Red Specter SPECTER SOCIAL

Autonomous Social Engineering Adversary — 6 channels. 10 attack types. 1,242 tests.

v1.0.0
Contents
Overview Installation Quick Start The Seven-Phase Campaign Loop Attack Channels Attack Types Human Target Model CLI Reference LLM Backends UNLEASHED Mode Pipeline Integration Evidence & Cryptography Report Output Disclaimer

Overview

SPECTER SOCIAL is an autonomous social engineering adversary. Point it at a human target. It builds a psychological profile, designs a multi-channel campaign, deploys adaptive personas, and pursues its objective until it succeeds or exhausts all vectors.

Every existing social engineering tool is a phishing simulator — static email templates, no reasoning, no adaptation, no psychological profiling, no multi-channel coordination. SPECTER SOCIAL thinks. It uses an LLM reasoning engine to analyse the target, select attack vectors, craft personalised content, interpret responses, calibrate trust, and adapt its strategy in real time.

Six channels. Ten attack types. One reasoning engine that decides which channel to use, what persona to deploy, and how to decompose a malicious objective into a sequence of innocent-looking interactions. The human is the attack surface. SPECTER SOCIAL is the adversary.

Installation

$ pip install red-specter-social

Optional extras:

# Cloud LLM backends $ pip install red-specter-social[cloud] # Voice channel (TTS) $ pip install red-specter-social[voice] # Web channel (fake portals) $ pip install red-specter-social[web] # Everything $ pip install red-specter-social[cloud,voice,web]

Quick Start

# Credential harvesting campaign via email $ specter-social engage target@company.com --objective credentials # Full multi-channel campaign $ specter-social engage target@company.com --mode full --channels email,voice,chat # OSINT reconnaissance only $ specter-social recon target@company.com --deep # With cloud LLM for stronger reasoning $ specter-social engage target@company.com --llm openai --objective wire_transfer

The Seven-Phase Campaign Loop

Every SPECTER SOCIAL campaign cycles through seven phases. The reasoning engine decides when to advance, pivot, escalate, or switch channels based on target responses and trust calibration.

01 RECON OSINT collection — role, organisation, LinkedIn, public communications, colleagues, org news
02 PROFILE Build psychological model — authority figures, stress triggers, compliance patterns, communication preferences
03 PLAN Design multi-channel campaign — select attacks, channel sequence, personas, lures, goal decomposition
04 EXECUTE Deploy agents across channels — email, voice, SMS, web, chat, video
05 ADAPT If target resists — change channel, change persona, change timing, change approach
06 ESCALATE Standard: document resistance. UNLEASHED: push through until objective achieved
07 REPORT Full interaction timeline, psychological vulnerability map, Ed25519 signed, SIEM export

Attack Channels

SPECTER SOCIAL coordinates attacks across six communication channels. The reasoning engine selects the optimal channel for each interaction based on target profile and campaign state.

ChannelVectorsCapabilities
EMAIL4SMTP spear phishing, HTML lures, attachment pretexts, personalised templates
VOICE3TTS vishing, real-time adaptive conversation, voice cloning, objection handling
SMS2Urgency attacks, link lures, callback number manipulation
WEB3Fake login portals, approval pages, credential harvesting, document lures
CHAT3Teams/Slack impersonation, direct message social engineering, group infiltration
VIDEO2Deepfake avatar, executive impersonation calls, fake meeting invitations

Attack Types

Ten social engineering attack types, each with specialised content generation and persona management.

AttackChannelsDescription
Spear PhishingemailTargeted, contextually personalised email campaigns with adaptive lures
VishingvoiceAutonomous voice calls with real-time adaptive conversation and objection handling
PretextingallMulti-turn identity deception across channels with supporting evidence
C-Suite Impersonationvoice, video, emailDeepfake voice/video of executives for authority-based attacks
IT Supportvoice, chat, emailCredential harvesting via fake helpdesk interactions
Vendor Impersonationemail, voiceInvoice fraud, wire transfer authorisation, payment redirection
Urgency EscalationallManufactured time pressure to bypass critical thinking (5 escalation levels)
Multi-ChannelallCoordinated campaign — email → voice → SMS → fake meeting
Goal DecompositionallMalicious intent split across harmless-looking interactions with cover stories
Consensus Manufacturingchat, emailMultiple fake personas creating false social proof to overwhelm critical thinking

Human Target Model

SPECTER SOCIAL extends the NEMESIS reasoning engine with a Human Target Model — a psychological profile that evolves throughout the engagement.

Psychological Profiler Builds profile from OSINT data — authority figures, stress triggers, compliance patterns, communication preferences
Trust Calibration Engine Tracks trust level across interactions — NONE → MINIMAL → DEVELOPING → ESTABLISHED → HIGH
Goal Decomposition Engine Breaks malicious objectives into innocent-looking sub-goals with cover stories and prerequisites
Resistance Adaptation Engine Analyses pushback, generates countermeasures, pivots strategy, detects when a target is burned
Influence Susceptibility Maps Cialdini’s six principles (reciprocity, authority, scarcity, social proof, liking, commitment) to target-specific scores
Compliance Prediction Predicts probability of target compliance based on trust level, resistance history, and request sensitivity

