In an era where social media profiles are more than just online diaries, new research shows that the real risk comes not from what people post explicitly, but from what can be inferred about them using advanced artificial intelligence. A newly published study introduces a unified framework that uses Large Language Models (LLMs)—the same kind of AI behind chatbots like ChatGPT—to measure how accurately someone can be profiled based on their public social media activity, and how susceptible they might be to social engineering attacks as a result. This approach could help security experts better understand and mitigate risks before attackers exploit them.
Key Takeaways
- The researchers developed a comprehensive taxonomy of 38 capabilities that combine social media intelligence (SOCMINT) and cyber human intelligence (Cyber-HUMINT) into a single framework covering the full threat lifecycle.
- The framework uses LLMs to extract structured information from unstructured social media content with very high accuracy (97.3% F1 score), outperforming traditional rule-based methods.
- It infers personal attributes that users never explicitly share, achieving near-perfect scores (4.73 out of 5) in validation tests.
- The system predicts how individuals would respond to personalized engagement strategies, accurately gauging their vulnerability to targeted social engineering attacks.
Traditionally, social media profiling and cyber human intelligence have existed as separate disciplines. SOCMINT focuses on collecting and analyzing information passively from social media platforms, while Cyber-HUMINT involves more active engagement to gather intelligence about individuals. This new research bridges the gap by creating a unified, doctrine-based taxonomy that maps 38 specific capabilities across the Cyber Threat Intelligence lifecycle. This lifecycle covers everything from initial data collection to using that data for active social engineering attempts.
At the core of this framework is an LLM-augmented multi-agent pipeline. “Multi-agent” here means that several AI components work together, each specializing in a different task—such as extracting data from posts, inferring hidden personal traits, and assessing how susceptible a person might be to manipulation. Large Language Models excel at understanding and processing natural language, allowing them to turn messy, unstructured social media posts into neat, structured profiles. This pipeline was tested on real users’ public social media data, showing it can predict how targets might rank different personalized engagement options—essentially estimating how likely they are to fall for tailored social engineering attacks.
The researchers emphasize that this tool is designed to support security analysts rather than replace them. By quantifying exposure—how much information about a person can be gleaned and exploited—it gives defenders a way to assess their own vulnerabilities before malicious actors do. This is particularly important in today’s “post-API” world, where traditional access to social media data is restricted, but profiling remains cheap and automated thanks to AI.
Looking ahead, this unified framework could become a valuable asset for organizations aiming to strengthen their cybersecurity posture. By understanding the full continuum from data extraction to attack susceptibility, defenders can better prepare against increasingly sophisticated social engineering tactics. Future work may explore expanding the framework to cover more platforms and refining its predictive capabilities. As social media continues to play a central role in both personal and professional lives, tools like this offer a promising way to stay one step ahead of emerging threats.
Based on research published on arXiv by Pellegrino Casoria, Simon Pietro Romano.