Cybercriminals Can Post Jobs on LinkedIn Posing as Any Employer They Want

Cybercriminals LinkedIn Lax verification around what company is offering a given job on LinkedIn allows attackers to create bogus job postings for malicious purposes.

It appears that LinkedIn is being potentially used as medium by cybercriminals to connect with victims. The ability exists today for a threat actor to impersonate being part of a legitimate company when posting a job.

Scams using job postings are one of the most powerful social engineering tactics used today – using a well-established site like LinkedIn to begin with and completely putting aside email-based phishing, matched with the desire of the potential candidate to follow whatever process is necessary to get that cool job at that great company with the awesome pay adds up to be a perfect cyber-storm.

I wrote about such attacks back in 2019, where a developer at a bank was looking for a new job and was tricked into installing a RAT under the premise it was a program designed to allow him to fill out an application. It appears that LinkedIn still has no means for verifying that the poster is from the company they say they are.

According to Bleeping Computer, security researchers were recently able to walk through the posting process without needing to validate the company they purported to work for. This is a huge advantage for the threat actor. Think about it – if I want to target a specific industry or company, post a dev job as a competing company in that same sector. Simple, elegant, and likely effective social engineering – all thanks to LinkedIn.

This kind of attack is one of the slickest as the victim feels completely like they are initiating the connection (as opposed to a phishing email that shows up in your Inbox) and is emotionally invested in following the process through to completion.

Falling for social engineering is one of the main reasons organizations need their users to enroll in continual Security Awareness Training – it’s not just within email that social engineering tactics are found; and this latest finding on LinkedIn affirms that notion.

Don’t get hacked by social media phishing attacks!

Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization's reputation, or gain access to your network.

KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.

Here's how the Social Media Phishing Test works: