Click, Trust, Lose: An Analysis of Social Engineering Vulnerabilities in Uzbekistan

Abstract

Social engineeringthe psychological manipulation of peo-
ple into actions that compromise their own securityhas become a dom-
inant cyber-threat in rapidly digitalising economies. This paper analyses
the forms social engineering has taken in Uzbekistan, drawing on docu-
mented incidents and direct observation. Four recurring attack patterns
are identied and organised into a taxonomy: the self-propagating Tro-
jan le (and its newer bot mini-app variant), fake-prize phishing that
clones domestic payment brands, a patient trust-building long-con, and
the fraudulent security call. We show that these patterns separate into
two groups: attacks that depend on intercepting a one-time SMS code,
which have been substantially blunted by the introduction of mandatory
OneID transaction verication, and attacks that exploit curiosity and
emotional investment, which no single regulatory measure can patch. A
light conceptual model formalises the exponential, self-replicating spread
of the Trojan pattern. We argue that Uzbekistan's elevated exposure re-
ects the timing of its digital transitionconvenience arriving ahead of
protective infrastructure and user literacyrather than any unique defficiency, and we outline a layered set of technical and educational coun-
termeasures.