DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers

arXiv:2402.18401v1 Announce Type: cross
Abstract: The Software Supply Chain (SSC) has captured considerable attention from attackers seeking to infiltrate systems and undermine organizations. There is evidence indicating that adversaries utilize Social Engineering (SocE) techniques specifically aimed at software developers. That is, they interact with developers at critical steps in the Software Development Life Cycle (SDLC), such as accessing Github repositories, incorporating code dependencies, and obtaining approval for Pull Requests (PR) to introduce malicious code. This paper aims to comprehensively explore …

adversaries arxiv attackers attacks attention critical cs.cr cs.se developers engineering organizations social social engineering software software developers software supply chain software supply chain attacks supply supply chain supply chain attacks systems techniques