Why do geopolitical crises create more risk for phishing, fraud, and DDoS activity?

Why crises create the perfect conditions for phishing and fraud

Geopolitical crises change the attacker’s operating environment. Public attention narrows, people move faster, and legitimate messages about conflict, aid, sanctions, travel, or payments become harder to distinguish from fakes. That combination lets criminals blend into the news cycle, impersonate trusted organisations, and use urgency to push victims into unsafe clicks, transfers, or disclosures.

Phishing and fraud also benefit from pattern disruption. During a crisis, normal communication habits break down, so recipients are less likely to notice small anomalies in sender identity, language, or timing. The result is not just more volume, but better cover for messages that would look suspicious in calmer conditions.

Crises also increase the value of social engineering against employee workflows, because attackers know staff are under pressure to respond quickly and may rely on familiar support channels. The same logic underpins OAuth phishing via Copilot Studio, where trusted-looking infrastructure is used to harvest credentials or tokens rather than break technical controls directly.

Why DDoS, fake claims, and noisy disruption rise at the same time

Geopolitical tension gives hacktivists and opportunistic actors a ready-made narrative for disruption. DDoS activity becomes attractive because it is visible, symbolic, and easy to frame as part of a cause, even when the real motive is attention or extortion. At the same time, false breach claims, forged statements, and spoofed websites spread quickly because audiences expect misinformation during a fast-moving event.

That mix creates a practical security problem: defenders must separate genuine incident signals from deliberate noise. Public-facing teams can be overwhelmed by fake social posts, cloned domains, and copycat messages while infrastructure teams are dealing with traffic spikes that may be protest-driven, criminal, or simply opportunistic. The challenge is not only service availability, but also trust in what is being said online.

For broader threat patterns, ENISA Threat Landscape is useful because it tracks how DDoS, fraud, and other campaign activity cluster around major geopolitical events and sector disruption. That makes it a strong reference point when you need to distinguish symbolic disruption from longer-running criminal exploitation.

What changes for defenders when the news cycle becomes part of the attack surface

The main change is tempo. Crisis-linked campaigns move fast, rely on emotional context, and often expire quickly, so normal review cycles can be too slow. Teams should expect short-lived phishing lures, cloned donation pages, fake executive statements, impersonation of logistics or payment partners, and denial-of-service bursts timed to public announcements.

Detection needs to be tuned for context, not just indicators. A message that is technically clean can still be malicious if it borrows crisis terminology, urgent payment requests, or references to sanctions, travel, aid, or supply interruptions. Likewise, a traffic surge may be an expected publicity event, a protest action, or an attack, so the response playbook has to account for ambiguity instead of assuming one motive.

Controls that matter most are those that slow down human action, preserve verification, and make impersonation harder to scale. That means strong sender verification, DNS and domain monitoring, protected executive communications, payment out-of-band checks, and clear escalation paths for brand impersonation or fraud reports. NIST SP 800-63 Digital Identity Guidelines is relevant here because phishing-resistant authentication reduces the chance that crisis-themed lures can turn into account takeover.

Risk and Threat Considerations

Geopolitical crises increase both opportunistic crime and ideologically motivated disruption. The immediate risk is that people trust urgent messages too quickly, but the broader threat is that attackers can reuse the same crisis narrative for credential theft, payment diversion, domain impersonation, and traffic floods across many targets.

Failure mechanism: Attackers exploit urgency, uncertainty, and news-driven trust to bypass normal verification, while DDoS and fake claims create enough noise to hide the real campaign path or drain defender attention.

Impact: Organisations can suffer account compromise, fraudulent transfers, service outages, reputational damage, and delayed incident response, especially when public communication and security operations are both under pressure.

Practitioner Guidance

What to prioritise: Put crisis-specific impersonation and payment-fraud checks in front of speed. If the message references conflict, sanctions, aid, travel, logistics, or emergency funding, require a second verification path before any click, transfer, or credential entry.

What to verify: Confirm that brand-monitoring, domain monitoring, and executive-communication controls are ready before the news event peaks. The practical test is whether your team can quickly prove which messages, websites, and traffic spikes are legitimate without relying on intuition.

Common mistake: Treating the event as “just another awareness issue.” During a geopolitical crisis, attacker success often comes from exploiting the organisation’s own urgency, so response procedures need to be stricter, not looser, than usual.

Practitioner takeaway: The right response is to slow trust down while keeping operations moving, because crisis periods reward attackers who can look credible, look urgent, or simply be loud enough to distract you.

Related resources from NHI Mgmt Group

• Why do non-human identities create more risk than many human accounts?
• Why do non-human identities create more remediation risk than many human accounts?
• Why do high-activity devices create more fraud risk than single suspicious sessions?
• Why do SMS-based authentication methods create more risk in environments exposed to phishing and SIM-swap fraud?