LinkedIn Phishing
We have seen a few customer reports recently around receiving malicious attachments and messages from LinkedIn. We wrote about this type of attack appearing again more frequently, although its been around for quite some time.
However much a business tries and attempts to prevent attack and infection to their computers and business, from securing the perimeter by filtering email and web traffic, right down to the controls on the endpoint looking after Antivirus and educating the organisations users about the threats, they are ever evolving.
Attackers are using compromised LinkedIn accounts to send messages to the accounts connections. LinkedIn being a business tool, users are allowed in the main to browse it and see these messages.
These messages are normally a PDF file, with links embedded in them that will either
- download a virus or, even worse, ransomware to your computer
- Prompt a user to enter in some form of credentials, normally Office365, in an attempt to gain a foothold into the customers environment
LinkedIn prompts recipients also of pending unread messages that they have, so these come sailing through to the recipients email legitimately from LinkedIn as trusted messages and adds weight to these messages being genuine and trusted.
Users in your business can protect themselves in as many ways they can as possible but situations like this are out of a business’s control. You can protect your LinkedIn and Office365 accounts with Multi-Factor authentication, but you cant be in control of your connections security.
Ways to Prevent
- Ensure you use MFA (Multi Factor Authentication) wherever you can. LinkedIn supports it, Office365 Supports it, Google supports it. Consider where your sensitive data is stored and ensure you have it as protected as it can be
- Educate your users on the threat of Phishing, through email and through other mediums such as LinkedIn. If a message is received, think for a moment whether its expected and its valid. Treat attachments and links as suspicious.
- Watch out for the messages, treat them as insecure. Indicators could be a badly spelt, has a link which has been shortened and not easily recognisable, asking you to view a shared document.
