# 🎭 Social Engineering Scripts That Stole $100M+ From Vegas Casinos

**URL:** <https://onehack.st/t/social-engineering-scripts-that-stole-100m-from-vegas-casinos/316181>\
**Category:** Tutorials & Methods\
**Tags:** tips-tricks\
**Created:** [January 5, 2026, 12:44am UTC](https://onehack.st/t/social-engineering-scripts-that-stole-100m-from-vegas-casinos/316181 "2026-01-05T00:44:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [January 5, 2026, 12:44am UTC](https://onehack.st/t/social-engineering-scripts-that-stole-100m-from-vegas-casinos/316181/1 "2026-01-05T00:44:16Z")

</div>

# 🕷 The 1% Social Engineering Toolkit

**The stuff that actually works. Not the GitHub list you bookmarked and forgot.**

> 🗺 **One-Line Flow:** How teenagers stole hundreds of millions using phone calls, fake emails, and cloned badges — every technique, tool, and script they used, broken down.

![](https://raw.githubusercontent.com/giuliacassara/awesome-social-engineering/master/images/social_engineering.jpg)

* * *

## Why This Exists

74% of breaches involve a human getting played. Not hacked. _Played._

The [Awesome Social Engineering](https://github.com/v2-dev/awesome-social-engineering) repo? That’s the tutorial level. This is the game.

* * *

## 🎭 Scattered Spider Changed Everything

A bunch of teenagers stole **hundreds of millions** from Fortune 500s using phone calls and fake IT tickets.

No zero-days. No nation-state backing. Just social engineering so good it’s embarrassing.

**The body count:**

- MGM + Caesars (2023) → $100M+ impact
- 165+ Snowflake customers including AT&T, Ticketmaster (2024)
- Marks & Spencer, Co-op, Harrods (2025) → £300M+ losses

> **🎯 Their Exact Playbook (CISA AA23-320A)**
>
> Full advisory: [cisa.gov/news-events/cybersecurity-advisories/aa23-320a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
> 
> **How they get in:**
> 
> | Move | What It Actually Looks Like |
> | --- | --- |
> | **Help Desk Social Engineering** | Call IT, claim you’re locked out, get MFA reset |
> | **MFA Fatigue** | Spam push notifications until victim rage-accepts |
> | **SIM Swap** | Pay carrier insider $500-$5K to port victim’s number |
> | **Voice Clone** | AI-generate CEO’s voice from earnings call audio |
> | **Evilginx Phishing** | Real-time session hijack, MFA means nothing |
> 
> **The script that works:**
> 
> > “Hi, this is [Name] from [Department]. I’m locked out and have a critical deadline. My manager [Manager’s Name] is in a meeting. I just need my MFA reset — my phone’s acting up so I’m calling from a different number.”
> 
> They call end-of-day. Staff are tired. Nobody verifies.
> 
> **After compromise:**
> 
> - Join the company’s incident response calls to watch them hunt
> - Use legitimate tools (TeamViewer, Ngrok) so EDR sleeps
> - Create fake LinkedIn profiles for cover
> 
> MITRE ATT&CK profile: [attack.mitre.org/groups/G1015](https://attack.mitre.org/groups/G1015/)

* * *

## 💸 BEC: The $16.6 Billion Quiet Heist

Business Email Compromise makes more money than ransomware. Nobody talks about it because there’s no flashy ransom note.

**2024 stats:**

- Average loss per incident: **$129,000**
- AI-generated BEC emails: **~40%**
- Year-over-year increase since ChatGPT: **+1,760%**

FBI IC3 page: [fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/business-email-compromise](https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/business-email-compromise)

> **🔪 The BEC Kill Chain**
>
> ```auto
> RECONNAISSANCE
> └─ LinkedIn, SEC filings, press releases
> └─ Map who approves payments, who travels when
> 
> CREDENTIAL THEFT
> └─ Phish the executive or their assistant
> └─ Buy creds from stealer log markets
> 
> MAILBOX TAKEOVER
> └─ Set up forwarding rules (silent copy of everything)
> └─ Learn their writing style, signature, emoji habits
> └─ Wait for a big pending payment
> 
> STRIKE
> └─ CFO is traveling? Perfect.
> └─ "Urgent wire needed for confidential acquisition"
> └─ "Don't discuss until announced"
> 
> CASH OUT
> └─ Mule accounts → crypto → gone in hours
> 
> ```
> 
> **Real example:** Orion (Luxembourg chemical company) lost **$60 million** in August 2024. One employee. Fraudulent wire instructions. That’s it.

* * *

## 📱 SIM Swap: Your Phone Number Is a Liability

FBI IC3: **$68 million** stolen in 2021 alone. 5x the previous three years combined.

Jack Dorsey got SIM swapped. The SEC’s Twitter account got SIM swapped. You’re not special.

