LinkedIn Has Become a Prime Target for Phishing Attacks

Phishing attacks have evolved and are no longer limited to our email inboxes. In fact, one-third of these attacks now occur on non-email-based platforms like social media, search engines, and messaging apps. LinkedIn, in particular, has become a major target for phishing. And there are several compelling reasons for the growing threat of LinkedIn phishing.

LinkedIn phishing is a serious concern for businesses, and here are five key reasons why attackers are turning to this platform. 

1: Bypassing Traditional Email Security Defenses

LinkedIn Direct Messages and DMs easily bypass the email security tools that many organizations rely on for phishing protection. Employees frequently use LinkedIn at work, but security teams are unaware of these communications.

This means outsiders can send messages to employees at work without any email interception. Modern phishing kits employ a range of techniques to evade detection, including obfuscation and anti-analysis methods. These tools can bypass anti-phishing controls based on web page inspection or web traffic analysis. As a result, organizations rely heavily on user training and reporting for their primary security, which is far from ideal.

Even when users report LinkedIn phishing, organizations face challenges. They cannot see which other accounts were targeted or affected. Unlike email, there is no way to recall or quarantine messages for multiple users. Organizations often resort to URL blocking, but this is ineffective because attackers rapidly change their phishing domains. It is cost-effective and scalable for attackers.

2: LinkedIn Attacks Are Easier and Faster Than Email Phishing

Phishing on LinkedIn is more accessible than email-based attacks. With email, attackers must create domains and go through a warm-up period to build domain reputation and pass mail filters. On LinkedIn, it is easier to hijack legitimate accounts. Because 60% of the credentials in Infostula logs are linked to social media accounts, many of which lack MFA.

It provides attackers with a reliable launchpad, allowing them to exploit existing networks and trust. By combining account hijacking with AI-powered direct messages, attackers can easily expand their LinkedIn reach. Easy access to high-value targets. LinkedIn Recon is straightforward for attackers. It’s easy to map an organization’s profile and select suitable targets.

3: Easy Access to High-Value Targets

LinkedIn is a top tool for red teamers and attackers when searching for potential social engineering targets. Job roles and descriptions provide information on accounts with the necessary access and privileges for successful attacks. There’s no screening or filtering of LinkedIn messages, no spam protection, and no assistants monitoring inboxes.

4: Higher Success Rate Compared to Email Phishing

It’s a direct route to the intended contacts, making it an ideal platform for highly targeted spear phishing attacks. The likelihood of success increases. The nature of professional networking apps like LinkedIn makes users more vulnerable to phishing attempts. Executives are more likely to open and respond to LinkedIn DMs than any other spam email.

When combined with account hijacking, messages from known contacts are even more likely to receive a response, similar to the takeover of an existing business contact’s email account, which has led to numerous data breaches. 

With the right pretext, the likelihood of success is significantly higher. The potential rewards are enormous. Despite occurring on individual apps, the impact of these attacks is not limited. Most phishing attacks target core enterprise cloud platforms like Microsoft and Google or specialist identity providers like Okta. Compromising one of these accounts not only provides access to key apps and data within the associated app but also to the data itself.

This gives the attacker access to nearly every core business function and data set. From there, it becomes easy to target other users of these internal apps using technologies like business messaging apps or SAM. With executive staff monitored, the leverage can be substantial, leading to business breaches worth millions of dollars.

5: A Single LinkedIn Breach Can Impact the Entire Enterprise

Even if an attacker gains access to an employee’s personal device, it could compromise a corporate account. For example, in the 2023 Okta breach, an attacker exploited an Okta employee who was signed into a personal Google profile on their work device and synced their credentials to their personal device, including credentials for 134 customer tenants.

When their personal device was compromised, their work account was also compromised. Widespread impact. With decentralized internet apps and various communication channels beyond email in modern work, preventing users from interacting with malicious content is becoming increasingly challenging. Attackers can send links through instant messenger apps, social media, SMS, malicious ads, and in-app messengers, as well as send emails directly from SAS services to bypass email verification.

6: Multichannel Threats Make Defense More Difficult

Now, every enterprise has hundreds of apps available with varying account security configurations. To protect against these emerging threats, organizations need a solution that can detect and block phishing across all apps and delivery vectors. 

LinkedIn phishing is a growing and serious cyber threat.

LinkedIn phishing is on the rise because it gives attackers:

Direct access to high-value individuals

No email filters or security layers

Trusted hijacked accounts

AI-driven, personalized messages

This combination makes LinkedIn one of the most dangerous platforms for modern phishing attacks.

To stay safe, organizations must adopt a multi-channel phishing protection strategy that can detect threats across all apps and communication channels – not just email.