A new wave of LinkedIn impersonation scams is hitting organisations, and many are not prepared for it. In a recent campaign, attackers sent highly tailored LinkedIn messages to executives, especially finance leaders, posing as investors or board members offering an “exciting” opportunity.
The messages come from well-curated, credible profiles with many mutual connections, increasing the likelihood of busy executives following through on the request without much thought.
Organisations have very little control over what goes on LinkedIn or other social platforms, creating a visibility gap that allows attackers to reach employees easily.
LinkedIn is becoming a prime initial access vector
Unlike email, which has multiple layers of filtering, blocklists, and authentication checks standing in the way, LinkedIn allows anyone to be messaged without much approval or verification. There are no restrictions for messages from new profiles, which means attackers can spin up fake profiles at scale and start reaching real employees immediately, without triggering security controls.
Another factor that works in favour of attackers is the availability of private information that users share voluntarily on the platform. There is specific info about their roles, responsibilities, and some projects they are involved in.
With these details, cybercriminals create highly targeted lures for high-value targets, rather than sending mass phishing emails that are easy to detect and ignore. The more detailed and relevant the messaging is, the more likely it is for busy executives to assume that the request is legitimate and click through.
All of these factors turn LinkedIn into a prime initial access vector that phishing operators will surely look to exploit more.
From fake invitations to full session takeover
What happens after the connection request and message is what can turn these scams from impersonation attempts into full-scale account compromises. The messages usually contain a link that sends the victim through several redirects before landing on a fake Microsoft login page designed to steal credentials or capture active session cookies.
The fake login pages copy branding, URL patterns, and layout elements perfectly, so users rarely stop to question their authenticity. Inconsistencies are even more difficult to spot on mobile, where many users live in the LinkedIn app.
When the victim enters their credentials, the attacker intercepts them, or in more advanced setups, steals the victim’s active session cookie. The technique is known as an Adversary-in-the-Middle (AiTM) attack, allowing the attacker to completely bypass MFA and step directly into the user’s Microsoft 365 environment.
From there, the impact can escalate quickly, especially if the criminals get their hands on a highly privileged account. They can gather data from the mailbox, access connected apps, or even move laterally in the environment to escalate privileges.
In some cases, attackers also use the compromised account to send additional phishing messages internally or respond to existing email threads, a tactic known as thread hijacking.
How to gain visibility of impersonation risks
As LinkedIn and other social platforms become increasingly attractive initial access vectors, organisations need better visibility into impersonation attempts and the downstream risks they bring. While it will be difficult to implement security controls inside LinkedIn, organisations can still control what happens when an employee clicks on a phishing link.
Attackers rely heavily on lookalike domains and cloned login pages mimicking corporate portals with near-perfect accuracy. These are almost impossible for employees to detect at a glance.
However, there are security platforms designed to tackle such threats. Memcyco, for example, gives security teams real-time visibility into website impersonation activity, which is where most LinkedIn phishing lures ultimately land. As soon as an employee lands on a fake login page, Memcyco immediately flags the spoofed site and alerts security teams, showing whether the user interacted with the page. It’s an efficient way to regain part of the visibility that is lost due to the nature of external platforms like LinkedIn.
Complementary identity security tools, like Okta’s Adaptive MFA and risk-based authentication features, further compensate for the lack of visibility by evaluating user context for each login before granting access. This includes analysing any device, location, IP reputation, or behavioural anomalies. Monitoring for such anomalies helps detect compromised sessions early before they escalate into larger incidents.
Users can implement immediate account lockout if a login comes from a suspicious or malicious source via Microsoft Entra ID’s risk-based policies.
Final thoughts
Not many in cybersecurity are talking about social media as an enterprise risk, but platforms like LinkedIn serve increasingly as the starting point for sophisticated and targeted impersonation attacks.
The latest campaigns should serve as a wake-up call to the fact that there are attack surfaces operating outside the areas most security teams control. These exposures require tools and processes for identifying impersonation attempts early and stopping them before they result in full account compromises.
Image source: Unsplash