FBI PSA: [ic3.gov/PSA/2022/PSA220208](https://www.ic3.gov/PSA/2022/PSA220208)

> **📞 How It Works**
>
> ```auto
> 1. OSINT the target (social media = security question answers)
> 2. Call carrier: "Lost my phone, need new SIM"
> 3. Pass verification with gathered PII
> 4. OR: Pay carrier insider ($500-$5,000 per swap)
> 5. Victim's phone dies. Attacker gets all SMS.
> 6. Trigger password resets. Intercept 2FA codes.
> 7. Drain everything.
> 
> ```
> 
> **The insider problem is real.** Threat actors openly discuss having contacts at every major US/Canada carrier. This isn’t speculation — it’s in their negotiations.
> 
> Deep dive: [Group-IB SIM Swap Research](https://www.group-ib.com/resources/knowledge-hub/sim-swap/)

* * *

## 🎤 Voice Cloning: 5 Seconds Is All They Need

The Arup deepfake video call cost **$25-39 million**. CFO + colleagues. All fake. All AI.

> **🔊 The Open-Source Pipeline**
>
> | Tool | Audio Needed | Quality | Link |
> | --- | --- | --- | --- |
> | **Chatterbox** | 5-10 sec | Beats ElevenLabs in blind tests | [GitHub](https://github.com/resemble-ai/chatterbox) |
> | **GPT-SoVITS** | 5 sec | Excellent with fine-tuning | [GitHub](https://github.com/RVC-Boss/GPT-SoVITS) |
> | **Tortoise TTS** | 3 min | Highest fidelity, slow | [GitHub](https://github.com/neonbjb/tortoise-tts) |
> | **RVC** | Variable | Enhancement layer | [GitHub](https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI) |
> | **XTTS v2** | 6 sec | 16 languages | [Coqui AI](https://github.com/coqui-ai/TTS) |
> 
> **Where they get voice samples:**
> 
> - Earnings calls
> - YouTube interviews
> - Conference talks
> - Podcasts
> - That one LinkedIn video you posted
> 
> **Google’s own red team** cloned a client’s voice, called their employee, said “Hey boss, what’s up?” — employee downloaded the payload. Exercise complete.

* * *

## 🪪 Badge Cloning: Physical Access in 3 Seconds

Most corporate RFID systems are misconfigured. Legacy support enabled. Default keys unchanged.

> **🔧 The Hardware**
>
> | Device | Price | Use Case | Link |
> | --- | --- | --- | --- |
> | **Proxmark3 RDV4** | ~$400 | Everything. Gold standard. | [proxmark.com](https://proxmark.com/) |
> | **Flipper Zero** | ~$200 | Portable, user-friendly | [flipperzero.one](https://flipperzero.one/) |
> | **Chameleon Ultra** | ~$150 | Excellent emulation | [GitHub](https://github.com/RfidResearchGroup/ChameleonUltra) |
> 
> **Elevator proximity clone:**
> 
> 1. Stand close to target
> 2. Proxmark in bag, antenna facing them
> 3. 2-3 seconds. Done.
> 4. Clone to blank card
> 
> **The pretext:**
> 
> > “Hi, building security. We’re upgrading card readers this week — need to scan your badge to check compatibility. Takes one second.”
> 
> **iClass downgrade attack docs:** [github.com/RfidResearchGroup/proxmark3/blob/master/doc/hid\_downgrade.md](https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/hid_downgrade.md)
> 
> **Long-range gooseneck reader build:** [github.com/sh0ckSec/RFID-Gooseneck](https://github.com/sh0ckSec/RFID-Gooseneck)
> 
> **ESP-RFID-Tool:** [github.com/rfidtool/ESP-RFID-Tool](https://github.com/rfidtool/ESP-RFID-Tool)

* * *

## 📲 Smishing Infrastructure: 194,000 Domains and Counting

The Smishing Triad registered **194,000+ phishing domains** since January 2024.

29% active less than 2 days. 71% gone within a week. Registered in Hong Kong. Hosted on US cloud. Targeting 121+ countries.

Full report: [unit42.paloaltonetworks.com/global-smishing-campaign](https://unit42.paloaltonetworks.com/global-smishing-campaign/)

> **📡 The Supply Chain**
>
> | Role | Job |
> | --- | --- |
> | **Data Brokers** | Sell phone number lists |
> | **Domain Sellers** | Register disposable domains |
> | **Kit Developers** | Build phishing pages + dashboards |
> | **SMS Spammers** | Bulk delivery via SIM boxes |
> | **Blocklist Scanners** | Rotate domains before they’re flagged |
> 
> **Underground service: Oak Tel / Carrie SMS**
> 
> - Supports spoofing major US bank Sender IDs (Chase, BofA, Wells Fargo)
> - ~$8 per 1,000 messages
> - Operated via Telegram
> 
> Resecurity analysis: [resecurity.com/blog/article/smishing-triad-is-now-targeting-toll-payment-services](https://www.resecurity.com/blog/article/smishing-triad-is-now-targeting-toll-payment-services-in-a-massive-fraud-campaign-expansion)

* * *

## 🏪 Initial Access Brokers: The Ransomware Supply Chain

IABs break into networks and sell access to ransomware crews. It’s eBay for corporate backdoors.

