social-engineering
Safeguard articles tagged "social-engineering" — guides, analysis, and best practices for software supply chain and application security.
27 articles
Mailchimp 2022-2023 Incidents: A Timeline
Mailchimp disclosed three social-engineering-driven intrusions in thirteen months; the timeline illustrates how repeated incidents shape vendor trust.
Scattered Spider: Developer Targeting Patterns
The English-speaking social engineering crew behind MGM and Caesars keeps going after developers and help desks. Here's what I keep seeing.
Maintainer Burnout: Security Implications
Exhausted maintainers are not just a welfare problem. They are a security problem. Burnout is a precondition for social engineering, delayed patches, and hostile takeovers.
Deepfakes and Social Engineering: The Human Layer of Supply Chain Attacks
AI-generated deepfakes are making social engineering attacks against software supply chains more convincing and harder to detect.
Twilio 2022 Incidents: Supply Chain Lessons
Twilio disclosed two social engineering incidents in 2022 that cascaded through its customer base; the supply chain lessons remain relevant for any B2B vendor.
Scattered Spider: The Social Engineering Group That Outmaneuvered Enterprise Security
Scattered Spider combined aggressive social engineering with deep knowledge of enterprise IT to breach MGM Resorts, Caesars Entertainment, and dozens of other organizations.
MGM Resorts and Caesars Hit by Scattered Spider: Social Engineering at Scale
In September 2023, the Scattered Spider hacking group crippled MGM Resorts and extorted Caesars Entertainment through phone-based social engineering, exposing how human vulnerabilities can bypass even the most expensive security stacks.
Starjacking Attacks on Package Registries: Exploiting Repository Trust
Starjacking exploits the trust developers place in GitHub stars and repository metadata. Attackers link malicious packages to popular repositories to appear legitimate. Here is how it works.
Microsoft Teams Vulnerability: External Tenant Attacks and the Collaboration Security Gap
Researchers demonstrated that Microsoft Teams' default configuration allowed external attackers to deliver malware directly to employees, bypassing email security controls entirely.
Email Security and Supply Chain Phishing Attacks
Phishing remains the top initial access vector for supply chain attacks. Targeted emails against developers, maintainers, and DevOps engineers open the door to code injection, credential theft, and pipeline compromise.
Aflac and the Scattered Spider Insurance Pivot: June 2025
In June 2025 Scattered Spider pivoted from UK retail to US insurance, hitting Erie Insurance, Philadelphia Insurance, and Aflac inside a week. Aflac later confirmed 22.6 million people affected. We unpack the campaign.
Uber's 2022 Breach: How an 18-Year-Old Social Engineered Past MFA
An attacker bombarded an Uber contractor with MFA push notifications until they accepted. What followed was a full compromise of internal systems.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.