a simple copy-and-paste action that led to compromise.

Why This Attack Method Is So Effective

It Looks Like Normal IT Troubleshooting

If you explore IT troubleshooting pages straight from the horse’s mouth, like Apple and Microsoft, they are set out in short, bite-sized instructions, which is exactly how the AI tools presented the information.

Not only was the information presented exactly like these troubleshooting pages, but it also followed the familiar short-style, easy-to-digest content AI platforms are known for. Everything looked completely normal, a key aspect of dangerous cyber social engineering tactics.

It Uses Trusted Platforms

The top-level results on search engines are those that the algorithm finds most useful, authoritative and legitimate. ChatGPT, Grok and other AI tools are trusted platforms, and are increasingly being used for technical guidance, but also exploited by cyber criminals.

It Avoids Traditional Malware Delivery

This attack differed significantly in how the malware and threat were delivered. All it took was a simple search, click and copy-paste. Normally, malware is delivered through downloads, links and attachments. This was completely different; there were no downloads or any warning signs. Just a platform that is used every day, presented as legitimate, helpful and trustworthy. Updates in cyber security awareness training are helping people recognise the evolving social engineering tactics.

The Risks Of Social Engineering For Businesses in 2026

Social engineering attacks in 2026 are more advanced, using AI to manipulate user behaviour rather than exploit technical flaws. Employers are increasingly tricked into compromising endpoints themselves, bypassing traditional email filtering and antivirus tools. This makes endpoint monitoring and behavioural detection essential for identifying suspicious activity and preventing breaches.

How To Stay Protected Against Evolving Social Engineering Tactics

Businesses must adopt a layered approach to cyber security. Monitor endpoint activity for anomalies, enforce strict privilege and identity controls, and implement modern security awareness training. Employees should understand risks like AI-generated instructions and unsafe copy-paste actions.

You can get expert support and review your cyber security practices by contacting Optimising IT for a consultation. Together, we can stay ahead and prevent the threats posed by evolving social engineering tactics.