Social-engineering attacks appear to be popular with criminals because they're simple and effective. "Hacking people is easier than hacking technology," says Chris Morales, head of security analytics at Vectra.