You do not need to be a skilled hacker to run a social engineering attack in 2026.

You need a LinkedIn profile, an AI tool and a target.

That is the shift ESET’s Threat Report H1 2026 documents. The biggest AI-driven threat right now is not autonomous malware. It is AI social engineering of phishing, impersonation and fraud made faster, cheaper and more convincing by tools that anyone can access. The skill barrier is gone. The volume is up. And the attacks look personal because they are built from personal data.

AI Social Engineering Is Now the Easiest Form of Cybercrime

Every public post is raw material.

Your workplace on LinkedIn. A photo from a company event. A colleague tagged in a post. An update about a recent project. Individually, none of these seem sensitive. Together, they are enough for an AI tool to build a detailed profile of you, your role, your relationships and your recent movements in minutes.

This is what makes AI social engineering different from old-school phishing. Old-school phishing sent the same message to a million people and hoped someone would click. AI social engineering sends a message that mentions your manager’s name, references your last team dinner and arrives on a day when your guard is down.

ESET found that this kind of AI-assisted reconnaissance has now removed the specialist knowledge requirement entirely. Threat actors who previously needed skills and time to profile a target now need neither.

Types of AI Social Engineering Cyber Attacks

The information gathered through AI-assisted reconnaissance gets used in several ways.

Spear phishing: an email that contains details specific enough to feel genuine. Over 80 per cent of phishing emails identified in late 2024 and early 2025 involved some form of AI assistance. The recipient sees their employer named, a recent event referenced, a familiar tone. They do not recognise it as a threat because it does not look like one.

Deepfake voice calls: AI synthesises a voice from a few seconds of publicly available audio. The call sounds like a colleague. Or the CFO. Attackers used deepfake audio to bypass voice authentication at a Hong Kong bank in a documented 2024 case. The technology has only improved since.

Business email compromise timed for absence: social media tells attackers when an employee is on leave. That is the moment they target colleagues, knowing the usual verification channel is unavailable. The request seems plausible. The approval comes through before anyone checks.

The common thread is that none of these attacks require breaking through a technical barrier. AI social engineering works by going around the technical layer entirely and targeting the person.

Why Managed IT Security and Firewalls Cannot Stop Social Engineering

Most enterprise security investment addresses perimeter defence. Firewalls, endpoint protection, managed IT security services. These are necessary. They are not the whole answer.

Not one of them stops an employee reading a convincing email and clicking a link. Not one of them stops a finance team member wiring funds in response to a voice call that sounds like the managing director. The tools catch what comes through the gate. They have no view of the person standing at the gate.

For Singapore organisations in finance, government, healthcare and critical infrastructure, this gap has regulatory weight. MAS Technology Risk Management guidelines and Singapore’s PDPA both require organisations to manage access and protect data. An AI social engineering attack that bypasses technical controls entirely is a direct exposure to both.

The SPF flagged this in May 2026. At least 20 confirmed cases involved victims being socially engineered into handing over Singpass credentials. Technical controls played no role in any of those breaches. Human judgement did.

Security Awareness Training and Human Risk Management Closes the Gap

The practical reality is that some of the information attackers use is already public and cannot be recalled. What organisations can control is whether their people recognise an attack when it arrives.

Security awareness training built around current AI social engineering lures is measurably different from annual compliance modules. Simulated phishing campaigns that mirror what employees actually receive show which departments and roles are most exposed. Tracking phish-prone percentage across teams tells you where to concentrate training before an attacker finds the same answer. Real-time coaching after a simulated click creates a felt experience that a slide deck cannot replicate.

Human risk management is not a soft concern. It is the control layer that addresses the gap AI social engineering is designed to exploit.