CLI Reference

CommandDescription
specter-social engage <target>Launch campaign (default: email, credentials)
specter-social engage <target> --objective credentialsCredential harvesting campaign
specter-social engage <target> --objective wire_transferWire transfer social engineering
specter-social engage <target> --objective data_exfiltrationData exfiltration campaign
specter-social engage <target> --objective access_authorisationAccess authorisation campaign
specter-social engage <target> --objective intelligenceIntelligence gathering
specter-social engage <target> --channels email,voice,chatMulti-channel campaign
specter-social engage <target> --mode fullFull campaign (default)
specter-social engage <target> --mode reconRecon only
specter-social engage <target> --mode singleSingle-channel mode
specter-social engage <target> --max-loops 20Set max reasoning loops
specter-social engage <target> --llm ollamaUse local Ollama (air-gapped)
specter-social engage <target> --llm openaiUse OpenAI GPT-4o
specter-social engage <target> --llm anthropicUse Anthropic Claude
specter-social engage <target> --session pentest_01Named session
specter-social engage <target> --overrideUNLEASHED dry-run
specter-social engage <target> --override --confirm-destroyUNLEASHED live
specter-social recon <target>OSINT reconnaissance
specter-social recon <target> --deepDeep OSINT recon
specter-social report --session s1Generate report
specter-social report --session s1 --signEd25519 signed report
specter-social report --session s1 --restrictedRESTRICTED report (UNLEASHED only)
specter-social report --session s1 --export-siem splunkSIEM export
specter-social report --session s1 --summaryPrint text summary
specter-social statusCurrent campaign status
specter-social channels-listList available channels
specter-social attacksList attack types
specter-social sessionsList recorded sessions

LLM Backends

SPECTER SOCIAL requires an LLM to reason about human targets. Three backends are supported:

Ollama (Local) Air-gapped. No data leaves the machine. Llama 3 70B recommended. No API key required.
OpenAI (Cloud) GPT-4o. Higher reasoning quality for complex social engineering. Set OPENAI_API_KEY.
Anthropic (Cloud) Claude Sonnet. Set ANTHROPIC_API_KEY.
# Local — air-gapped, no data leaves the machine $ specter-social engage target@company.com --llm ollama --model llama3:70b # OpenAI — cloud reasoning $ export OPENAI_API_KEY=sk-... $ specter-social engage target@company.com --llm openai # Anthropic — cloud reasoning $ export ANTHROPIC_API_KEY=sk-ant-... $ specter-social engage target@company.com --llm anthropic

UNLEASHED Mode

Standard mode probes and reports. UNLEASHED mode does not stop until the objective is achieved.

CapabilityStandardUNLEASHED
OSINT ReconFullFull
Psychological ProfilingFullFull
Multi-Channel CampaignFullFull
Deepfake VoiceSimulatedLive cloning
Deepfake VideoSimulatedLive avatar
Credential HarvestingSimulatedReal capture
Wire Transfer PushSimulatedLive attempt
Resistance AdaptationReportsDestroys
Objective CompletionBest effortUntil achieved
Report ClassificationStandardRESTRICTED
Ed25519 Key RequiredNoYes

Ed25519 cryptographic override. One private key. Dual-gate: --override (dry-run) then --override --confirm-destroy (live).

UNLEASHED Modules

# UNLEASHED dry-run — see what would happen $ specter-social engage target@company.com --override # UNLEASHED live — execute for real $ specter-social engage target@company.com --override --confirm-destroy

Pipeline Integration

SPECTER SOCIAL completes the Red Specter offensive pipeline. Every other tool attacks infrastructure. SPECTER SOCIAL attacks the human. The last gap is closed.

01 FORGE LLM testing
02 ARSENAL Agent testing
03 PHANTOM Swarm assault
04 POLTERGEIST Web siege
05 GLASS Traffic interception
06 NEMESIS Adversarial AI
07 SPECTER SOCIAL Human layer
08 PHANTOM KILL OS/kernel/firmware
09 GOLEM Physical layer
10 HYDRA Supply chain
IDRIS Discovery & governance
AI Shield Defence
redspecter-siem SIEM integration

Tool Integration

Evidence & Cryptography

Ed25519 Signed Campaigns Every campaign can be cryptographically signed for tamper-evidence
SHA-256 Evidence Chain Hash-linked evidence chain across all interactions and channels
MITRE ATT&CK Mapping 15 techniques mapped across all social engineering findings
SIEM Export Splunk CEF, Microsoft Sentinel, QRadar formats

Report Output

Every campaign produces a full report: executive summary, interaction timeline across all channels, psychological vulnerability map, trust trajectory, findings with ATT&CK mapping, statistics, and recommendations.

# Generate a signed report with SIEM export $ specter-social report --session pentest_01 --sign --export-siem splunk # Quick text summary $ specter-social report --session pentest_01 --summary # RESTRICTED report (UNLEASHED engagements) $ specter-social report --session pentest_01 --restricted

Disclaimer

Red Specter SPECTER SOCIAL is designed exclusively for authorised red-team engagements conducted with the written consent of the target organisation. All human targets must be employees or contractors of the authorising organisation operating under an active engagement agreement. Unauthorised use against real individuals constitutes offences under the Computer Misuse Act 1990 (UK), the Fraud Act 2006 (UK), the Computer Fraud and Abuse Act (US), GDPR, and equivalent legislation in your jurisdiction. The authors accept no liability for misuse.