Red team operations: OSINT for social engineering

Open Source Intelligence (OSINT) is the reconnaissance layer under most modern social engineering. Before a phishing email lands, before a vishing call goes out, before someone tailgates through a badge reader, somebody spent hours or days assembling context: names, roles, org chart, vendors, event schedules, tech stack. The better the OSINT, the more plausible the pretext.

This post is aimed at authorized red teamers and the blue teams they eventually brief. Understanding the attacker’s OSINT surface is a shared exercise: red team needs to know what to gather; blue team needs to know what an attacker will assemble regardless. Every example below is defender-relevant.

What OSINT is, briefly

#

OSINT is intelligence assembled from publicly available sources: news, government records, corporate filings, social media, code repositories, DNS records, certificate transparency logs, satellite imagery, breach data indexes. The discipline has been around since WWII (the Foreign Broadcast Monitoring Service, founded in 1941 and later renamed the Foreign Broadcast Information Service, is the usual reference point); the internet just made the source volume unmanageable in interesting ways.

SOCMINT (Social Media Intelligence) is the subcategory most relevant to social engineering. What people voluntarily post about themselves, their employers, and their environments is often the most productive attack surface a red team encounters.

Why this matters for a defender

#

Every piece of information an attacker can assemble about your organization is a piece of information they will use. The playbook has not changed in decades:

• A pretext (a fake identity or scenario) that matches something the target expects
• Enough specific detail to survive light scrutiny
• A call-to-action that the target has business reason to complete

Where 2026 differs from 2016 is scale. AI-assisted collection makes assembling per-target dossiers cheap. Deepfake voice and video makes vishing significantly more effective, as the Arup case in January 2024 demonstrated (about HK$200M, roughly US$25.6M, sent in fifteen transfers after a Hong Kong employee joined a video call where everyone else on screen, the CFO included, was a deepfake; Hong Kong police described the case in February 2024 without naming the company, the Financial Times identified Arup in May, and Arup confirmed it). Defensive posture that assumes “our people would catch a weird phone call” no longer holds without training that specifically covers AI-generated content.

Where the attacker looks

#

Employees on professional networks

#

LinkedIn is the reference source. Attacker perspective: employee list, org chart, roles, technology stacks (from job history and stated skills), recent hires (still learning who is who and less likely to challenge unusual requests), recent departures (email may still route). Defender perspective: an attacker will have this before they contact anyone.

On the legal side: LinkedIn’s terms prohibit scraping, and the platform has aggressive session-based bot detection. The hiQ Labs v. LinkedIn saga ended in a settlement stipulated on December 6, 2022 and approved two days later: hiQ won the Computer Fraud and Abuse Act question at the Ninth Circuit (scraping public data is likely not “unauthorized access”) but lost on breach of contract at the district court in November 2022, because scraping and the fake accounts used to do it violated LinkedIn’s User Agreement. hiQ took a $500K judgment, a permanent injunction against scraping LinkedIn, and an order to delete the data. “Public data is fair game” is not the settled principle a lot of OSINT tutorials still assume; hiQ won the CFAA question and lost the case. More recent example: LinkedIn v. Nubela, the company behind Proxycurl, filed January 24, 2025 in the Northern District of California. Proxycurl shut down on July 4, 2025. Attackers do not care about the terms; defenders and legitimate red teams need to.

Personal social media

#

X (formerly Twitter), Facebook, Instagram, TikTok, Bluesky, Mastodon. The API access story has changed:

• X: paid API only since 2023 and now on pay-per-use pricing as of 2026 ($0.005 per post read, $0.010 per user read, $0.015 per post created, with post reads capped at three million a month; legacy Basic subscribers have been auto-migrated since June 2026). Free scraping is heavily rate-limited. Nitter, which used to anonymize X access, shut down in February 2024 when X stopped issuing guest tokens, came back in February 2025 with instances that needed registered accounts, and then got cease-and-desist letters from X Corp in August 2026. As of this writing nitter.net is offline and the repository is archived. Do not build anything on it.
• Facebook / Instagram: Meta shut down CrowdTangle in August 2024, replacing it with the researcher-only Content Library. Public scraping is nontrivial.
• Bluesky: open firehose accessible via ATProto. Attractive for OSINT precisely because of the openness.
• Mastodon: federated, per-instance access varies. Many instances have public timeline APIs.
• TikTok: minimal researcher access, aggressive anti-scraping, one of the harder platforms to pull structured data from.
• Telegram: extremely permissive by comparison, public channel content trivially collectable.

