Scammers are using shortened LinkedIn URLs to disguise phishing links, according to Jeremy Fuchs at Avanan. LinkedIn automatically shortens links that are longer than 26 characters. The URL is shortened to a “lnkd.in” link followed by several characters. Attackers are abusing this feature to avoid detection by users and security filters.
Avanan spotted a phishing email that states, “Good afternoon. We are having a general upgrade on our new system data for 2021, and we’ll be needing your aid to rectify the missing info below so we can deliver more accurate and reliable service.” Ironically, the bottom of the email contains a warning that email fraud is on the rise, urging users to validate the source before interacting with an email.
If a user clicks on the shortened link, they’ll be sent through several redirects before landing on a phishing page that asks them to download a PDF. By using a shortened link from a legitimate service, users are less likely to be suspicious. Using multiple redirects through harmless sites helps to fool security technologies that check for phishing pages.
“This particular email can target anyone,” Fuchs says. “Though it presents itself as a standard credential harvesting and invoice scheme, the use of a LinkedIn URL may mean that any profession—the market for LinkedIn—could click. Plus, more employees have access to billing and invoice information, meaning that a spray-and-pray campaign can be effective. Whether it’s the “lnkd.in” form or the https://www.linkedin[.]com/slink?code=aB-cDeF variation, the idea is to create a link that contains a clean page, redirecting to a phishing page.”
Avanan notes that LinkedIn is among the top ten most impersonated brands in phishing attacks, so users should be on the lookout for these types of scams.
Story from Avanan.