Trick Or Phish? How To Spot The Real Monsters Lurking This Halloween

While ghouls and goblins creep around the streets this Halloween, the scariest threats aren’t hiding under your bed or lurking in haunted houses, they’re creeping in your inbox. Forget your classic zombies, devils and vampires. This October, it’s deepfakes, ransomware and phishing emails that are haunting every corner of your organisation.

Imagine getting a video message that looks and sounds exactly like your CEO, urgently asking you to send sensitive documents. Only to realise, too late, that you just handed over confidential data to a cybercriminal. That’s not just spooky, it’s real. And it’s happening more often than you think.

Cybercriminals are tapping into a whole new level of social engineering sophistication. And the scariest bit is, today’s attacks don’t need malware to cause damage. They just need one careless click, a second of trust and one distracted employee.

It’s time to pull back the mask and confront them, but more importantly, let’s talk about how to fight back.

Meet The Cyber Villains

Cybercriminals don’t just exploit technology. They manipulate human behaviour, emotions and everyday habits to slip past even the strongest defences. That’s why social engineering remains one of the most dangerous and effective forms of cyberattack.

So, who’s behind the mask? Introducing the 4 ‘Arcade Villains’: Dr. Deepfake, Cyberpunks, Enkryptor and The Doppelgänger. Each representing the scariest social engineering threats haunting businesses today.

Dr. Deepfake

The face and voice of synthetic deception. This villain symbolises the rise of Ai-powered impersonation, where cybercriminals use generative Ai to convincingly mimic real people, from CEOs to colleagues and even family members.

They turn trust into a liability. With the proportion of organisations reporting deepfake incidents jumping from 10 per cent to 50 per cent (Wall Street Journal), we can no longer assume a video call is legitimate just because the face matches or rely on voice alone to confirm identity. With trust exploited, being skeptical is key.

Cyberpunks

They’re your classic cyber tricksters that rely on phishing emails, fake voice calls and scams delivered via social media, WhatsApp, Telegram or even SMS. Their cons work because they know how to push the right buttons: trust, fear and urgency.

Even seasoned professionals can fall for a well-timed phish. That’s why technical defences aren’t enough anymore. The real front line of cybersecurity must be built on human behaviour.

Enkryptor

Think of them as the embodiment of ransomware-as-a-service. This villain doesn’t just lock up files – he steals them too, then threatens to leak them unless a ransom is paid.

Don’t think your organisation is too small to be targeted, no one is immune. If you have an email address, you can be targeted. If you or your employees have an email address, you can easily end up on a list of places to attack. It could be a vendor that you use that gets breached, leaking your information, an email address published on your website, or any number of other ways your contact information ends up in the public domain. Whatever the reason, you can easily become a target. And while backup and recovery tools have improved, the fear of having private data exposed publicly keeps ransom demands high.

Doppelganger

Just like the name suggests, Doppelganger is a master impersonator. This villain uses domain spoofing, fake login portals and cloned websites to mimic trusted sources. Employees are tricked into entering passwords, authorising payments or clicking malware links – all under the illusion of legitimacy.

Doppelganger thrives on confusion. Their strength is in looking familiar enough to go unquestioned.

Cyber Tips Not Tricks

From Ai-generated deepfakes to phishing phantoms lurking in inboxes, social engineers are out to play trick-or-treat with your trust. And the best defence isn’t just technology – it’s people. It’s time to unmask the tricks and train your team to spot the threats hiding in plain sight.

Fight back by summoning a bit of skepticism. Teach your team to pause before they click, question what seems urgent and verify anything that feels “off.” A voice message that sounds anxious, a perfectly timed video call, or a strange executive request – any of these could be a digital disguise. So, make it a habit to always verify through secondary channels.

Secondly, a reminder that training is your silver bullet. One-and-done sessions don’t cut it anymore. Employees need bite-sized, engaging and frequent training that evolves with the threat landscape. Think simulated phishing attacks, real-time coaching and personalised learning to help reinforce the right behaviours before a real attack hits.

And lastly, don’t forget that the bravest teams always speak up. When something feels eerie, employees should feel safe to sound the alarms. Foster a culture of awareness that empowers every user to become vigilant defenders on the digital frontline. Because when anyone’s face or voice can be faked, your best defence is a well-trained, critically thinking team.

Erich Kron is Security Awareness Advocate at KnowBe4.

Last Updated on October 30, 2025 by Erich Kron