Social media is becoming cybercriminals most powerful attack vector

Date:
Mon, 28 Sep 2026 10:26:02 +0000

Description:
Cybercriminals are exploiting trusted brands online, while AI makes impersonation faster and harder to detect.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Social media has become central to how businesses communicate with customers, promote their brands, and build trust. But as businesses have relied more on these channels, they have also become a more attractive target for cybercriminals.

New research has found that social media impersonation and defamation have risen from the fifth greatest cyber threat last year to the top expected cybersecurity threat over the next three years. The data also revealed that employee and executive impersonation, including deepfakes, has entered the
top five areas of risk for the first time. Elliott Champion Social Links Navigation

Senior Director of Technology for Brand Protection at CSC. These findings point to a wider challenge for security teams. Cybercriminals are still
trying to compromise systems, but they are also increasingly using other ways to exploit legitimate brands hard-earned trust. That trust might sit in a senior leaders online profile, a brands social media presence, a customer service account, a domain name, or a website that looks legitimate at first glance. Latest Videos From TechRadar Watch full video here:

For security leaders, this means the attack surface is no longer defined only by infrastructure they own and control. It also includes the public-facing channels where customers, employees, and partners interact with the company every day.

Security strategies now need to reflect that reality. A threat may start with a fake profile, but it rarely stays there. You may like We built a trillion-dollar security industry on top of an unprotected layer Security policy is critical infrastructure AI needs rules and rails: Why governance must move beyond policy Social media and identity have become frontline cyber risks Fake profiles and fraudulent customer service accounts are not new tactics, but they are becoming more prevalent and are increasingly being used as entry points for phishing, fraud, counterfeit sales, and wider brand
abuse.

And this is all happening at a time when cybersecurity teams are already
under pressure. Recent research found that 72% of senior technology leaders said the level of cybersecurity threats faced by their organization in 2025 was either critical or very critical. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

On social media, criminals can meet potential victims where they are already used to engaging with brands. Fake accounts can be used to share malicious links, promote fraudulent schemes, spread false information, or pose as legitimate support channels.

Attackers may then direct users to a second location, such as a lookalike website, fake login portal, or phishing page, where victims are encouraged to enter account credentials, payment information, or other sensitive data .

A separate but related risk is counterfeiting. Fraudulent social media accounts can impersonate legitimate brands to advertise fake goods, directing customers to websites where counterfeit products are presented as genuine. In both cases, criminals are using the trust associated with a recognized brand to make the next step of the attack appear credible. What to read next AI is making cyber threats faster, but trust will define which businesses survive The ascent of autonomous attacks and the race to contain them AI floods security teams with findings. The advantage is in what happens next

The impact can also go beyond fraud and counterfeiting. Impersonation or fake accounts can be used to spread false or defamatory claims about a company or its employees, potentially damaging reputation and customer confidence even when no direct financial fraud takes place.

As such, social media abuse, domain impersonation, and identity-based fraud should be treated as part of the same threat landscape. AI is making impersonation faster and more convincing AI is making impersonation faster
and more convincing. Criminals can use AI tools to imitate a brands tone of voice, generate convincing customer messages, produce realistic imagery, or create more credible fake profiles at speed.

Deepfakes, synthetic audio, and AI-generated content can also strengthen employee or executive impersonation, particularly when combined with information gathered from multiple sources. For example, an attacker could create a fake executive profile and use AI-generated messages that mimic how that individual communicates, making requests or links appear more credible.

But AI is only one part of the threat. Attackers can also use established techniques to build the infrastructure behind impersonation campaigns. Domain generation algorithms (DGAs), for example, can produce large numbers of plausible lookalike web addresses to support phishing and impersonation campaigns. DGAs are not inherently AI-powered, but they remain a concern for security leaders, with 86% of respondents viewing them as a threat.

These domains can then be combined with fake social media profiles to create
a more convincing digital presence. A fake executive account may point to a fraudulent landing page. A counterfeit product post may direct customers to a lookalike domain.

For customers and employees, these attacks are becoming harder to identify based on appearance alone. The signs of fraud may be subtle, and by the time an impersonation attempt is reported, the campaign may already have moved to another account, page, or domain. Businesses need a more connected approach
to protecting trust Social media impersonation should be treated as part of the wider cybersecurity strategy, rather than as a standalone brand or communications issue. That requires coordination between the teams
responsible for protecting organizations, their people, and their customers.

Attacks often move from a fake profile to a lookalike domain, phishing page, or fraudulent website, so companies need a connected view of where threats
are emerging. Social media teams may spot one warning sign. Security teams
may see another. Legal or brand protection teams may hold the takedown process. A coordinated approach can help companies respond more effectively.

Alongside those measures, organizations need continuous monitoring across social media, domains, websites, and other public-facing digital assets to identify impersonation, brand abuse, and related threats occurring beyond infrastructure they directly control. Bringing these signals together can
help teams recognize when activity across different channels forms part of
the same campaign.

Clear processes for investigation, escalation, and takedown are essential, particularly as AI enables campaigns to spread, adapt, and reappear rapidly. Businesses need to know who owns the response, what evidence is needed, and how quickly action can be taken.

Technology will also play a growing role. More than half of respondents, 57%, confirmed that they use AI-based monitoring and enforcement solutions, while 44% use AI-based solutions for threat detection and fraud prevention. Given the 24/7 nature of the internet and how quickly malicious accounts and materials can appear, some level of automated detection is increasingly important for identifying threats at scale.

This is an important step, but tools alone will not solve the problem. Companies need the right governance, clear ownership, and close collaboration between security, legal, marketing, and digital teams.

The goal should be to detect and stop impersonation before it reaches customers, employees, or partners and causes wider damage. Looking ahead Social media is no longer simply a communications platform that sits outside the traditional cybersecurity perimeter. It has become one of the main environments in which criminals exploit trust, impersonate legitimate people, and manipulate victims into falling for fraud.

As AI makes these attacks faster and more convincing, businesses will need to connect social media protection with their broader approach to identity , domains, and digital brand security. This means monitoring for threats across the full online journey, sharing intelligence between teams, and responding before an impersonation campaign has time to spread.

The companies best equipped to protect customers will recognize that trust itself has become a target and treat the channels where that trust is built
as a core part of their cybersecurity strategy. We've featured the best antivirus software. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/social-media-is-becoming-cybercriminals-most-pow erful-attack-vector


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)