Security+ 801 Countdown, T-27: Social Engineering Gets Whaling, Quishing, and Deepfakes

Social engineering is the manipulation of a person, rather than of a system, into granting access, revealing information, or moving money. Its instrument is a lure: an email, text, call, or meeting that borrows the identity of someone trusted and supplies a reason to act before checking. No software flaw is required; the exploit runs in the recipient’s judgment, which is why defenders classify and train against social engineering as its own category of attack.

In SY0-801, social engineering attacks sit under objective 2.5, “Given a scenario, analyze indicators of malicious activity,” where phishing, vishing, and smishing are joined by four terms new to the exam: whaling, spear phishing, quishing, and deepfake (CompTIA 2025). Expect stems that describe an email, text, call, or video meeting and ask which attack it is or what to do next. That rewards a classification habit (target first, then channel) over a memorized definition list. This post builds the habit, then works through the two newest mechanisms in detail: the QR code that hides a URL from mail filters, and the synthetic video call that led a finance employee to wire HK$200 million (The Standard 2024).

Classifying lures by target, then by channel

CompTIA’s objectives list these terms without defining them, so the definitions below come from MITRE ATT&CK, the FBI, and CISA. Two questions sort almost every case: who was targeted, and what carried the lure.

The target axis runs from broad to narrow. Phishing is the untargeted, mass lure: the same message sent to many recipients (MITRE 2026b). Spear phishing narrows the aim to a specific person, company, or industry, with the message tailored to what the attacker has learned about the target (MITRE 2026b). Whaling narrows it again to an executive recipient. Whaling has no CompTIA definition, NIST definition, or ATT&CK technique; treat it as conventional usage, spear phishing defined by who receives it.

The channel axis asks what medium carried the bait. Smishing is phishing over SMS or MMS (FBI 2025a). Vishing is phishing by voice call, often with spoofed caller ID so the phone displays a trusted number (CISA 2021). Quishing hides the URL in a QR code, so the victim’s own phone camera, rather than a clickable link, delivers it (MITRE 2026c). A deepfake is synthetic or cloned audio or video that puts a trusted face or voice on the attacker’s script (MITRE 2026a). Impersonation sits on a third axis, identity: a false claim to be a trusted person or organization, whatever the channel.

Term	Axis	What defines it
Phishing	Target	Untargeted, mass lure (MITRE 2026b)
Spear phishing	Target	A specific person, company, or industry (MITRE 2026b)
Whaling	Target	Spear phishing whose recipient is an executive
Smishing	Channel	SMS or MMS (FBI 2025a)
Vishing	Channel	Voice, often with spoofed caller ID (CISA 2021)
Quishing	Channel	A URL hidden in a QR code (MITRE 2026c)
Deepfake	Channel	Synthetic or cloned audio or video (MITRE 2026a)
Impersonation	Identity	A false claim to be a trusted person or organization

The axes are independent, so one message can earn several labels. When a stem supports several terms, pick the most specific (a heuristic, not a CompTIA rule): a cloned voice beats vishing, a QR code beats phishing or smishing, and a CFO recipient beats spear phishing. The edges need care. Calling an RCS lure smishing is interpretation, since the FBI defines smishing by SMS or MMS; SY0-801 lists RCS only as a threat vector, covered at T-31.

ATT&CK gives the same vocabulary stable identifiers. Phishing is T1566, and Mobile T1660 names smishing, quishing, and vishing together (MITRE 2026b; MITRE 2026c). Impersonation is now T1684.001; ATT&CK v19, released April 28, 2026, revoked the T1656 that older study guides cite (MITRE 2026d). Producing a deepfake is T1683.002 (MITRE 2026a).

Quishing: how a QR code slips past mail controls

Quishing is QR code phishing: the lure is an image that encodes a URL, and the victim’s phone decodes it. Microsoft first noticed the rise in QR code attacks in September 2023 (Chitrakar 2024). The technique’s appeal is structural: email security was built around links, and a QR code is not a link until something turns pixels back into text.

