My Boss is Really Cool: Malware-Induced Misperception in Workplace Communication Through Covert Linguistic Manipulation of Emails
Filipo Sharevski, Peter Jachim, Paige Treebridge, Audrey Li, Adam Babin · 2020
This paper introduces a social engineering attack called Malware-Induced Misperception (MIM). Social engineering attacks are usually carried over emails and "phish" for the receiver's assets, e.g. passwords. The MIM also uses email as an attack vector but instead "phishes" for the receiver's perception. Since email is one of the main lines of communication in a workplace, individuals are trained how to spot traditional phishing but not emails aiming to induce misperception. A study was conducted to test the effect of the MIM attack in covertly manipulating the perception of the individual's working relationship in a realistic workplace email interaction (N = 173). The misperception-inducing malware was packaged as a browser extension that manipulated the "politeness" formatting of an email request through covert linguistic rearrangements. The results indicate that the attack is capable of creating misperceptions that: (1) an email request seems more demanding than it actually is; and (2) the sender seems more polite and "cool" than they actually are. The results also show that the attack nudges the receivers to match the level of politeness in their response to the one in the email request. The overall findings are consistent with the politeness theory applied in computer-mediated communication settings.