Over the past two weeks, I have been made aware of four cases of suspected social engineering attempts initiated through LinkedIn messaging. I was also contacted and decided to investigate and document the attacker's playbook.
How the attack typically unfolds
🔹 Step 1 – Initial LinkedIn Contact
The attacker starts with a seemingly legitimate conversation on LinkedIn.
🔹 Step 2 – Meeting Invitation
They then send a meeting invitation, often through a scheduling platform such as Calendly.
🔹 Step 3 – The Video Call
When you join the meeting, you may notice that the person appears to be working from a noisy call center environment. In my case, and according to others who reported similar encounters, the caller spoke with a Chinese accent.
Warning Signs 🚩
🚩 No camera
The caller refuses to turn on their camera, usually claiming to have technical issues.
🚩 Personal email address
Communication takes place from a Gmail account or another personal email address instead of a corporate domain.
🚩 Screen-sharing requests
They ask you to share your screen. When I asked them to share theirs, they claimed they were unable to do so because of technical problems.
🚩 Excessive praise
The conversation often revolves around technology-related topics. Even when I deliberately provided completely incorrect and nonsensical answers, I was repeatedly complimented on my expertise.
The End Goal
The next stage of the attack appears to involve sending links to fraudulent websites and encouraging victims to install code or software.
At that point, I felt I had gathered enough information about the scam.
When I informed the caller that I was aware the websites were fraudulent and that I intended to write about the experience, the meeting was immediately terminated.
Stay Vigilant
If someone you have only just met on LinkedIn:
Invites you to an off-platform meeting Refuses to use video Uses a personal email account Requests screen sharing Pushes you towards downloading software…treat the interaction with extreme caution.
Top comments (0)