Do not assume email gateways cannot do that. Microsoft says thorough image analysis was not standard when the surge began, and Defender for Office 365 now extracts URLs from QR codes (Chitrakar 2024). What still works is a stack of smaller evasions:

• Pixels, not a link: Safe Links rewriting and time-of-click checks have nothing to act on until something decodes the image.
• Rendering tricks: codes drawn with colors or HTML tables (Chitrakar 2024), or with ASCII and Unicode blocks (Kanase 2025).
• Split and nested codes: the Gabagool kit splits one code across two images, and Tycoon 2FA wraps a malicious code around a benign one (Kanase 2025).
• Minimal text: MFA re-enrollment and document-signing lures give classifiers little to score (Chitrakar 2024).
• Device pivot: the scan happens on a phone, often personal, outside the proxy, EDR, and Safe Links (MITRE 2026c).
• Small screens: mobile and chat apps have “constrained user interfaces” that hide the full URL (CISA et al. 2023).
• Redirects and overlays: the decoded URL often hits a redirector, and physical codes get a sticker on top (FBI 2022).

Here is the anatomy of an illustrative quishing message:

From: "IT Service Desk" <it-servicedesk@helpdesk-notice.example>
To: dana.reyes@example.com
Subject: Action required: re-register MFA before 17:00
Date: Tue, 20 Oct 2026 08:14:09 -0400
MIME-Version: 1.0
Content-Type: multipart/related; boundary="qr-7f3a"

--qr-7f3a
Content-Type: text/html; charset="utf-8"

<p>Scan with your phone to keep access.</p><img src="cid:qr01@helpdesk-notice.example">
--qr-7f3a
Content-Type: image/png
Content-ID: <qr01@helpdesk-notice.example>
Content-Disposition: inline; filename="mfa.png"
Content-Transfer-Encoding: base64

The HTML has no anchor tag, so controls that count or rewrite links see nothing. The red flags are the lookalike domain, the deadline, and an MFA lure that makes scanning sound routine. Decode it on an isolated host instead of scanning it:

$ zbarimg -q mfa.png
QR-Code:https://www.example.com/url?q=https%3A%2F%2Fsso-verify.example.net%2Fa%2F7Kq2

The output is illustrative: a redirector wrapping the real destination. Exit status 4 means no barcode was found, which is what a split or ASCII-rendered code produces in a naive pipeline. In Defender XDR, URLs decoded from QR codes land in EmailUrlInfo with UrlLocation equal to “QRCode” (Microsoft, n.d.), so you can rank them by reach:

EmailUrlInfo
| where Timestamp > ago(7d) and UrlLocation == "QRCode"
| join kind=inner (
    EmailEvents
    | where EmailDirection == "Inbound" and DeliveryAction == "Delivered"
    | project NetworkMessageId, RecipientEmailAddress
  ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress) by UrlDomain
| sort by Recipients desc

If sso-verify.example.net reached 212 inboxes, Safe Links click telemetry may still show nothing, because users scanned on phones; that device-pivot gap is an inference, which is why the hunt starts from delivery, not clicks. Defenses follow the mechanics: decode and sandbox the extracted URL at the gateway, require phishing-resistant MFA (T-11), and put MDM or mobile threat defense on managed phones, knowing BYOD phones remain the gap. Users should check the full URL after scanning, check physical codes for stickers, and never install an app from a QR code (FBI 2022).

Deepfakes: the Arup case and why it is not whaling

A deepfake is synthetic or cloned audio or video, generated from public recordings of a real person so that the person appears to say what the attacker scripts (MITRE 2026a). Its role in a social engineering chain is specific: it does not deliver the lure, it defeats the check a cautious recipient would otherwise make.

Take Arup, the UK engineering firm. In January 2024 a finance employee in its Hong Kong office received a message, apparently from the UK-based CFO, about a secret transaction, and at first suspected phishing (Magramo 2024). He then joined a video conference in which, Hong Kong police said, every participant was fake (Chen and Magramo 2024). Within a week he made 15 transfers totaling HK$200 million (The Standard 2024), about US$25.6 million. The fraud surfaced only when he later checked with head office.

The sequence is the lesson: the employee’s first instinct was correct, and what overrode it was a meeting in which familiar faces and voices supplied the confirmation he was looking for.

Whaling is the tempting wrong answer. The CFO was impersonated; a finance employee was targeted. In 801 terms that is deepfake plus impersonation, with the payment side as business email compromise (BEC), covered at T-2. The stopping control was verification through an independently sourced channel, such as a call to the UK office on a known number, before the first transfer.

