![](https://pbs.twimg.com/media/EHylsbXU4AI8CEy.jpg)
You gather everything you can about the org, identify the best target based on ROI (highest reward + lowest risk of detection), then craft a story to approach them.
- @ChristinaLekati
![](https://pbs.twimg.com/media/EHymYbtW4AA0sYC.jpg)
They first tried PupyRAT via phishing, but that didn’t work. So they created the fake person Mia Ash to establish relationships with targets (yes Mia was pretty hot)
![](https://pbs.twimg.com/media/EHyoReyX4AASgKP.jpg)
— @ChristinaLekati
For any future attackers: my personal brand is fluffy kittens, unlimited crispy bacon, resting bitch face & intellectualism as a coping mechanism
![](https://pbs.twimg.com/media/EHypI1mWoAATRpQ.jpg)
#Hacktivity2019
![](https://pbs.twimg.com/media/EHyp-jUXYAIZsAW.jpg)
We like people who are like us, so social engineers will present themselves like you.
— @ChristinaLekati #Hacktivity2019
![](https://pbs.twimg.com/media/EHyrQuCW4AAfSci.jpg)
![](https://pbs.twimg.com/media/EHyrRMjWsAA3f6b.jpg)
A great talk by @ChristinaLekati at #Hacktivity2019 !
![](https://pbs.twimg.com/media/EHyswZZXYAEtHiO.jpg)