A computer-implemented method, comprising: receiving, by a host, a source message; extracting, by the host, an initial attribute from the source message to present a pre-processed version of the source message; determining, by the host, whether the extracted initial attribute comprises a special feature so as to generate a lexical feature vector, wherein the lexical feature vector comprises a string of values corresponding to at least one lexical feature in the initial attribute; detecting, by the host, a language of the source message or the pre-processed version of the source message; based on the detected language, tokenizing, by the host, the pre-processed version of the source message to generate a cleaned token list comprising a plurality of tokens; extracting, by the host, a number of misspelled words from the cleaned token list to generate a spelling feature vector, wherein the spelling feature vector comprises a value based on the number of misspelled words; based on determining whether the cleaned token list includes one or more suspicious topics, generating, by the host, a topics vector and a correlation score for each token of the plurality of tokens in the cleaned token list, wherein the topics vector comprises a topic score based on a number of suspicious topics in the cleaned token list; based on the lexical feature vector, the spelling vector and the topics vector, applying, by the host, a model to predict a risk score for the source message; upon the risk score exceeding a risk threshold, classifying the source message as a social engineering attack; and withholding, by the host, the source message from immediate transmission to an intended recipient, if the source message is classified as a social engineering attack. receiving, by a host, a source message; extracting, by the host, an initial attribute from the source message to present a pre-processed version of the source message; determining, by the host, whether the extracted initial attribute comprises a special feature so as to generate a lexical feature vector, wherein the lexical feature vector comprises a string of values corresponding to at least one lexical feature in the initial attribute; detecting, by the host, a language of the source message or the pre-processed version of the source message; based on the detected language, tokenizing, by the host, the pre-processed version of the source message to generate a cleaned token list comprising a plurality of tokens; extracting, by the host, a number of misspelled words from the cleaned token list to generate a spelling feature vector, wherein the spelling feature vector comprises a value based on the number of misspelled words; based on determining whether the cleaned token list includes one or more suspicious topics, generating, by the host, a topics vector and a correlation score for each token of the plurality of tokens in the cleaned token list, wherein the topics vector comprises a topic score based on a number of suspicious topics in the cleaned token list; based on the lexical feature vector, the spelling vector and the topics vector, applying, by the host, a model to predict a risk score for the source message; upon the risk score exceeding a risk threshold, classifying the source message as a social engineering attack; and withholding, by the host, the source message from immediate transmission to an intended recipient, if the source message is classified as a social engineering attack.