Attackers are distributing malware through spoofed LinkedIn job postings, using a social engineering technique to trick job seekers into downloading malicious files that establish system backdoors.
Security researchers discovered a campaign distributing backdoored files through counterfeit LinkedIn job offers. The attack exploits job seekers' trust in the platform by creating fake recruiter accounts and posting legitimate-looking positions.
The malware is delivered through file attachments or download links embedded in job descriptions. When victims execute the files, attackers gain persistent backdoor access to compromised systems. The files typically masquerade as job applications, contracts, or qualification tests.
This attack vector capitalizes on multiple psychological and technical factors. Job seekers are primed to act quickly and trust major platforms like LinkedIn. The urgency of job hunting overrides security caution. Additionally, the backdoor installation occurs before security software can detect malicious behavior.
The campaign targets users across various sectors. Attackers customize job listings to match victim profiles, increasing success rates. LinkedIn job posts lack the friction of traditional email spam filters, making the platform an effective distribution channel.
Researchers recommend several defensive practices:
- Verify recruiter legitimacy directly through LinkedIn profiles and company websites
- Avoid downloading files from unsolicited job offers
- Use separate systems for job applications when possible
- Maintain updated antivirus and endpoint protection software
- Monitor accounts for unauthorized access attempts
LinkedIn has not issued a specific statement about this campaign. The platform's trust model depends on verified accounts, yet attackers continue finding ways to exploit user expectations.
The incident highlights risks in digital job markets where convenience and scale create vulnerabilities. As remote work grows, job-related phishing becomes increasingly profitable for criminals. Security awareness training should emphasize verification steps before interacting with unsolicited recruitment offers, regardless of platform reputation.
Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.
Two security researchers purchased commonly-used generic email domains and discovered hundreds of companies automatically sending sensitive corporate data to their listening services. The experiment reveals a widespread failure in email configuration practices across organizations.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.