Source: https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6900494418705473536
Threatpost Massive #LinkedIn #Phishing, #Bot #Attacks Feed on the #Job-Hungry: https://lnkd.in/eJhZmBWM: The #phishing attacks are #spoofing #LinkedIn to target #GreatResignation #job #hunters, who are also being preyed on by huge #data-#scraping #bot #attacks. Emotionally vulnerable and willing to offer up any information that lands the #gig, #job #seekers are prime targets for #SocialEngineering campaigns. And with the “Great Resignation” in full swing, #cybercriminals are having an easy time finding their next victim.
#Default: #Trust #Nothing: #ZeroTrust:
Don’t click on ANY link or download ANY file you won’t #TRUST.
#Spoofed #EMails: #AssumeBreach
Just since Feb. 1, analysts have watched #phishing #email #attacks #impersonating #LinkedIn surge 232 percent, attempting to trick job seekers into giving up their #credentials. It is likely these phishing attacks aim to capitalize on jobseekers (plus curious individuals) by flattering them into believing their profile is being viewed and their experience is relevant to household brands.
The emails had subject lines that would be enticing to job hunters hoping to get noticed, like, “Who’s searching for you online,” “You appeared in 4 searches this week” or even “You have 1 new message”… The #phishing #emails themselves were convincing dupes, built in HTML templates with the #LinkedIn #logo, #colors and #icons, the report added. The #scammers also name-checked well-known companies throughout the bodies of the phishing emails, including American Express and CVS Carepoint, to make the correspondence seem more legitimate…
Even the email’s footer lifted the company’s headquarters’ address and included “unsubscribe” links to add to the email’s authenticity, the analysts pointed out.
“You can also see the LinkedIn display #name #spoofing, which is designed to hide the #webmail #accounts used to launch the #attacks,”
Once the victim clicks on the #malicious #links in the email, they were #directed to a [ #fake ] #site [ that looks like #real #site ] to harvest their #LinkedIn #logins and #passwords. “While the display name is always LinkedIn and the emails all follow a similar pattern, the phishing attacks are sent from different #webmail #addresses… Currently, it is unknown whether these attacks are the work of one #cybercriminal or a #gang operating together.”
“It boils down to the fact that LinkedIn has hundreds of millions of members – many of whom are very accustomed to seeing frequent #legitimate #emails from LinkedIn – and may #inevitably #click without carefully checking that each and every email is the real deal.”
That leaves it to #individual #users to be #mindful of the #information they #expose #publicly and how it could be used to trick them into #clicking on a #malicious #link.
Global Risk Management Network LLC: Silicon Valley-Wall Street-Pentagon-Global Digital CEOs Networks
AIMLExchange.com : BRINT.com : C4I-Cyber.com