What attackers extract: locations, schedules, personal interests, family members, recent events, professional gripes. A public complaint about a specific SaaS vendor is a gift; it names the vendor, confirms it is in use, and suggests the target has been dealing with it recently.

Search engines and dorking

#

Google dorking (site:example.com filetype:pdf, intext:"internal use only", inurl:admin) still works but is less productive than it was a decade ago. Google has aggressively de-ranked or removed a lot of accidental exposure. Alternatives:

• DuckDuckGo and Kagi for less-filtered results
• Bing (has its own indexing quirks that reveal different things)
• Yandex (frequently the best reverse image search, and indexes some content Western engines skip)
• searx / searxng for self-hosted metasearch

The single most productive Google dork for organizational OSINT is still site:company.com combined with specific filetypes or keywords, run periodically as a defender exercise to see what escaped.

Code repositories

#

GitHub, GitLab, Bitbucket, and internal-turned-public forks. Public repos accidentally contain credentials, internal hostnames, service architecture, and vendor names.

GitHub’s Secret Scanning partner program has existed since October 2018 (partner-notify model). Automated validity checking for AWS, Microsoft, Google, and Slack tokens landed in October 2023, and push protection has been on by default for public repositories since March 2024. Leaked credentials in public commits are much more likely to be dead, or never to have landed, than they were five years ago. It does not cover custom secret formats, hostnames, internal API URLs, or embedded documentation, all of which still show up regularly.

For defenders: run truffleHog, gitleaks, or GitHub’s own secret scanning against your public repos on a schedule. For OSINT investigation: github.com/search?q=<company>&type=commits is the entry point.

Certificate transparency

#

Every public TLS certificate issued by a CA that logs to Certificate Transparency (which is required for public trust) is publicly discoverable. Attacker use: enumerate every subdomain that has ever been given a cert, mapping the org’s actual attack surface including dev/staging/internal hosts that were never supposed to be public.

Tools: crt.sh (built and run by Rob Stradling at Sectigo) and Censys certificate search (free tier, credit-limited). subfinder (ProjectDiscovery) and amass (OWASP) both query CT logs among other sources.

Passive DNS and asset discovery

#

• crt.sh for CT-derived subdomain enumeration
• subfinder (ProjectDiscovery, the current dominant standard), amass, findomain for programmatic subdomain enumeration across CT + DNS + third-party APIs (sublist3r and assetfinder have both been untouched since 2020)
• SecurityTrails (Recorded Future since 2022), DomainTools (which bought Farsight and its DNSDB in 2021), VirusTotal (its own passive DNS, built from scan telemetry), and CIRCL Passive DNS (access restricted to trusted partners) for historical DNS resolution data
• Shodan and Censys for internet-exposed hosts, services, banners, and TLS fingerprints

Any of these will tell an attacker (or a defender) which of your hostnames resolves to what, which of your services expose what, and which of your certificates were issued to what.

WHOIS post-GDPR

#

Almost everything an attacker used to get from a raw WHOIS query is now redacted for individual registrants (GDPR since 2018, with follow-on privacy protections in most other jurisdictions). ICANN’s WHOIS sunset took effect on January 28, 2025: gTLD registries and registrars are no longer contractually required to answer on port 43, RDAP is the required protocol, and WHOIS stays up only where operators choose to keep it. Commercial WHOIS aggregators (WhoisXML API, DomainTools) still have historical data that predates the redaction. For current-domain investigation, the useful data is registrar, registration date, expiration, and nameservers, not registrant contact details.

Reverse image search and face recognition

#

• Google Images, TinEye, Yandex for classic reverse image search. Yandex remains startlingly effective, in ways that make privacy-conscious researchers uncomfortable.
• PimEyes and FaceCheck.id for face-based reverse search. Both are consumer-accessible and both have serious downstream implications for anyone whose face is on the internet.
• Clearview AI, which under its 2022 ACLU settlement is limited to government agencies in the US; not accessible to red teams under normal engagement scopes.

Face recognition is the OSINT capability that has changed most in the last five years. An attacker who can put a name to a face from a conference photo, or find every public appearance of a specific person, has significantly more pretexting material than they used to.

