Which attack involves attackers posing as technical support and requesting credentials in exchange for a service?

Which attack involves attackers posing as technical support and requesting credentials in exchange for a service?

• A. Quid Pro Quo
• B. Elicitation
• C. Pop-Up Windows
• D. Whaling attack

Answer: (A)

Quid Pro Quo is a social engineering tactic where the attacker promises or offers something of value in exchange for information or access. In this scenario, the attacker pretends to be technical support and says a service or help will be provided only if the target reveals their credentials. The lure of getting a service makes the target more likely to hand over usernames and passwords, exploiting trust and the sense of a beneficial exchange. This differs from elicitation, which is just coaxing information through questions without promising a concrete trade; from pop-up windows, which rely on deceiving the user into clicking or entering data through a fake UI; and from whaling, which is targeted phishing aimed at high-value individuals. To defend, verify identities through official channels, never share credentials for supposed services, and use multifactor authentication along with security awareness training.

Quid Pro Quo is a social engineering tactic where the attacker promises or offers something of value in exchange for information or access. In this scenario, the attacker pretends to be technical support and says a service or help will be provided only if the target reveals their credentials. The lure of getting a service makes the target more likely to hand over usernames and passwords, exploiting trust and the sense of a beneficial exchange.

This differs from elicitation, which is just coaxing information through questions without promising a concrete trade; from pop-up windows, which rely on deceiving the user into clicking or entering data through a fake UI; and from whaling, which is targeted phishing aimed at high-value individuals. To defend, verify identities through official channels, never share credentials for supposed services, and use multifactor authentication along with security awareness training.