S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T14.21
CATEGORY Social Engineering
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Trust Exploitation

Human Vector · Transitive-Trust Abuse · Moderate but Growing
High Alert
How It WorksSEC 01

Trust exploitation abuses an already-established trusted relationship, identity, or system — a vendor, partner, service provider, colleague, or trusted software channel — to gain access, funds, or data that the target’s own defenses would have blocked from an unknown source. Most security models spend their strength at the perimeter, scrutinizing the stranger. This defeats that by coming from inside the circle of trust: the attacker inherits the credibility of a party the target already trusts, so requests are honored and updates are installed precisely because the source is “known good.”

The mechanism is transitive trust: A trusts B, B is compromised or impersonated, and the attacker rides B’s trust to reach A. It appears at several altitudes. At the human level, a message from a known colleague, vendor contact, or long-standing partner is granted latitude an outsider never would be. At the organizational level, a trusted supplier, managed-service provider, or contractor becomes the conduit — sometimes “island hopping”: breach the smaller, less-defended partner to reach the larger target. At the technical level, the trusted software-update channel is abused so malicious code arrives through a legitimate, signed distribution mechanism.

What makes it so dangerous is that normal detection is inverted: the very signals used to grant trust — a known sender, a signed update, an established account — are the signals the attack rides in on. Defense cannot rest on “is this source known?” but must shift to “is this request verified — even from a known source?”

Warning SignsSEC 02
  • Anomalous request from a trusted source. A known vendor, partner, or colleague asks for something outside the normal pattern — unusual timing, amount, phrasing, access level, or channel.
  • Sudden escalation from a trusted account. A familiar account requesting credential resets, elevated access, or fund/data movement it never asked for before.
  • Trusted artifact behaving unexpectedly. Software or data from a trusted channel making unusual network calls or reaching data it never needed.
  • Relationship pressure to skip checks. "You know us, just do it" — leaning on familiarity to discourage verification.
  • Trust doing the work evidence can't. The only reason a request is being honored is that the source is familiar.
  • The key inversion. Treat "it's from someone we trust" as a reason to verify the request, not to skip verification.
Frequently Paired WithSEC 03
  • Business Email Compromise · T14.10
    Highest-value human-scale trust-transfer attack
  • Fake Invoices · T14.12
    Abuses established vendor trust
  • Phishing · T14.3
    Often the initial compromise of the trusted party
  • Fake Recruiters · T14.13
    Borrows trusted-brand credibility
How the Attack UnfoldsSEC 04
  • Stage 01 · Trusted Source
    A request, update, or access path appears to come from a known colleague, vendor, partner, or signed channel.
  • Stage 02 · Inherited Credibility
    Because the source is familiar, the request is granted latitude a stranger never would get — "we always work with them."
  • Stage 03 · Ride-In
    The attacker rides that trust to reach the target — funds move, access is granted, or malicious code installs through the trusted channel.
Counter-ProtocolSEC 05
Defense: Verify the request, not just the source — trust is a reason to check, not to skip checking.
  • Adopt zero-trust principles. Never grant implicit trust from network location, prior relationship, or a "known" identity; verify explicitly for every sensitive request (NIST SP 800-207).
  • Verify anomalous requests out-of-band. Confirm on a known channel before honoring an unusual request — even from a trusted party (the same callback discipline that stops BEC).
  • Segment and limit third-party access. Treat a partner's compromise as part of your risk surface; monitor it and require vendor security assurance.
  • Baseline and detect anomalies. Model normal behavior of trusted accounts and channels so deviations surface; enforce MFA and strong identity everywhere, including partners.
  • Change the culture. Replace "we trust them, so we don't check" with "we trust them, and we verify anomalous requests."