Cybersecurity researchers have unearthed a credential stealing phishing scam that’s aimed at users of the professional networking platform, LinkedIn.
The research by email security vendor Armorblox follows news of the sale of millions of scrapped LinkedIn user details on the dark web - and Preet Kumar, ArmorBlox Director of Customer Success, argues that the scraped details could be utilized to obtain login credentials from LinkedIn users.
Moreover, in what has now become a common modus operandi in phishing attacks, the whole fraudulent campaign is run via the reputable Google services, Google Forms in this case, which helps the attackers thwart most automated checks.
- Here’s our list of the best password managers
- These are the best identity management services
- We’ve also rounded up the best security keys
Legitimate scam
The phishing attack originates from a legitimate Nigerian university email account, which Kumar believes has been compromised and exploited.
Because the domain from which the email originates is legitimate, the email bypassed authentication checks and protection mechanisms like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication Reporting and Conformance).
The fraudulent email informs users that their LinkedIn account has been locked, tricking them into opening the phishing LinkedIN login page hosted on Google Forms.
“This page was hosted on Google Forms and used LinkedIn branding to get past victims’ perfunctory eye tests. Because Google Forms is ‘trusted by default’, this page bypassed any binary email security technologies that filter for known bad or suspicious links,” writes Kumar in her breakdown.
- Shield yourself with these best identity theft protection services
