Phishing Scammers Send a Fake “Private Shared Document” as the Initial Attack Vector for Stealing LinkedIn Credentials

LinkedIn Shared Document Phishing ScamA new social engineering scam demonstrates how cybercriminals are both evolving their tactics while still using tried and true methods that just work to attain their goals.

I’ve covered scams impersonating Office 365 I don’t know how many times. But it’s not very often you hear about a scam that uses LinkedIn as both its distribution medium and its’ credential target.

Last month, victim LinkedIn users received a message from one of their connections (which proved to have been compromised) that contained a link to a third-party website containing a “LinkedInSecureMessage” (which there is no such thing).

Victims are taken to a page displaying the following very official-looking page:

LinkedIN View Document

After pressing the “view document” button, they are presented with again, an equally convincing page.

LinkedIn Welcome Page

The scam here is to steal LinkedIn credentials, likely to be sold to another cybercriminal used to perpetuate additional scams. In this case, LinkedIn is merely the avenue of opportunity for the bad guy; it can just as easily be any other SaaS offering in the cloud.

Users need to stay vigilant with every cloud-based application they use; cybercriminals are always looking for the next site they can make use of to infiltrate to make a buck. Teaching users through Security Awareness Training will help to maintain that needed vigilance and lower the chance of users falling for even some of the best impersonation attacks around.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Anti-Phishing Guide ebook

Get the latest about social engineering

Subscribe to CyberheistNews