Physical reconnaissance

#

• Google Maps, Bing Maps for street view and satellite imagery
• OpenStreetMap for building layouts, entrances, road access
• Zillow and equivalents for interior layouts of homes
• Trip Advisor, Yelp, Google Reviews for nearby cafes, restaurants, hotels used by employees

For a physical assessment, this data is what informs where to be, when to be there, and what to wear. For a defender, it is what informs “an attacker will know where the smoking area is.”

The tools that still work

#

The catalog moves around a lot. As of 2026:

• TheHarvester (Christian Martorella, still maintained). Aggregates emails, subdomains, and hosts from a shrinking set of sources as APIs shut down.
• SpiderFoot (Steve Micallef; Intel 471 acquired it in November 2022). Broad automated OSINT harness with hundreds of modules. The open-source repository is still up but has not had a commit since late 2023, so treat it as frozen.
• Recon-ng (Tim Tomes / LaNMaSteR53). Modular Metasploit-style OSINT framework. Actively maintained.
• Maltego (Maltego Technology). Graph-based OSINT with a large ecosystem of Transforms. Free Community Edition is capable; commercial tiers unlock the interesting external data providers.
• Amass (OWASP project, owasp-amass GitHub organization, Jeff Foley’s project since 2017, now on v5). Best-of-class subdomain enumeration; “OAM” in Amass v4 and later refers to the Open Asset Model data schema, not a maintainer group.
• subfinder and httpx (ProjectDiscovery). Fast, purpose-built.
• OSINT Framework (Justin Nordine). Not a tool but a browsable catalog of tools organized by data type.

Modern OSINT increasingly integrates LLM-driven summarization: Perplexity, ChatGPT search, and similar tools accelerate initial reconnaissance dramatically. They also confidently make things up, so verify everything.

What to do with it as a defender

#

Every attacker capability above suggests a defender countermeasure:

• Executive protection: high-profile employees (execs, key engineers, spokespeople) get proactive personal-data removal (DeleteMe, Kanary, Optery, Incogni) plus targeted awareness training.
• OSINT exposure monitoring: run the same tools against your own organization on a schedule. What can you enumerate? What comes up on a site:yourcompany.com filetype:xlsx search? What certs got issued to subdomains you did not know existed?
• Awareness training that shows employees their own OSINT footprint. Nothing lands like watching a red-teamer assemble a personal profile in real time from public data.
• Vendor scrutiny for external tooling. Any SaaS that requires you to embed technical detail in a public support ticket is a public support ticket.
• Pretext-resistant callback procedures for finance and IT. If deepfake voice/video can impersonate your CFO on a call (Arup, January 2024), the process needs to route around voice as the sole authentication factor.

Ethics and scope

#

For anyone reading this from the red team side:

• Signed scope, signed rules of engagement. No exceptions. Public data is not free-fire.
• PII handling. OSINT engagements accumulate personal information about real people. Encrypt at rest, purge on schedule, limit access.
• Do not target family members unless the scope explicitly names them; and think hard about whether it should.
• Report responsibly. Findings that would substantially harm identified individuals (execs, employees) get discussed with the client before publication, not surprise-dropped in the final report.
• Nothing that touches the target’s systems without authorization. OSINT is passive by definition. Active recon (scanning, credential stuffing, sending phishing) requires separate authorization and is a different phase.

Where OSINT fits in the broader picture

#

OSINT is the first phase of most modern red team engagements and one of the most productive per-hour phases. It is also the phase most likely to reveal that the target has an OSINT exposure problem that gets fixed regardless of whether the engagement’s “real” objective succeeds. Half the value of a red team is the phase-one finding that gets remediated before phase two even starts.

For blue teams: assume every attacker starts with everything above. Design your program to hold up against an adversary who knows your org chart, your tech stack, your vendors, and your executives’ hobbies. That is the realistic threat model in 2026.

Further reading

#

• OSINT Framework (Justin Nordine)
• Bellingcat’s Online Investigation Toolkit
• Trace Labs , OSINT for missing persons cases, one of the best legitimate uses of the discipline
• Michael Bazzell’s IntelTechniques tools and “Extreme Privacy” books
• OWASP Amass
• ProjectDiscovery tools
• Cisa StopRansomware Guide for how OSINT-driven attacks fit into the larger incident lifecycle