07 · Malware & Social Engineering Basics¶
Modules 2–6 covered technical controls. This module covers the attacks that target people instead of (or in addition to) technology — and the malware categories those attacks typically deliver. No live malware is used anywhere in this course; this module is entirely conceptual, backed by real examples and a phishing-recognition exercise you can safely practice on yourself.
Never download, run, or analyze real malware casually
Live malware samples belong in an isolated, air-gapped sandbox handled by someone trained for it (Level 3 Module 3 covers this properly, in a controlled VM with no network access). This module never asks you to download or execute anything malicious.
1. Malware categories¶
"Malware" (malicious software) is an umbrella term. The categories describe behavior, and real-world malware frequently combines several:
| Type | Behavior | Example impact |
|---|---|---|
| Virus | Attaches to a host file/program, spreads when that file is run/shared | Corrupts or destroys files it infects |
| Worm | Self-replicates across a network with no human action needed | Can spread globally in hours (e.g., WannaCry via the SMB vulnerability from Module 2) |
| Trojan | Disguised as legitimate software; does something different from what it claims | Opens a backdoor while appearing to be a useful utility |
| Ransomware | Encrypts the victim's files, demands payment for the decryption key | Business-halting; modern variants also exfiltrate data first ("double extortion") |
| Spyware | Covertly monitors activity — keystrokes, screen, browsing | Credential theft, surveillance |
| Adware | Displays unwanted advertising, often bundled with legitimate-looking software | Usually more nuisance than damage, but can be a delivery vector for worse |
| Rootkit | Hides its own presence and other malware's, often at the OS/kernel level | Extremely hard to detect and remove once installed |
| Botnet malware | Turns the infected machine into a remotely controlled "bot" in a larger network | Used for DDoS attacks, spam, further malware distribution |
Ransomware's actual mechanism, briefly
Modern ransomware typically uses the cryptography from Module 4 correctly — it generates a strong symmetric key, encrypts the victim's files with it, then encrypts that key with the attacker's public key so only the attacker's private key can recover it. This is precisely why "just brute force the encryption" is not a realistic recovery path for well-built ransomware — the underlying crypto is sound, only the use of it is malicious. Recovery realistically depends on backups (defense in depth, Module 1) taken before the infection.
2. Social engineering — attacking the human¶
Social engineering is manipulating people into breaking normal security procedures — bypassing every technical control covered so far by targeting the human who has legitimate access. It works because it exploits normal, reasonable human behavior: trust, helpfulness, fear, urgency, and authority.
| Technique | How it works |
|---|---|
| Phishing | Mass emails impersonating a trusted sender, pushing the victim to click a link or open an attachment |
| Spear phishing | Phishing tailored to a specific individual using researched personal/professional details |
| Whaling | Spear phishing targeted at senior executives specifically |
| Vishing | Voice phishing — a phone call impersonating IT support, a bank, or an executive |
| Smishing | Phishing via SMS text message |
| Pretexting | Inventing a fabricated scenario ("I'm from IT, I need your password to fix an issue") to extract information |
| Baiting | Leaving an infected USB drive somewhere it will be found and plugged in out of curiosity |
| Tailgating / piggybacking | Following an authorized person through a secured physical door without their own badge |
3. Recognizing phishing — the concrete signals¶
Phishing succeeds by creating urgency and short-circuiting careful thought. Slowing down and checking these signals catches the overwhelming majority of attempts:
| Signal | What to check |
|---|---|
| Sender address | Does the domain exactly match the real organization? (paypa1.com vs paypal.com, or a lookalike subdomain) |
| Urgency/fear language | "Your account will be suspended in 24 hours," "Immediate action required" — designed to prevent careful checking |
| Generic greeting | "Dear Customer" instead of your actual name, from an organization that should know it |
| Link mismatch | Hover over (don't click) a link — does the actual URL destination match the displayed text and the claimed sender? |
| Unexpected attachment | An invoice, shipping notice, or document you weren't expecting, especially .exe, .zip, or macro-enabled Office files |
| Requests that bypass normal process | A "CEO" emailing asking for an urgent wire transfer or gift cards, outside normal channels |
| Too good to be true | Prize notifications, unexpected refunds, unclaimed inheritance |
The single best habit: verify out-of-band
If an email, text, or call asks you to act urgently on something sensitive (send money, share credentials, grant access), verify through a separate, known-good channel — call the person or organization back using a number you already had, not one provided in the suspicious message. This one habit defeats the overwhelming majority of social engineering, because it removes the attacker's control over the verification channel.
