How Crisis and Conflict Fuel Social Engineering Attacks

Attackers follow the news cycle, because a crisis makes people act faster and check less. CISA has warned about exactly this pattern during heightened tensions. When a major conflict, disaster, or market shock fills the headlines, phishing tied to that event rises within days. The lures work for a simple reason. Fear, urgency, and the wish to help wipe out the pause where checking normally happens. So the defense is to prepare before the crisis, not during it.

Why Crisis Makes Social Engineering Easier

Social engineering already runs on emotional pressure. A crisis supplies that pressure for free.

Three things change during a big news event. People read more and share faster, often without checking the source. Feelings run high, which narrows attention to the request in front of them. And odd activity becomes normal, so a message that would look strange in a quiet week blends right in.

That last point matters most. During a crisis, companies send real alerts, real policy updates, and real urgent requests. Attackers hide among them.

What These Campaigns Actually Look Like

The lures follow patterns you can learn, whichever crisis is current.

That voice row matters because a vishing caller gets a ready excuse for the call. Meanwhile, the supply chain row is the expensive one. A crisis hands attackers a ready excuse for why a supplier’s bank details changed. Finance teams under pressure may just accept it.

Notice that none of these need technical skill. They need timing.

The Psychology That Makes It Work

Crisis lures use the same mental shortcuts as ordinary phishing, just turned up.

Urgency shrinks the decision window, so people act before checking. Verizon’s breach research keeps finding the human element in most breaches for this reason. Authority carries more weight when official guidance is expected anyway. And the wish to help, which charity lures target head-on, makes pausing feel cold rather than careful.

Why people fall for phishing covers these shortcuts in detail. What a crisis adds is volume and cover. More messages arrive, and each one has a better reason to exist.

Prepare Before, Not During

The core problem with crisis response is timing. By the time the event fills the headlines, attackers are already sending, and staff are already stressed.

So the preparation has to be standing.

• Name one trusted internal channel in advance. Staff should know where real company updates appear. Then anything arriving elsewhere looks odd by default.
• Fix payment checks for good. A callback rule that already exists does not need inventing under pressure.
• Pick a charity route ahead of time. If the company donates, name the channel first, so staff are not judging appeals one by one.
• Brief finance and HR early. They get the most crisis-shaped lures, because they handle money and personal data. The usual countermeasures against social engineering apply, just under more pressure.
• Keep reporting blame-free. Stressed people report less if they expect criticism, and crisis periods are exactly when speed matters.

None of this depends on knowing which crisis is coming, and that is the point.

What to Do When It Starts

Still, once an event is underway, a few actions help.

Send a short, plain internal notice early, confirming where official updates will come from. Keep it boring and factual, since a dramatic security warning competes with the crisis itself for attention. That does two things. It tells staff what to expect, and it sets a baseline that makes fake messages easier to spot.

Tighten payment approvals for a while if the crisis hits suppliers or shipping. Watch for lookalike domains registered around the event, since attackers buy these in bulk when a story breaks. And brief the help desk, because a crisis brings more password reset requests. That is exactly the cover a vishing caller wants.

Train for the Pattern, Not the Headline

A crisis-specific training module is always late. The event will have passed before the content ships.

What transfers is the pattern. Staff who learn that urgency, plus authority, plus a narrow window means stop and check will apply it to any crisis, including ones nobody saw coming.

Threatcop Security Awareness Training (TSAT) builds that habit through realistic, repeated simulations rather than one-off content. Its Employee Vulnerability Score shows which staff act under pressure, not just who clicks. That difference is exactly what crisis lures target. Repeat-offender flagging then points coaching at the people most likely to act first and check later. Average breach time shows how much room an attacker would have during a genuinely stressful week.

The Bottom Line

Attackers do not need a new trick when the news supplies the pressure for them. Every major event brings a fresh wave of lures built on urgency, authority, and the wish to help. They land on people already running with less attention than usual. So the defense is standing preparation. One trusted internal channel. Permanent payment checks. A charity route decided in advance. And reporting that carries no blame, since fast reporting is what limits the damage. Build those while things are calm, because during the crisis there is no time to design them and no attention left to learn them.

Frequently Asked Questions

Anjali Chauhan

Anjali is the Cybersecurity Manager at Kratikal, leading a team focused on strengthening security through rigorous vulnerability assessments and penetration testing. With expertise across web, network, and cloud environments, she drives strategies to safeguard clients’ critical assets while mentoring her team and staying ahead of escalating cyber threats.

Anjali Chauhan

Anjali is the Cybersecurity Manager at Kratikal, leading a team focused on strengthening security through rigorous vulnerability assessments and penetration testing. With expertise across web, network, and cloud environments, she drives strategies to safeguard clients’ critical assets while mentoring her team and staying ahead of escalating cyber threats.