Our operator didn’t need a single tool. A LinkedIn post about a charity drive. That was enough. From public data alone, we built a spear phishing example so convincing the target effectively wrote it themselves. This is what exposed looks like.
No scanning, no tooling. No technical infrastructure.
Just a LinkedIn feed, a search, and everything an attacker would ever need to walk straight through the front door.
The post that said too much
In practice: during an OSINT engagement, our operator was mapping the organisation’s community footprint through LinkedIn. Public information only. Reading what they’d chosen to share with the world.
That’s when it appeared: a post celebrating their partnership with a local charity. Warm, genuine, well-intentioned. A company proud of doing good in their community.
And an attacker’s roadmap.
The goodwill was real, the relationships were real. The warmth in the writing told us exactly who cared about this work and would never want to let the partnership down.
That’s not a human weakness. It’s a human strength. But in the wrong hands, it becomes the most believable hook imaginable.
The target hiding in plain sight
Cross-referencing that post against employee data, one person stood out immediately.
A senior employee, personally connected to the partnership.
They owned this relationship, which means a routine email arriving from the charity would land in their inbox as completely normal. Expected, even.
On top of which, the breach data sealed it: their credentials had appeared in multiple known breaches.
The spear phishing example that writes itself
No creativity required at this point.
Add to that a spring collection drive referencing the existing partnership. A request to review an updated agreement. Nothing suspicious. Just a cause they genuinely care about, asking for a few minutes of their time.
A payload nobody would think twice about opening.
The consequence is straightforward. A targeted phishing attack like this succeeding usually means valid credentials in an attacker’s hands. From there, it’s lateral movement, mailbox access, and a foothold inside systems nobody meant to expose.
The cost isn’t the phishing email. It’s everything that follows it.
Attackers don’t invent the most convincing phishing emails. They borrow them from the target’s own LinkedIn feed.
The uncomfortable question
Every piece of information that went into this pretext was posted voluntarily.
The partnership announcement. A role, a name. A personal connection to the cause. Nobody stole it. None of it was leaked. It was shared, proudly, because it deserved to be.
That’s what makes this hard. Here’s why: social engineering like this doesn’t require touching a system, a network, or a login page.
It only requires enough personal and organisational context, freely shared, to build trust.
The answer isn’t to stop celebrating good work or hide your people from the world. It’s to understand that the same information your communications team shares as a feel-good story is being read by more than just your partners and supporters.
And to test whether your people, however experienced and well-intentioned, would hesitate before opening that attachment.
Because the most dangerous intelligence is the kind you gave away yourself.
Want to see what your public footprint is really saying?
Contact CovertSwarm and find out what an attacker sees before you do.