Don't fall for LinkedIn phishing: How to watch for this credential-stealing attack

Image: Natee Meepian/Shutterstock

Cybercriminals are ever changing their tactics successful bid to execute their goals. With phishing, the extremity is to cod banking credentials, recognition paper numbers oregon get entree to emails from users, which successful crook allows them to tally much blase scams, similar the infamous business email compromise scam that has affected truthful galore companies for immoderate years already.

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

Now immoderate phishing includes precocious social engineering. Abusing LinkedIn is 1 of those techniques that is precise effectual due to the fact that a batch of professionals usage and beryllium connected LinkedIn for their activities oregon enactment relationships.

LinkedIn phishing emails

In a caller blog post, Kaspersky exposed immoderate examples of this benignant of phishing email.

The archetypal 1 consists of an email supposedly coming from LinkedIn, but really it has been forged and comes from a existent cybercriminal (Figure A).

Figure A

  A phishing email supposedly coming from LinkedIn.

Image: Kaspersky

The contented is beauteous good done, but what should rise suspicion and observe that this email contented is fake is the sender address, which has thing to bash with LinkedIn. Legitimate emails from the societal web ever usage the domain linkedin.com. Also, 1 mightiness expect specified an email not to incorporate misspellings similar "bussinessman."

Once clicked, the nexus leads the unsuspecting idiosyncratic to a phishing leafage hosted connected a precise antithetic URL than the morganatic 1 (Figure B).

Figure B

  The fraudulent phishing leafage acceptable by the cybercriminals.

Image: Kaspersky

Once the idiosyncratic enters his oregon her credentials into this page, the crippled is over: The cybercriminals volition beryllium capable to usage the user's relationship astatine will.

Kaspersky besides warns astir phishing emails abusing LinkedIn (Figure C) which leads to a wholly antithetic content.

Figure C

  A phishing email abusing LinkedIn, with a highly suspicious link.

Image: Kaspersky

Once again, Figure C shows contented that should instantly rise suspicion: the sender code has thing to bash with LinkedIn, and the nexus to click is besides unrelated.

But the weirdest happening happens for the idiosyncratic who decides to click connected the link. He oregon she is not guided to a fake login leafage supposedly from LinkedIn but to a fiscal online survey. In that benignant of fraud, the idiosyncratic is enticed to capable retired a tiny survey (Figure D) earlier providing accusation astir themselves, including a phone-number, which mightiness beryllium utilized to perpetrate different fraud.

Figure D

  A fraudulent online survey dispersed by a fake LinkedIn email.

Image: Kaspersky

Financial crimes from LinkedIn phishing

Most phishing and societal engineering attempts that maltreatment the LinkedIn nonrecreational web are done for fiscal transgression purposes.

Some phishing is done to cod nonstop LinkedIn credentials, oregon to entice the idiosyncratic to supply different credentials, similar idiosyncratic oregon firm email oregon adjacent telephone fig oregon recognition paper information. 

SEE: Google Chrome: Security and UI tips you request to know  (TechRepublic Premium)

Once they get clasp of recognition paper information, they tin usage the paper oregon merchantability it online. When they get entree to the backstage email code of someone, they tin usage it for much precocious scams, similar impersonating the idiosyncratic to instrumentality immoderate friends into sending money, hunt successful the stored emails for much entree to different services, oregon drawback backstage accusation that tin beryllium sold easily, specified arsenic passport information. 

Owning the entree to a firm relationship is besides juicy for a financially motivated attacker. The attacker mightiness find accusation to merchantability oregon find capable accusation to physique a existent BEC fraud.

Fake LinkedIn profiles utilized for cyber-espionage

In caller years, determination person been respective examples of existent cyber-espionage menace actors abusing LinkedIn to get successful interaction with employees of companies they privation to compromise.

In June 2020 ESET, a Slovak net information company, exposed "Operation In(ter)caption," targeted attacks against aerospace and subject companies successful Europe and the Middle East. In that cyberespionage operation, the menace histrion utilized LinkedIn-based societal engineering to found an archetypal foothold earlier deploying malware (Figure E).

Figure E

 A fake LinkedIn occupation connection sent by a menace histrion to found contact.

Image: Kaspersky

In this case, the attackers had created a mendacious illustration connected LinkedIn and utilized it to attack employees successful companies they wanted to target. Once the speech was initiated, they would socially technologist the victims to person malware launched to compromise the company.

In different case, an probe from the Associated Press revealed the usage of an artificial intelligence-generated representation acceptable connected a fake LinkedIn illustration nether the sanction "Katie Jones,"  who targeted respective deliberation tanks' profiles.

How to observe LinkedIn phishing and fake profiles

LinkedIn phishing tin beryllium tricky to observe due to the fact that immoderate phishing emails tin look precise convincing. So, however tin you spot LinkedIn phishing?

• First, look astatine the sender information. It indispensable travel from an email code astatine linkedin.com. Yet if it does, it does not mean the contented is not fake.
• Look for typos and misspellings successful the taxable enactment and the email body.
• Look astatine the nexus that you request to click to spell further. If it brings you to a URL that is not utilizing the linkedin.com domain, it is phishing.
• If it contains an attached file, it is fake. LinkedIn volition not nonstop you files. It is astir apt a record that volition infect your machine if opened.
• In each cases, if you fishy something, disregard the email, unfastened your browser and entree LinkedIn the mode you usually do. You tin past spot what's up successful the idiosyncratic interface and grip it safely.

Now what astir the fake profiles connected LinkedIn?

• Check each of the profile. Are determination inconsistencies oregon weird information?
• Check the contacts oregon the fig of contacts. If the fig is precise low, it mightiness beryllium a recently created illustration acceptable up for fraud.
• Does it marque consciousness that this idiosyncratic contacts you?
• Does the idiosyncratic privation to stock files with you? Maybe adjacent successful an urgent manner?

If you person doubts and truly are funny astir the message, don't hesitate to telephone the main bureau astatine the company. Ask for the person. For starters, they volition corroborate the idiosyncratic exists successful the company. Then get the idiosyncratic connected the telephone and corroborate it is so the idiosyncratic who sent you the message.

Remember that cybercriminals tin besides compromise LinkedIn accounts and usage them. Therefore, it's important to person confirmation via different connection transmission erstwhile receiving weird messages connected LinkedIn.

Also see

• Stop utilizing your enactment laptop oregon telephone for idiosyncratic stuff, due to the fact that I cognize you are (TechRepublic)
• Working astatine a harmless distance, safely: Remote enactment astatine concern sites brings other cyber risk (TechRepublic)
• How to go a CIO: A cheat sheet (TechRepublic)
• NFTs: What IT leaders request to cognize astir non-fungible tokens (free PDF) (TechRepublic)
• Checklist: Onboarding and offboarding IT staff (TechRepublic Premium)
• CXO: More must-read coverage (TechRepublic connected Flipboard)