When a simple message brings down giants

From hacked mailboxes to paralyzed casinos, some of the most spectacular attacks of recent years did not start with sophisticated malware. They started with a trick: a message, a phone call, a recovered password. Four true stories to understand how attackers sometimes prefer cunning to force.

What if the best way in was to ask politely?

Imagine this message:

Hello, unusual activity has been detected on your account.
Click here to secure it.

One click. A username. A password. And suddenly, the attacker no longer needs to break down the door: they have the key.

That is the whole logic of phishing and social engineering (the art of manipulating people rather than machines):

• create a believable situation;
• trigger an emotion: fear, urgency, curiosity, the wish to help;
• push someone to act fast, without thinking;
• collect the information or access needed.

The most spectacular part is not always the phishing itself. It is what happens next. A single compromised account can set off a real chain reaction.

Four true stories, four ways to trap people

🇫🇷 FICOBA: the stolen account that opened a door onto 1.2 million bank accounts

FICOBA is France's national register of bank accounts: it lists the accounts opened in French banks. A highly sensitive file, reserved for authorized officials.

From late January 2026 until 13 February, a malicious actor used the credentials of a civil servant (from outside the tax administration, the DGFiP) who had access to this file for information exchanges between ministries. This allowed them to consult part of FICOBA. According to the official statement from the French Ministry of the Economy (in French), about 1.2 million accounts were affected, less than 1% of the file: bank details (RIB, IBAN), identity, address and sometimes tax ID.

Why does it stand out? Because there is no movie scene with a hacker “breaking into” a server. The administration even stated that the incident did not come from a flaw in the application itself. It all started with something much more mundane: a legitimate account used by the wrong person.

To date, official sources establish that the credentials were misused, but not how they were obtained. So we cannot say for certain that phishing was involved in this case.

The question to ask: what if the attacker didn't need to hack the database… because they already had the keys of an authorized user?

🪟 Microsoft: getting in through an old, forgotten door

In late November 2023, the group Microsoft calls Midnight Blizzard (linked to Russian intelligence according to the US and UK governments) went after… an old test account. Its method: password spraying, which consists of trying a few very common passwords on many accounts, rather than many passwords on a single account, so as not to trigger any alarm. That old account, less well protected than the others, eventually gave way.

From this first foothold, the attackers reached a small portion of Microsoft's email accounts, including those of senior leadership members and specialized teams, notably in cybersecurity. Microsoft later stated that information found in those emails had been used to try to access other internal systems.

The fascinating detail: they didn't attack the executives' accounts directly. They first found a side door, then used it to go further. In cybersecurity, the most important door isn't always the front door: sometimes it is the old account nobody looks at anymore.

🎰 MGM Resorts: how a trick ended up hitting Las Vegas

September 2023, Las Vegas. Slot machines go dark. Room key cards stop working. Reservations are disrupted. Welcome to the incident that hit MGM Resorts, one of America's casino giants.

How do you get into such a giant? Not necessarily by attacking its servers head-on. According to press reports, the attackers targeted the IT help desk: by pretending to be an employee, using information found online, they got help accessing that employee's account. MGM later estimated the impact of the incident at about 100 million dollars.

The lesson: the help desk can become as important a target as a server. A technician is there precisely to help. If someone convinces them they are the right user, the system ends up doing exactly what it was designed to do: help.

📨 John Podesta: the email that looked like a Google alert

March 2016. John Podesta, then chairman of Hillary Clinton's presidential campaign, receives a message that looks like a Google security alert: “Someone has your password”. The message claims a suspicious sign-in was detected and urges him to change his password immediately.

The link actually leads to a fake page controlled by the attackers. According to the Associated Press, this trap gave access to his mailbox and to about 50,000 emails, some of which were later published during the campaign.

The detail that makes the story fascinating: the message had been forwarded to the campaign's IT support for checking. The answer? That it was a “legitimate” email. The person who replied later explained he had meant to write “illegitimate”. A typo, at the worst possible moment.

The question to ask: if even the people in charge of security can be fooled, what makes phishing so believable?

What all these stories have in common

These attacks don't all use the same mechanism. And that is precisely what makes them interesting.

So the common thread is not “an email”. The real common thread is gaining the trust or the access needed for the system to open the door itself.

Why phishing is getting even more dangerous

Phishing used to be recognizable by its flaws: “Dear Sir, your account is blocked, please click”, mistakes everywhere, a strange address.

Today, a phishing message can be perfectly written, personalized, adapted to the victim's job, fed with public information (social networks, company website) and sent at the most believable moment. Generative AI makes this personalization faster than ever (see Phishing: the cat-and-mouse game between researchers and attackers).

Example: in late October 2024, Microsoft described a targeted phishing campaign by the same group, Midnight Blizzard, aimed at thousands of people in more than 100 organizations. Some messages impersonated Microsoft employees and referred to other online service providers.

The shift is profound: phishing no longer just tries to send lots of bad emails; it tries to send the right message to the right person.

The same mechanics, in everyday life

You don't need to be a multinational to be targeted. The same tricks show up everywhere:

• email: “Your account will be deleted in 24 hours.”
• text message: “Your parcel could not be delivered.”
• Discord: “Check out this video 😂”
• Instagram: “Your account is about to be suspended.”
• school: “Your homework must be submitted by tonight.”
• the fake friend: “Can you send me the code you just received?”

The setting changes, the identity changes, the level of urgency changes. But the hidden message is always the same: “Do something now, without taking time to think.”

The golden rule: break the script

Rather than a list of ten rules, one single idea: an attacker wants to control your pace. They want you to see → panic → click → act. The goal is to break that chain: see → STOP → check → decide.

Three easy reflexes

1. Look at the real address, not just the display name. “Customer Service” in big letters proves nothing; the full address, and especially the domain after the @, says much more.
2. Switch channels. A message claims to come from a teacher, the bank or a friend? Don't reply to the message itself to check: contact the person another way (phone, official app, in person).
3. To sign in, start from the official site. If an email asks you to sign in, open the website or app yourself rather than following the link in the message.

And if the message really is a trap, one last useful reflex: report it. With Baitback, you just paste the email: the tool finds the server that sent it and its hosting provider, then prepares the report to get the campaign shut down. To understand why a perfect-looking email can still lie, see also An email can lie… even when the checks say “OK”.

The attacker doesn't need to beat you

The attacker doesn't need to break down the door if someone will open it for them.

The most impressive attacks don't always rely on unknown technology or spectacular malware. Sometimes, it all starts with a message. A call. An account. A mistake lasting a few seconds. And behind that small mistake can lie millions of records, a large company paralyzed or confidential information exposed.

In cybersecurity, the weak link isn't necessarily the computer. Sometimes, it is the story told to the person sitting in front of the screen.