LinkedIn has a few new problems with the recent hack of their paid InMail service. Users beware: links within the popular networking site may be malicious. Learn more and protect yourself from this recent threat.  

LinkedIn is known as one of the most popular social networking sites in the world, but right now it’s getting press for something much more dangerous: a new phishing attack coming through LinkedIn’s in-network email platform called InMail. The paid service purportedly allows organizations or individuals to connect with others in a secure way without violating privacy laws and giving out personal or work email addresses, as all communication is completed within the LinkedIn platform. Few LinkedIn users would expect a virus-infested InMail message, simply because many know that the service costs the sender a fee. This makes it that much worse to discover that hackers have infiltrated paid versions of the prominent platform to spread malware.

Phishing for Personal Information

Phishing attacks are one of the most common forms of hacking and have been scamming users out of personal information such as credit card details, login information and personal details for many years now. Phishing works generally by spoofing information to make their links and websites appear legitimate at a glance or too unsophisticated users, or by fraudulently utilizing major brand names in their messaging. For instance, Amazon.com buyers may receive an email that appears to be from Amazon asking users to log in and update their personal information or reset their password, the link actually goes to a different site controlled by the hackers. Security researchers estimate that there are over 100 million phishing attacks carried out every day, making it difficult for busy users to analyze each message that appears in their inbox. Unwary consumers are often attracted to offers that are better than expected, such as a bank or eCommerce site sending an email stating that there has been an overpayment and requesting that users log in to claim their funds.

Corporate Phishing

Phishing attacks on businesses can be even more subtle and include attachments from a trusted vendor whose information happens to be in your email address book. These attachments can launch malware that harvests personal or corporate data, which is then dispatched to the hackers via the internet. Microsoft Office documents are a literal playground for hackers, with the ability to pump macros into a seemingly-safe document that launches malware as soon as macros are enabled by the recipient. Corporate phishing has been occurring since the mid-1990s and continues to grow and expand as business users grow more distracted and hackers grow in sophistication.

Staying Safe from Phishing

There are a variety of giveaways with phishing, and one of the easiest in the past has been to look for obvious spelling and grammar mistakes. This is not to say that legitimate emails are perfect — many are far from it — but hacking emails do tend to have obvious misspellings or what appears to be errors in translation with transposed words or letters. This may be because the vast quantity of phishing attacks originate outside the United States. Another key way to spot a phishing attack is when you receive an email or push notification message from an organization that you don’t currently do business with, such as a different credit card or banking system than you use. If you have any question whatsoever about the security of a message, navigate to that organization’s homepage instead of clicking a link. Even a Google search may lead you down a dangerous path if you’re not careful to watch the actual URL that you are visiting. Finally, it’s a dead giveaway when you hover over a link and see that the visible link and the “hidden” link that you will actually visit do not match or have different domains. These spoofed URLs may look accurate at first glance but look closely to ensure the key domain is accurate before clicking. A good rule of thumb is that if something sounds too good to be true — it probably is!

Cleaning Up After an Attack

If you find that you or someone in your organization has clicked through and been the victim of a phishing attack, there are several steps that you can take to attempt to secure your accounts and information. First, change any passwords that you feel may have been affected. This is particularly important if you clicked through to what you thought was a financial services site and entered any personal financial account information. Run a credit report and check your bank account regularly for several weeks to several months, looking for unusual activity. Sometimes, hackers will test your accounts by putting through small transactions — even canceling the transactions before money is removed from your account — before going for a larger purchase. Scan all computers attached to the affected computer for viruses, and ensure that all anti-malware software is up-to-date.

The recent attack through LinkedIn shows that even the most secure-seeming platforms can be infiltrated by cybercriminals, and the only way to stay safe online is through continuous vigilance and a concerted effort to maintain strict anti-virus and anti-malware software. Ongoing communication with business users as well as training on how to avoid being the target of a phishing expedition can also help businesses keep their customer data and systems safe. Contact Vertical IT today at (888) 505-8215 or via email to info@verticalitcorp.com to learn more about best practices to avoid malware and phishing attacks. Our active monitoring provides you with the peace of mind knowing that your sensitive systems are always under review and that any potential attacks are caught quickly and remediation applied as soon as possible.