> **💰 The Market**
>
> **Pricing (2023-2024):**
> 
> | Access Type | Price Range |
> | --- | --- |
> | RDP | $500-$5,000 |
> | VPN | $1,000-$10,000 |
> | Domain Admin | $10,000-$50,000+ |
> 
> **Where:** Exploit, XSS, RAMP forums
> 
> **The pipeline:**
> 
> ```auto
> IAB gains access → Lists on forum → RaaS affiliate buys → Ransomware deployed → Payment split (70-80% affiliate / 20-30% RaaS)
> 
> ```
> 
> 36% of listings target US companies. Finance and retail get hit hardest.
> 
> Deep dives:
> 
> - [KELA: The Secret Life of an Initial Access Broker](https://www.kelacyber.com/blog/the-secret-life-of-an-initial-access-broker/)
> - [Flare: IAB Report](https://flare.io/learn/resources/initial-access-brokers-russian-hacking-forums-the-underground-corporate-access-economy/)
> - [Cyberint: IAB Trends & Statistics](https://cyberint.com/blog/research/a-deep-dive-into-initial-access-brokers-trends-statistics-tactics-and-more/)

* * *

## 🧠 Psychological Manipulation: Beyond Cialdini

Everyone knows the 6 principles. Here’s what actually gets exploited in phishing:

> **🎯 The 10 Cognitive Biases That Work**
>
> | Bias | How It’s Weaponized |
> | --- | --- |
> | **Curiosity** | “Your package has arrived” |
> | **Authority** | Impersonate IT, executives, legal |
> | **Urgency** | “24 hours to respond” |
> | **Negativity** | Threats, warnings, fear |
> | **Conformity** | “Your colleagues already completed this” |
> | **Zero-Risk** | “Verify now to protect your account” |
> 
> **The 4-Stage Hijack:**
> 
> 1. **Attention Capture** → Urgency + curiosity → System 1 engaged
> 2. **Trust Construction** → Logos, titles, familiar domains
> 3. **Critical Bypass** → Emotion overrides analysis
> 4. **Action** → Click before thinking
> 
> Academic source: [Cognitive Biases in Phishing Emails (PDF)](https://www.techscience.com/cmc/online/detail/24390/pdf)

* * *

## 🛠 The Toolchain

> **⚔️ Phishing Stack**
>
> | Tool | Purpose | Link |
> | --- | --- | --- |
> | **Evilginx3** | Reverse proxy, captures session cookies, bypasses MFA | [github.com/kgretzky/evilginx2](https://github.com/kgretzky/evilginx2) |
> | **Gophish** | Campaign management + tracking | [getgophish.com](https://getgophish.com/) |
> | **evilgophish** | Evilginx + Gophish combined | [github.com/fin3ss3g0d/evilgophish](https://github.com/fin3ss3g0d/evilgophish) |
> | **Modlishka** | Alternative reverse proxy | [github.com/drk1wi/Modlishka](https://github.com/drk1wi/Modlishka) |
> | **Muraena** | Transparent reverse proxy | [github.com/muraena/muraena](https://github.com/muraena/muraena) |
> | **SET** | Social-Engineer Toolkit | [github.com/trustedsec/social-engineer-toolkit](https://github.com/trustedsec/social-engineer-toolkit) |
> | **Zphisher** | Quick phishing site generation | [github.com/htr-tech/zphisher](https://github.com/htr-tech/zphisher) |
> | **SocialFish** | Mobile-friendly phishing | [github.com/UndeadSec/SocialFish](https://github.com/UndeadSec/SocialFish) |
> 
> **Phishlets:** [github.com/An0nUD4Y/Evilginx2-Phishlets](https://github.com/An0nUD4Y/Evilginx2-Phishlets)
> 
> **Pretext templates:** [github.com/L4bF0x/PhishingPretexts](https://github.com/L4bF0x/PhishingPretexts)

> **🔍 OSINT Stack**
>
> | Tool | Use | Link |
> | --- | --- | --- |
> | **SpiderFoot** | 200+ modules, automated recon | [github.com/smicallef/spiderfoot](https://github.com/smicallef/spiderfoot) |
> | **Maltego** | Graph-based link analysis | [maltego.com](https://www.maltego.com/) |
> | **Sherlock** | Username across 300+ sites | [github.com/sherlock-project/sherlock](https://github.com/sherlock-project/sherlock) |
> | **theHarvester** | Email/subdomain enumeration | [github.com/laramies/theHarvester](https://github.com/laramies/theHarvester) |
> | **Recon-ng** | Modular framework | [github.com/lanmaster53/recon-ng](https://github.com/lanmaster53/recon-ng) |
> | **GHunt** | Google account intel | [github.com/mxrch/GHunt](https://github.com/mxrch/GHunt) |
> | **Holehe** | Email-to-account matching | [github.com/megadose/holehe](https://github.com/megadose/holehe) |
> 
> **Google dorks that work:**
> 
> ```auto
> site:target.com filetype:pdf
> "target company" filetype:xls "password"
> site:linkedin.com "target company" "IT manager"
> site:target.com ext:sql | ext:bak | ext:log
> 
> ```

> **📞 VoIP/Caller ID Spoofing**
>
> **DIY setup:**
> 
> 1. Install Asterisk on VPS
> 2. Register with VoIP provider (Skyetel, Telnyx)
> 3. Get DID (~$0.50/month)
> 4. Configure custom Caller ID in dialplan
> 5. Spoof away
> 
> **Tools:**
> 
> - Viproy (Metasploit VoIP toolkit)
> - inviteflood (Kali Linux)
> - [SIPVicious](https://github.com/EnableSecurity/sipvicious)
> 
> **Guides:**
> 
> - [Rapid7: CID Spoofing with Asterisk](https://www.rapid7.com/blog/post/2018/05/16/social-engineering-vishing-with-open-source-tools-part-1/)
> - [StackTitan: CID Spoofing](https://rift.stacktitan.com/cid-spoofing/)
> 
> Spoofing itself isn’t illegal (US). Misrepresenting identity for fraud is.

* * *

## 📚 FBI Elicitation Techniques

The 20 techniques. The ones that actually matter:

| Technique | How It Works |
| --- | --- |
| **Assumed Knowledge** | Pretend you already know; they fill gaps |
| **Deliberate False Statement** | Say something wrong; they correct you |
| **Flattery** | Compliment expertise; they elaborate |
| **Silence** | Let the uncomfortable pause do the work |
| **Bracketing** | Estimate high/low; they correct to real number |
| **Quid Pro Quo** | Share first; reciprocity triggers |

**Chain them:** Flattery → Assumed Knowledge → Silence → Feigned Ignorance

Vishing best practices: [social-engineer.org](https://www.social-engineer.org/)

* * *

## 🎪 DEF CON SECTF

Since DEF CON 18. Contestants vish real Fortune 500 companies from a soundproof booth. Live audience watches.

**Flags:** OS versions, browser types, VPN vendors, org charts, cafeteria vendor names.

**Winner gets:** Black badge (lifetime DEF CON entry).

**Communities:**

- se.community (SECVC Discord)
- BREAKDEV Discord (Evilginx)

**SE Village:** [sevillage.org](https://www.sevillage.org/)

* * *

## 📦 Red Team Resource Repos

| Repository | Content |
| --- | --- |
| **Red-Teaming-Toolkit** | Comprehensive tool list |
| **Awesome-Red-Teaming** | Books, courses, resources |
| **red-team-scripts** | Scripts and automation |
| **awesome-phishing** | Phishing-specific collection |
| **Awesome-Cybersecurity-Handbooks** | Cheatsheets |

* * *

## 📖 Glossary

| Term | Meaning |
| --- | --- |
| **PhaaS** | Phishing-as-a-Service |
| **IAB** | Initial Access Broker |
| **MFA Fatigue** | Push bomb until they accept |
| **Phishlet** | Evilginx config file |
| **Stealer Logs** | Creds from infostealer malware |
| **Blitz Price** | Buy-now price vs auction |
| **VEC** | Vendor Email Compromise |
| **PACS** | Physical Access Control System |
| **SID** | Sender ID (SMS spoofing) |

* * *

## 📎 Sources

- [CISA AA23-320A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a) (Scattered Spider)
- [Microsoft Octo Tempest Analysis](https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/)
- [Palo Alto Unit42 Smishing Triad](https://unit42.paloaltonetworks.com/global-smishing-campaign/)
- [FBI IC3 Reports](https://www.ic3.gov/)
- [KELA IAB Research](https://www.kelacyber.com/)
- [Flare Threat Intelligence](https://flare.io/)
- [Resecurity](https://www.resecurity.com/)
- [Verizon DBIR](https://www.verizon.com/business/resources/reports/dbir/)
- [Proxmark3 Docs](https://github.com/RfidResearchGroup/proxmark3)

* * *

⚠ **For authorized security testing only.** Social engineering without explicit authorization is illegal. Know your laws. Get permission. Document everything.

* * *