Technique

Social Media Reconnaissance

Also known as: OSINT, Social Engineering Reconnaissance, Profile Scraping, Social Profiling, Personal Intelligence Gathering, Digital Footprint Analysis

TARGETINGMITRE ATT&CK: Search Open Websites/Domains: Social Media (T1593.001)

Mining public social media profiles for personal details, relationships, and lifestyle information.

Common attack flows

How it fits in a scam

This technique shows up duringTARGETING

Before

After

Defense

How to defend against this

How to spot it

  • Unexpected friend/follow requests from unknown people or duplicate accounts of known contacts
  • Strangers referencing specific personal details (employer, pets, vacations) in unsolicited contact
  • Receiving highly personalized phishing that mentions recent life events or interests
  • Someone asking probing questions about routines, schedules, or locations
  • New connections rapidly asking personal questions before building rapport
  • Accounts viewing your profile repeatedly without engaging (if platform shows viewers)

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading