2f:I[59321,["$18","$19","$1a","$29"],"BlogCard"] 31:I[27201,["$2"],"IconMark"] 30:T2d88,

Imagine: it's morning and you're at work.

You open your email and see a message:

“Urgent: please approve the latest payment”

The sender is your company's director.

An invoice is attached.

The text looks normal.

The name is right.

The company name is right.

There's even something that looks like your director's signature.

You open the file.

A few minutes later it may already be too late.

But the most interesting question is this:

How did the attacker know to send that email to you in particular?

They didn't pick you at random.

Attackers start with information, not passwords

One of the most important stages of a cyberattack often isn't the “hack” itself.

It's gathering information.

This is called OSINT — Open-Source Intelligence: collecting and analysing information from public sources.

An attacker can study everything a company and its employees have published online.

And the problem is that in many cases nothing secret is needed at all.

LinkedIn may already be enough

Say the attacker finds the company's LinkedIn page.

A few minutes later they can already work out:

who the director is,
who the accountant is,
who the sales manager is,
who handles HR,
who the IT specialist is,
who the new employees are.

For example:

Anna — Accountant

Davit — Sales Manager

Karen — IT Specialist

Aram — CEO

Now the attacker has a small “org chart” of the company.

And the next question becomes:

who is the easiest target?

Different bait for different people

If the attacker has chosen the accountant, there's no point sending them a “new client enquiry”.

This would be more convincing:

“Hi Anna, please find attached this month's invoice for payment. Could you check and approve it?”

For the sales manager it might be:

“The new client's contract is attached. Please review it by the end of the day.”

And the manager might get:

“This document needs your approval urgently.”

In other words, the attacker isn't just sending a phishing email.

They're trying to build a story that fits the context of your job.

That's the power of social engineering.

And how do they know the email address?

This is where the next layer begins.

A company website may publish:

info@company.am

hr@company.am

sales@company.am

or employees' contact details.

Other sources can then reveal the company's email format.

For example:

name.surname@company.am

If you already know someone's first and last name, that format can be very useful for targeting.

On top of that, email addresses sometimes appear in public datasets or in past data breaches.

So the attacker can end up knowing not only that

“Anna works at this company”,

but also that

“this is Anna's email”.

People often think:

“I don't post anything secret.”

But information doesn't have to be secret to be useful.

For example, an employee posts on Instagram or Facebook:

“Finally, holidays 😎✈️”

To an attacker, that may mean the person will be unreachable for a while.

Someone else writes:

“First day at my new job today.”

Now the attacker knows there's a new employee at the company.

A new employee may not yet know the internal procedures, the systems in use or the security rules.

And that can become an extra risk.

But OSINT isn't only about people

Attackers are also interested in a company's technical environment.

For example, which subdomains the company has:

crm.company.am

mail.company.am

vpn.company.am

dev.company.am

Or which services it uses.

They may also be interested in:

public IP addresses,
DNS records,
exposed services,
the technologies in use,
public repositories,
published documents,
metadata,
past data breaches.

Put together, all this information can paint a fairly detailed picture of the company.

Say the attacker already knows:

Aram — CEO

Anna — Accountant

Davit — Sales

CRM — used by the sales team

Email — used across the company

Now they can create not generic phishing but a specific scenario.

For example:

Anna,
please check this invoice and approve the payment.
Aram

Even if the email isn't really from Aram, Anna may not suspect a thing.

Because the attacker isn't just trying to fool her.

They're trying to become part of her working environment.

What if the employee doesn't click the link?

Then the attacker may try another route.

For example, sending a page that looks like a login page.

The employee sees:

Microsoft 365 Login

Company CRM Login

They enter their email and password.

And that's it.

Those credentials may now be in the attacker's hands.

What can follow are attempts at account takeover, data access or getting into internal systems.

So what does the CRM have to do with it?

In many businesses a CRM isn't just “a list of clients”.

It can contain:

client names,
phone numbers,
email addresses,
addresses,
orders,
contracts,
payment details,
employee actions,
internal notes.

In other words, a CRM can become one of the company's most important information systems.

So the question isn't only:

“Can the CRM be hacked?”

The more important question is:

“If someone gets hold of an employee's account, what can they do with it?”

