You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing

Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorized access or information. In this scenario, the attacker impersonated a trusted authority figure (the boss) via email spoofing, manipulated the receptionist into sharing a document, then weaponized that document and used trust to get the victim to open malicious links. Every step relied on deceiving a person rather than exploiting a software flaw.

Piggybacking is a physical security attack where an unauthorized person gains building access with the consent of an authorized person, which did not occur here.

Tailgating is also a physical access technique where an attacker follows an authorized person through a secured door without their knowledge, not applicable to this email-based scenario.

Eavesdropping involves intercepting communications passively to gather information, whereas this attack involved active deception and interaction with the victim.