You can post LinkedIn jobs as ANY employer — so can attackers

guest · Aug 19, 2021

You can post LinkedIn jobs as ANY employer — so can attackers
August 19, 2021
https://www.bleepingcomputer.com/ne...nkedin-jobs-as-any-employer-so-can-attackers/

EXCLUSIVE: Anyone can create a job listing on the leading recruitment platform LinkedIn on behalf of any employer—no verification needed.

And worse, the employer cannot easily take these down.
Now, that might be nothing new, the feature and lax verification on career websites pave the ways for attackers to post bogus listings for malicious purposes.

The attackers can, for example, then use this social engineering tactic to collect personal information and resumes from professionals who believe they are applying to a legitimate company, without realizing their data may be sold or used for phishing scams.
Click to expand...

We are hiring! Oh wait...
This week, Harman Singh, a security expert and managing consultant at Cyphere, shared a "feature" with BleepingComputer that was quite unsettling for him to come across.

"Anyone can post a job under a company's LinkedIn account and it appears exactly the same as a job advertised by a company."
In tests by BleepingComputer, I used an unaffiliated LinkedIn account and was able to successfully publish a new job posting on behalf of BleepingComputer, almost anonymously.
Click to expand...

Singh believes this feature has been abused in the past and could become a hotbed for phishing campaigns.

Although pen-testers and red teams can find good use of the feature, for reconnaissance and social engineering, Singh states the same feature can be misused by threat actors to target the public for various kinds of frauds and phishing scams.
Click to expand...

Log in or Sign up

You can post LinkedIn jobs as ANY employer — so can attackers

guest Guest

Log in or Sign up

You can post LinkedIn jobs as ANY employer — so can attackers

guest Guest

Useful Searches