4. Why security awareness training exists¶
Technical controls (spam filters, email authentication like SPF/DKIM/DMARC, endpoint protection) catch a large share of attacks before they reach a person — but they cannot catch everything, and a sufficiently well-crafted spear-phishing email will get through. This is why organizations run security awareness training and simulated phishing campaigns: the goal isn't to make every employee a security expert, it's to build the habit of pausing and verifying described above, and to give people a clear, low-friction way to report something suspicious rather than either ignoring it or clicking through out of uncertainty.
How It Actually Works: how antivirus actually detects malware, and why phishing exploits a real cognitive shortcut¶
Traditional antivirus works by signature matching: the vendor's lab extracts a short, distinctive byte sequence from a known-malicious file (a "signature," often a cryptographic hash of a section of code, or a fuzzy hash tolerant of small changes) and the AV engine scans files on disk by computing the same hash/pattern over each one and comparing it against a local database updated continuously. This is fast and has near-zero false positives, but it is fundamentally reactive — it can only catch malware that someone has already seen, hashed, and shipped a signature for, which is why attackers routinely repack the same payload with a different packer/compiler flag to produce a different hash from functionally identical code.
Modern endpoint detection adds behavioral/heuristic analysis to close that gap: rather than matching bytes, the engine hooks key OS APIs (process creation, registry writes, network connections) and evaluates sequences of actions against known-malicious patterns — e.g., "a Word process spawns PowerShell, which downloads a file, which is then executed" is flagged regardless of the payload's exact bytes, because the behavior graph matches a known technique (this is the operating principle behind MITRE ATT&CK-based detection, which Level 3–4 build on directly). Sandboxing takes this further by actually executing a suspicious file inside an instrumented virtual machine for a few seconds and recording every syscall it makes, classifying it by the effects it produces rather than by static inspection — which is why sophisticated malware checks for signs of virtualization (unusual hardware IDs, short uptime, absence of user mouse movement) before detonating its real payload, specifically to defeat this technique.
Phishing works on a completely different attack surface — human cognition rather than software parsing — but it has just as mechanical an explanation. It reliably exploits System 1 thinking (Kahneman's term for fast, automatic, low-effort judgment): an email that creates urgency ("your account will be suspended in 24 hours") or authority ("message from the CEO") short-circuits the slower, deliberate verification most people would apply if given time and no emotional pressure. The concrete signals this module teaches — mismatched sender domain, urgency language, unexpected attachments — work because they force a brief switch back to System 2 (slow, analytical) processing: checking the actual domain instead of the display name, for instance, requires deliberately overriding the automatic trust most people extend to a familiar-looking name. Security awareness training's real mechanism of action is building that pause into habit, not teaching facts about malware.
Key terms¶
| Term | Meaning |
|---|---|
| Malware | Malicious software — umbrella term for viruses, worms, trojans, ransomware, etc. |
| Ransomware | Malware that encrypts victim files and demands payment for recovery |
| Social engineering | Manipulating people to bypass normal security procedures |
| Phishing | Mass-targeted fraudulent messages impersonating a trusted sender |
| Spear phishing | Phishing tailored to a specific, researched individual |
| Pretexting | Fabricating a scenario to extract information or access |
| Out-of-band verification | Confirming a request through a separate, independently trusted channel |
Exercise¶
No downloads required — this is an analysis and awareness exercise.
-
Check your own inbox's spam/junk folder (safely — do not click any links or open any attachments) for a real phishing or spam email. Using the signal table in section 3, identify at least three specific red flags it exhibits. Write down what it's impersonating and what action it wants the recipient to take.
-
Write a realistic (but clearly fictional, for-training-purposes) phishing email targeting an employee at a fictional company, using at least four techniques from section 3 (urgency, sender spoofing description, a plausible pretext, a call to action). Then, immediately below it, annotate your own email pointing out each red flag you deliberately included — this dual exercise (write one, then break it down) is exactly what security awareness trainers do when building simulated phishing campaigns.
-
Classify five scenarios by social engineering technique from the table in section 2:
- A caller claiming to be from your bank's fraud department, asking you to "confirm" your card number.
- A USB drive labeled "Executive Salaries 2026" left in an office parking lot.
- A text message claiming a package delivery failed, with a link to "reschedule."
- Someone in a delivery uniform asking you to hold a secure door open because their hands are full.
- An email, apparently from your own CEO, urgently requesting you purchase gift cards for a "client gift."
-
Written answer. For the ransomware mechanism described in section 1, explain in your own words why paying the ransom is not guaranteed to recover your files even if the attacker's cryptography is implemented correctly — think about what has to be true about the attacker's honesty and operational reliability, independent of the math.