LinkedIn Phishing Scam Uses Fake InMail to Deliver ConnectWise RAT

Overview

Cybersecurity researchers at Cofense have uncovered a LinkedIn phishing campaign distributing the ConnectWise Remote Access Trojan (RAT). Unlike traditional LinkedIn-themed phishing attacks that steal credentials, this campaign delivers malware via spoofed InMail notifications.

Attackers exploit LinkedIn’s branding and fake a request for a product or service quote, creating a sense of urgency to trick recipients into downloading the malicious RAT installer.

How the LinkedIn Phishing Attack Works

1. Fake LinkedIn InMail Notification

• Victims receive a spoofed LinkedIn email, mimicking an InMail request from a Sales Director.
• The email appears legitimate but uses outdated LinkedIn branding from before 2020.
• Attackers use a real person’s profile picture but a fabricated company name to increase credibility.

2. Social Engineering Tactics

• The email does not directly request downloads to avoid suspicion.
• Clicking “Read More” or “Reply To” triggers a hidden download of the ConnectWise RAT installer.

3. Email Spoofing & Bypassing Security

• The email fails SPF & DKIM authentication, proving it did not originate from LinkedIn.
• However, weak DMARC settings allow the email to land in inboxes instead of being rejected.
• The Secure Email Gateway (SEG) fails to block the phishing email, enabling widespread delivery.