Deepfake verification is procedural, not perceptual. The FBI says AI-generated content is “often difficult to identify” (FBI 2025a), so spotting glitches is a weak control. Hang up and call a number you look up yourself, and confirm any new account or platform through a previously confirmed channel (FBI 2024; FBI 2025a); the December 19, 2025 update adds that actors move victims to Signal, Telegram, or WhatsApp and ask for authentication codes (FBI 2025b). Hong Kong police advised asking questions that test a participant’s identity (The Standard 2024). The FBI suggests a secret word for families; using one with finance teams is an extension. And NIST SP 800-63B-4 says “Biometric comparison based on voice SHALL NOT be used,” so a familiar voice proves nothing (Temoshok et al. 2025).

Human-based attack surfaces

Social engineering also appears in SY0-801’s list of human-based threat vectors, where the question is not which attack is happening but where exposure comes from. That list names impersonation, watering hole, contractor, visitor, and biometric (CompTIA 2025).

Impersonation appears in both places. As a vector it is a route in, such as someone posing as a contractor or IT technician; as an attack it is something you identify from indicators. CompTIA defines neither use, so the split is interpretation, but it predicts the stems: the vector objective asks where exposure comes from, and the scenario objective asks what is happening.

Contractor and visitor have no CompTIA definition either; the likely reading is that both hold legitimate, temporary access with less vetting than employees. NIST SP 800-53 Rev. 5 supplies the controls: PE-3 item d, “Escort visitors and control visitor activity”; PE-8 visitor access records; and PS-7, which requires external providers to report terminations of personnel holding badges or privileges (Joint Task Force 2020). Tailgating belongs to T-26.

Biometric has no CompTIA definition; the best-supported interpretation is an attack on the capture pipeline. A presentation attack puts a photo, mask, or molded finger in front of the sensor; an injection attack feeds untrusted media, such as “a forged video of a user,” into the process (NIST, n.d.-a). Hong Kong police said deepfakes fooled facial recognition at least 20 times in loan and bank-account fraud using stolen identity cards (Chen and Magramo 2024); the synthetic face that sells a video call can also pass a face check. SP 800-63B-4 requires presentation attack detection for facial recognition (Temoshok et al. 2025).

A watering hole attack infects websites a targeted group visits often (NIST, n.d.-b), filed in ATT&CK under T1189 Drive-by Compromise (MITRE, n.d.). The attacker chooses the site from the group’s browsing habits. No message is sent, so it is not phishing, and the real site is compromised, so it is not typosquatting.

What you need to know for SY0-801

• Target axis: phishing is mass, spear phishing is researched and specific, and whaling is spear phishing aimed at an executive.
• Channel axis: SMS or MMS is smishing, voice is vishing, a QR code is quishing (even when texted), and synthetic audio or video is a deepfake.
• An executive who is faked signals impersonation or deepfake, not whaling.
• Stem indicators: urgency, authority, secrecy, a payment or MFA-code request, a lookalike domain, a move to another platform, and a request to skip process.
• Quishing defeats link rewriting because there is no link; the URL exists only after a phone decodes the image, usually outside corporate controls.
• Deepfake counters are procedural: a callback on a known number, challenge questions, and a previously confirmed channel.
• Biometric as a human-based vector means a presentation or injection attack on the sensor; presentation attack detection is the control.
• 2.3 “Biometric” is an attack surface; 4.5 “Biometrics” is an authentication factor.
• Pretexting, typosquatting, brand impersonation, and misinformation/disinformation are 701-era vocabulary that no longer appear in the 801 list; expect them as distractors. BEC remains on the exam as a training topic (T-2).

Check yourself

These are my own practice questions, written for this post.

1. A finance clerk wires funds after a video meeting with what appeared to be the CFO and two directors. The company later learns all three were AI-generated from public video. Which SY0-801 attack best describes this?

• A. Whaling.
• B. Deepfake.
• C. Pretexting.
• D. Watering hole.

Answer: B. Synthetic audio and video is the most specific indicator. Whaling requires an executive recipient, and the recipient was a clerk; pretexting is no longer an 801 list item.

2. An email from a lookalike “IT Service Desk” domain holds one sentence and a PNG image, with no hyperlinks, asking users to re-register MFA. Link-rewriting logs show no clicks, yet three users report a sign-in page on their personal phones. Which attack is this, and why did rewriting record nothing?

• A. Smishing; the link arrived by SMS, outside the gateway.
• B. Quishing; the URL was in an image and opened on an unmanaged phone.
• C. Spear phishing; the message named each user individually.
• D. Watering hole; the users visited a compromised site.

