Hackers Are Going After Executives' Families to Get Past Corporate Security
Criminals are bypassing hardened corporate defences by targeting the people executives live with. Family members rarely have security training, and that gap is getting easier to exploit.
Key points
- Criminals are using family members and close friends of senior executives as a stepping stone into corporate networks, a tactic that is growing more common according to new research.
- A 2025 Ponemon Institute and BlackCloak study found 51% of organisations reported attacks on their business leaders, up from 43% in 2023.
- During client onboarding, BlackCloak found 39% of executives already had devices secretly compromised, and 20% had home networks with no access controls at all.
- AI tools can map a household's relationships and routines roughly seven times faster than manual reconnaissance, according to KnowBe4 security adviser Erich Kron.
- Authenticator apps or physical security keys offer stronger protection than SMS codes, which criminals can redirect by convincing a mobile carrier to transfer a phone number to a SIM card they control.
A senior executive locks down her corporate laptop with strong multi-factor authentication (MFA), the extra verification step that confirms you are who you say you are. The attacker steps back and looks elsewhere. Her teenager hasn't enabled MFA on his gaming console, which sits on the home Wi-Fi. That network connects, eventually, to her work. The attacker walks straight in.
That's the scenario Brian Hill, field chief information security officer at digital protection firm BlackCloak, uses to describe what he calls one of the most predictable paths criminals now take. The pattern is backed by hard numbers, first aggregated by Dark Reading.
How common is this really?
Common enough that it's no longer theoretical. The 2025 Ponemon and BlackCloak research puts the share of organisations that experienced attacks targeting their leaders at 51%, up eight percentage points in two years. Hill says that during BlackCloak's own onboarding, nearly four in ten executives already had devices compromised without knowing it, and one in five had home networks that were entirely open.
Family members are the obvious entry point. They share calendars and group chats with the target. Nobody has put them through corporate security training. Kron, at KnowBe4, puts it plainly: family and friends are easier to deceive precisely because no one has prepared them. Our coverage of help-desk social engineering found a similar dynamic: MFA pushes criminals toward the softer human layer, not away from them entirely.
What do these attacks actually look like?
Three main approaches are in use. Impersonation, where criminals clone a family member's voice or copy their writing style to make a fake urgent request feel real. Device compromise, breaking into a phone or laptop that sits on the same home network as the executive's work machine. Phishing and smishing (text-message phishing) aimed at people who are less likely to spot a fake bank alert or a fraudulent parcel notification.
AI is making the groundwork faster. Criminals can sweep social media profiles and public records to build a detailed picture of a household's routines without touching any corporate system. Location check-ins, a child's school mentioned in a caption, a partner's podcast appearances: all of it feeds that picture. Kron says AI now does that sweep roughly seven times faster than a person working manually.
Jeremy Banon, CEO of The Cyber Health Company, notes that routing an attack through a family member adds steps that might individually fail, but the overall odds of eventually reaching the real target go up, not down.
What should families actually do?
MFA on everything, to start. Kron advises against SMS-based codes: criminals can steal a phone number through a SIM swap, convincing a mobile carrier to transfer it to a device they control. Authenticator apps or physical security keys are harder to subvert.
Beyond that, the practical advice is mostly about reducing what attackers can find. Remove legal names from social media usernames and profile photos. Set accounts to private. Be cautious about podcasts and video content that captures your voice, since that audio can be used to build a voice clone. Less technically confident family members should treat unexpected QR codes and fake delivery messages with suspicion, and verify by calling back on a known number.
Banon is also sceptical of family safe words, the phrases some experts recommend to verify identity over text. "If you text your safe word once, it's burned," he told Dark Reading. "Then you need a new safe word."
None of this is glamorous. A family that knows these scams exist is meaningfully harder to use as a bridge into a corporate network than one that doesn't. The criminal calculus is straightforward: if the front door has a decent lock, try the side gate. Right now, a lot of side gates are wide open.