That's why access control matters

For example, a salesperson doesn't need the same access as an administrator.

If an employee only needs to work with clients, they shouldn't be able to:

change every system setting,
create users,
export the entire database,
delete important data.

This is called the principle of least privilege.

Every user should have exactly as many rights as their job requires.

No more.

And what if someone changes the data?

This is where an audit log comes in.

For example:

09:41 — Anna — changed a client's phone number

10:03 — Davit — changed an order's status

10:17 — Admin — created a new user

Records like these let you see not only what happened, but also who did it and when.

That matters for security and for keeping ordinary business processes under control.

And then an employee leaves

This is another very often forgotten topic.

An employee leaves the company.

But their account stays active.

They may still have access to:

the CRM,
email,
cloud storage,
the VPN,
internal systems.

From a security point of view, that's a serious problem.

Employee onboarding and offboarding must be controlled processes too.

So what does the attacker see?

You might see:

LinkedIn → job posting → website → CRM

while the attacker sees:

people → roles → email addresses → systems → access → potential targets

And they can use that information to craft one very convincing phishing message.

What a business can do

There's no need to wait until someone clicks a phishing link.

You can start with very simple steps:

A separate account for every employee
Limited administrator rights
MFA on every important system where possible
Regularly review user permissions
Disable a departing employee's account immediately
Audit logging
Backups
Phishing awareness training for staff
Don't publish unnecessary internal information
Regularly check what information about the company is available online

The most dangerous vulnerability sometimes isn't software

In cybersecurity we often think:

“We need to protect the server.”

Yes.

The server needs protecting.

But so do people.

Because an attacker may not try to break into the server at all.

They may simply try to convince one employee that they're the director.

And if that works, it can open a way around some of your technical defences.

Sometimes an attacker doesn't need to break into your system.

It's enough to get you to open the door yourself.

TM Hub × Cybersecurity

In a modern business, a CRM isn't just a sales management tool.

It's also where important business information is gathered and processed.

That's why, when choosing a CRM, you should think not only about features but also about:

Who has access?

Who can change data?

Who can delete it?

Who can see it?

What does the system record?

What happens if an employee's account is compromised?

Cybersecurity isn't a separate “IT topic”.

It's part of a business's everyday processes.

Because data has value. And everything of value needs protecting.

c:[["$","section",null,{"className":"phero","children":["$","div",null,{"className":"container","children":["$L2e",["$","div",null,{"className":"row","style":{"gap":32,"alignItems":"center"},"children":[["$","span",null,{"className":"avatar avatar--xl avatar--alt avatar--img","style":"$undefined","aria-hidden":"true","children":["$","img",null,{"src":"https://api.tmhub.am/media/blog/authors/photo_2026-03-16_18-52-30_2.jpg","alt":"","loading":"lazy"}]}],["$","div",null,{"children":[["$","h1",null,{"children":"Cybersecurity_am Տելեգրամյան ալիք"}],["$","p",null,{"className":"t-lead","style":{"color":"var(--c-brand)","fontWeight":700,"marginTop":6},"children":"Գործընկեր"}],""]}]]}]]}]}],["$","section",null,{"className":"section","children":["$","div",null,{"className":"container","children":[["$","h2",null,{"className":"t-h3","style":{"marginBottom":24},"children":"Articles"}],["$","div",null,{"className":"grid grid-3","children":[["$","$L2f","osint-social-engineering-phishing",{"post":{"slug":"osint-social-engineering-phishing","cat":"","a":"cybersecurity-am-telegramyan-alik","date":"2026-09-24","updated":"2026-11-03","min":7,"pop":0,"t":"So how does an attacker know who to trick?","d":"Attackers often start not with a password but with information: LinkedIn, the company website, social media. How OSINT turns into a convincing phishing email, and how to protect yourself.","tags":[],"cover":"https://api.tmhub.am/media/blog/covers/Screenshot_2026-09-24_041327.jpg","body":"$30","toc":[{"id":"attackers-start-with-information-not-passwords","text":"Attackers start with information, not passwords","level":2},{"id":"linkedin-may-already-be-enough","text":"LinkedIn may already be enough","level":2},{"id":"different-bait-for-different-people","text":"Different bait for different people","level":2},{"id":"and-how-do-they-know-the-email-address","text":"And how do they know the email address?","level":2},{"id":"social-media-is-a-source-of-information-too","text":"Social media is a source of information too","level":2},{"id":"but-osint-isn-t-only-about-people","text":"But OSINT isn't only about people","level":2},{"id":"and-this-is-where-real-social-engineering-begins","text":"And this is where real social engineering begins","level":2},{"id":"what-if-the-employee-doesn-t-click-the-link","text":"What if the employee doesn't click the link?","level":2},{"id":"so-what-does-the-crm-have-to-do-with-it","text":"So what does the CRM have to do with it?","level":2},{"id":"that-s-why-access-control-matters","text":"That's why access control matters","level":2},{"id":"and-what-if-someone-changes-the-data","text":"And what if someone changes the data?","level":2},{"id":"and-then-an-employee-leaves","text":"And then an employee leaves","level":2},{"id":"so-what-does-the-attacker-see","text":"So what does the attacker see?","level":2},{"id":"what-a-business-can-do","text":"What a business can do","level":2},{"id":"the-most-dangerous-vulnerability-sometimes-isn-t-software","text":"The most dangerous vulnerability sometimes isn't software","level":2},{"id":"tm-hub-cybersecurity","text":"TM Hub × Cybersecurity","level":3}],"faq":[],"metaTitle":"How an attacker knows who to trick: OSINT and phishing | TM Hub","metaDescription":"How attackers gather information from LinkedIn, websites and social media (OSINT), pick a target and craft a convincing phishing email — and what a business can do about it.","lang":"en","translations":[{"language":"ru","slug":"osint-socialnaya-inzheneriya-fishing"},{"language":"hy","slug":"osint-social-engineering-phishing"}],"allowComments":true,"ctaTitle":"See how staff access is managed in TM Hub"},"author":{"id":"cybersecurity-am-telegramyan-alik","name":"Cybersecurity_am Տելեգրամյան ալիք","role":"Գործընկեր","bio":"","avatar":"https://api.tmhub.am/media/blog/authors/photo_2026-03-16_18-52-30_2.jpg","n":1,"cls":"avatar--alt"},"index":16}]]}]]}]}]] e:null 15:[["$","title","0",{"children":"Cybersecurity_am Տելեգրամյան ալիք — TM Hub blog"}],["$","meta","1",{"name":"description","content":"Գործընկեր Articles in the TM Hub blog on business automation, CRM and management."}],["$","meta","2",{"name":"application-name","content":"TM Hub"}],["$","link","3",{"rel":"canonical","href":"https://tmhub.am/en/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","link","4",{"rel":"alternate","hrefLang":"hy","href":"https://tmhub.am/hy/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","link","5",{"rel":"alternate","hrefLang":"en","href":"https://tmhub.am/en/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","link","6",{"rel":"alternate","hrefLang":"ru","href":"https://tmhub.am/ru/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","link","7",{"rel":"alternate","hrefLang":"x-default","href":"https://tmhub.am/hy/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","meta","8",{"property":"og:title","content":"Cybersecurity_am Տելեգրամյան ալիք — TM Hub blog"}],["$","meta","9",{"property":"og:description","content":"Գործընկեր Articles in the TM Hub blog on business automation, CRM and management."}],["$","meta","10",{"property":"og:url","content":"https://tmhub.am/en/blog/authors/cybersecurity-am-telegramyan-alik"}],["$","meta","11",{"property":"og:site_name","content":"TM Hub"}],["$","meta","12",{"property":"og:locale","content":"en_US"}],["$","meta","13",{"property":"og:image","content":"https://tmhub.am/assets/brand/logo.png"}],["$","meta","14",{"property":"og:type","content":"website"}],["$","meta","15",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","16",{"name":"twitter:title","content":"Cybersecurity_am Տելեգրամյան ալիք — TM Hub blog"}],["$","meta","17",{"name":"twitter:description","content":"Գործընկեր Articles in the TM Hub blog on business automation, CRM and management."}],["$","meta","18",{"name":"twitter:image","content":"https://tmhub.am/assets/brand/logo.png"}],["$","link","19",{"rel":"icon","href":"/icon.png?icon.3hokdqtdg7cgw.png","sizes":"500x500","type":"image/png"}],["$","$L31","20",{}]] 16:null