A fabricated article about mass layoffs in your security team gets picked up by a bot network and reposted 86 times per second. A deepfake video of your CEO announces a new product feature - with a link that harvests customer credentials. A network of fake employee profiles spends eight weeks building credibility on LinkedIn before launching a coordinated spear-phishing campaign against your partners. Social media as an attack surface is not new. What is new is that AI has collapsed the cost and complexity of running influence operations at scale. Campaigns that once required the resources of a hostile state, multiple languages, coordinated personas, cross-platform distribution, can now be run by a single person. The barrier to entry is gone. The threat is not. This keynote explores how social media has become an operational layer of modern cyber attacks. It is where threat actors conduct reconnaissance, build cover identities, and run preparatory campaigns weeks before anything touches an organization’s infrastructure. Through real cases and attacker methodology, this session maps what that pre-attack lifecycle actually looks like, and what it would take to have visibility into it before the damage is done.