An attacker creates an account closely mimicking a real person or project's official identity — matching the name, photo, and writing style — sometimes going as far as compromising a genuine account to use it directly.
They reach out directly, often with a believable, context-specific reason: a project "team member" offering early access, a "friend" urgently needing help, or an official account announcing a time-limited opportunity.
The interaction is steered toward either a direct payment, a request for sensitive information, or a malicious link — all relying on the borrowed credibility of whoever's being impersonated to lower the victim's guard.