Answer: B. The URL lived in a QR code, so there was no link to rewrite, and the scan moved the session to a phone outside corporate controls. The channel was email, not SMS, and nothing shows researched targeting.

3. A penetration tester opens a facial-recognition door reader by holding up a high-resolution photo of an employee. Which human-based vector is this, and which control most directly addresses it?

• A. Biometric; presentation attack detection with liveness checks.
• B. Impersonation; visitor escorts and access logs.
• C. Biometric; switching the reader to voice comparison.
• D. Visitor; badge-based access control.

Answer: A. A spoofed trait shown to a sensor is the clearest reading of 2.3’s “Biometric,” and presentation attack detection with liveness is the direct control. NIST SP 800-63B-4 mandates PAD for facial recognition in digital authentication; it excludes physical access, but the attack is the same. Option C does nothing about a photo and swaps in a modality the same publication bars.

This is T-27 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-26: Network and Physical Attacks, With Sniffing In and Bollards Out. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Chen, Heather, and Kathleen Magramo. 2024. “Finance Worker Pays Out $25 Million After Video Call With Deepfake ‘Chief Financial Officer’.” CNN, February 4, 2024.

Chitrakar, Ramya. 2024. “How Microsoft Defender for Office 365 Innovated to Address QR Code Phishing Attacks.” Microsoft Security Blog, November 4, 2024.

CISA (Cybersecurity and Infrastructure Security Agency). 2021. “Avoiding Social Engineering and Phishing Attacks.” Released February 1, 2021.

CISA, NSA, FBI, and MS-ISAC. 2023. “Phishing Guidance: Stopping the Attack Cycle at Phase One.” October 18, 2023.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

FBI (Federal Bureau of Investigation). 2022. “Cybercriminals Tampering with QR Codes to Steal Victim Funds.” Public Service Announcement I-011822-PSA, January 18, 2022. Internet Crime Complaint Center.

FBI (Federal Bureau of Investigation). 2024. “Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud.” Public Service Announcement I-120324-PSA, December 3, 2024. Internet Crime Complaint Center.

FBI (Federal Bureau of Investigation). 2025a. “Senior US Officials Impersonated in Malicious Messaging Campaign.” Public Service Announcement I-051525-PSA, May 15, 2025. Internet Crime Complaint Center.

FBI (Federal Bureau of Investigation). 2025b. “Senior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign.” Public Service Announcement I-121925-PSA, December 19, 2025. Internet Crime Complaint Center.

Joint Task Force. 2020. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53 Rev. 5.

Kanase, Rohit Suresh. 2025. “Threat Spotlight: Split and Nested QR Codes Fuel New Generation of ‘Quishing’ Attacks.” Barracuda Blog, August 20, 2025.

Magramo, Kathleen. 2024. “Arup Revealed as Victim of $25 Million Deepfake Scam Involving Hong Kong Employee.” CNN Business, May 16, 2024.

Microsoft. n.d. “EmailUrlInfo Table in the Advanced Hunting Schema.” Microsoft Learn. Accessed October 12, 2026.

MITRE. 2026a. “Generate Content: Audio-Visual Content, Sub-technique T1683.002.” MITRE ATT&CK for Enterprise, v19. Created March 25, 2026.

MITRE. 2026b. “Phishing, Technique T1566.” MITRE ATT&CK for Enterprise, version 2.7. Last modified May 12, 2026.

MITRE. 2026c. “Phishing, Technique T1660.” MITRE ATT&CK for Mobile, version 1.2. Last modified May 12, 2026.

MITRE. 2026d. “Social Engineering: Impersonation, Sub-technique T1684.001.” MITRE ATT&CK for Enterprise, v19. Last modified May 12, 2026. See also the v19 release notes.

MITRE. n.d. “Drive-by Compromise, Technique T1189.” MITRE ATT&CK for Enterprise. Accessed October 12, 2026.

NIST (National Institute of Standards and Technology). n.d.-a. “Injection Attack.” CSRC Glossary. Accessed October 12, 2026. See also the entry for presentation attack.

NIST (National Institute of Standards and Technology). n.d.-b. “Watering Hole Attack.” CSRC Glossary. Accessed October 12, 2026.

The Standard. 2024. “HK’s First Deepfake Video Conference Scam Involving HK$200 Million.” The Standard (Hong Kong), February 4, 2024.

Temoshok, David, et al. 2025. Digital Identity Guidelines: Authentication and Authenticator Management. NIST SP 800-63B-4. National Institute of Standards and Technology.