Fake LinkedIn emails phishing job seekers

Fake LinkedIn emails are hitting inboxes, trying to get recipients to hand over their CVs.

The scammers are trying to impersonate the popular employment-oriented social networking service, but careful users will immediately spot many things that point to the email being fake:

• The email sender address that has nothing to do with LinkedIn
• The lack of certain design elements and the “unsubscribe” footer usually contained in LinkedIn emails
• The email not addressing the recipient by name
• A sense of urgency that the email is designed to create
• Typos, and so on.

Unfortunately, there are always some users that will fail to spot any of these red flags, and will click on the offered links. They will be taken to a website where they are instructed to upload their CVs.

The site (at ) to which the initial emails pointed to has already been taken down, but you can be sure that the scammers have already set up new ones, and changed the link in subsequently sent emails.

“Your CV contains a wealth of personal data which a cybercriminal uses to make a profit at your expense,” Heimdal Security’s Paul Cucu explains.

“Phone numbers can be sold for companies doing promotional cold calling. Or, the cybercriminal might call you himself in a vishing attack. In other cases, he might use the information for identity theft, using the companies you worked at or attached references as a cover for fraudulent activities.”

Or, the scammer could use the info to craft believable spear-phishing emails targeting the person’s current or former employers or colleagues.

Total Defense warns about other dangers and typical scams aimed at job seekers:

• Insecure sites (no HTTPS to protect the information inputed into job application forms)
• Follow-up emails soliciting more sensitive information (e.g. bank account number to set up direct deposit)
• Too good to be true job offers that involve a high hourly fee for simple work that can be performed from home
• Non-existing companies contacting users directly with job offers for which they haven’t even applied (as in this last LinkedIn scam),