New Tactic: Shortened LinkedIn URLs Are Now Used As Phish Hooks



Shortened URLs and Use of Phish HooksScammers are using shortened LinkedIn URLs to disguise phishing links, according to Jeremy Fuchs at Avanan. LinkedIn automatically shortens links that are longer than 26 characters. The URL is shortened to a “lnkd.in” link followed by several characters. Attackers are abusing this feature to avoid detection by users and security filters.

Avanan spotted a phishing email that states, “Good afternoon. We are having a general upgrade on our new system data for 2021, and we’ll be needing your aid to rectify the missing info below so we can deliver more accurate and reliable service.” Ironically, the bottom of the email contains a warning that email fraud is on the rise, urging users to validate the source before interacting with an email.

If a user clicks on the shortened link, they’ll be sent through several redirects before landing on a phishing page that asks them to download a PDF. By using a shortened link from a legitimate service, users are less likely to be suspicious. Using multiple redirects through harmless sites helps to fool security technologies that check for phishing pages.

“This particular email can target anyone,” Fuchs says. “Though it presents itself as a standard credential harvesting and invoice scheme, the use of a LinkedIn URL may mean that any profession—the market for LinkedIn—could click. Plus, more employees have access to billing and invoice information, meaning that a spray-and-pray campaign can be effective. Whether it’s the “lnkd.in” form or the https://www.linkedin[.]com/slink?code=aB-cDeF variation, the idea is to create a link that contains a clean page, redirecting to a phishing page.”

Avanan notes that LinkedIn is among the top ten most impersonated brands in phishing attacks, so users should be on the lookout for these types of scams. New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for stealthy phishing attacks.

Avanan has the story.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Subscribe To Our Blog


Cybersecurity Awareness Month Resource Kit




Get the latest about social engineering

Subscribe to CyberheistNews