Massive LinkedIn Phishing, Bot Attacks Feed on the Job-Hungry

Reading Time: 2 Minutes

The emails had subject lines that would be enticing to job hunters hoping to get noticed, like, “Who’s searching for you online,” “You appeared in 4 searches this week” or even “You have 1 new message,” the Egress team said.

The phishing emails themselves were convincing dupes, built in HTML templates with the LinkedIn logo, colors and icons, the report added. The scammers also name-checked well-known companies throughout the bodies of the phishing emails, including American Express and CVS Carepoint, to make the correspondence seem more legitimate, the analysts said.

Even the email’s footer lifted the company’s headquarters’ address and included “unsubscribe” links to add to the email’s authenticity, the analysts pointed out.

“You can also see the LinkedIn display name spoofing, which is designed to hide the webmail accounts used to launch the attacks,” the report said.

LinkedIn phishing email. Source: Egress.

Once the victim clicks on the malicious links in the email, they were directed to a site to harvest their LinkedIn logins and passwords.

“While the display name is always LinkedIn and the emails all follow a similar pattern, the phishing attacks are sent from different webmail addresses that have zero correlation with each other,” the analysts added. “Currently, it is unknown whether these attacks are the work of one cybercriminal or a gang operating together.”

Data Scraping Attacks on Job Seekers

Besides using potential job leads to trick targets into coughing up their credentials, Imperva, in a separate report, detailed how it stopped the largest bot attack the company has seen to date, on a global job listing site.

Imperva didn’t specifically name the company, but the company said that it was bombarded with 400 million bot requests over 400,000 unique IP addresses over four days that tried to scrape all its job seekers’ data.

The Imperva team added that these types of web-scraping attacks are common and can result in “lower conversion rates, skewed marketing analytics, decrease in SEO ranking, website latency, and even downtime (usually caused by aggressive scrapers).”

But as Imperva pointed out in its report, data scraping is one of those cybersecurity gray areas. Collecting publicly available information isn’t itself a data breach, but collected in mass quantities, it can be a weapon wielded against users in social-engineering attacks.

Last summer, a massive data-scraping attack against LinkedIn was discovered to have collected at least 1.2 billion user records that were later sold on underground forums. At the time, LinkedIn reiterated that the scraped data was public information, not private information, and didn’t qualify as a breach.

LinkedIn isn’t really at fault here, according to Yehuda Rosen, senior software engineer at nVisium.

See Also: Offensive Security Tool: Stratus Red Team

“This has little to do with LinkedIn specifically – they’re not doing anything wrong here,” Rosen explained to Threatpost. “It boils down to the fact that LinkedIn has hundreds of millions of members – many of whom are very accustomed to seeing frequent legitimate emails from LinkedIn – and may inevitably click without carefully checking that each and every email is the real deal.”

That leaves it to individual users to be mindful of the information they expose publicly and how it could be used to trick them into clicking on a malicious link.

“While I don’t believe that this will hurt LinkedIn’s brand, this does reiterate the importance of email phishing education,” Ray Kelly, with NTT Application Security, told Threatpost by email. “Given these emails are coming from a legit LinkedIn email address makes it especially difficult to identify the danger. My rule is to never click on email links. Always visit the site directly.”

See Also: How ILOVEYOU worm became the first global computer virus pandemic

Source: threatpost.com

Source Link