Hackers using LinkedIn’s chat and job posting tools to steal users’ data

Microsoft-owned LinkedIn is being used by hackers to spread data stealing malware via sending connection requests in disguise of people working with reputed companies. Researchers from AI Cybersecurity firm CloudSEK found that scammers are exploiting LinkedIn’s chat and job posting features to share links/files that are laced with stealer malware.

Once opened, a stealer malware is deployed on the victim’s system, from which it steals passwords, credit card information, and other sensitive data, and sends it to the threat actors. The stolen credentials are then used to compromise and take over the victim’s social media and email accounts.

Scammers can easily make connections and build credibility on the platform as most LinkedIn users accept any and all connection requests they receive. The actors then share malicious files and links, which are then opened by unsuspecting victims.

The connection shares a URL or a zip file with the information stealer embedded. The file size is usually restricted to 100MB to evade antivirus or security tools. Rahul Sasi, CEO and Founder of CloudSEK, said that the underlying promise of professionalism makes it easier for scammers to run campaigns at scale on the platform.

Users are recommended to verify connection requests before accepting them, even if the requester is connected to someone you know. Users should also scan documents and files shared on LinkedIn, before opening them on their systems.