1

I get a steady stream of phishing emails but this one is really weird. I keep getting an email that appears extremely legitimate from Linkedin. I knew something was wrong with it however because it came to an address I do not use for Linkedin and moreover the person who was supposedly requesting the connection says she never sent it, so it would appear to be a forgery. The email address was known to my counterparty, so it is possible her computer is hacked and they vacuumed her email address book to get my address.

The only problem is that the clickable link in the email does appear to go to Linkedin. Here is the link (edited slight to invalidate the tokens):

https://www.linkedin.com/comm/start/accept-invitation?sharedKey=z65BZQRm&invitationId=6182181234249090451&trk=eml-first_guest_reminder_01-hero-2-accept_button&trkEmail=eml-first_guest_reminder_01-hero-2-accept_button-null-bsjb8a%7Fjwf76e8g%7E5g

Since this link does appear to be going to Linkedin (not the usual Russian proxy), how can the phisher possibly be using it?

Tyler Durden
  • 1,116
  • 1
  • 9
  • 18
  • Is this question's discussion relatable to yours: http://security.stackexchange.com/questions/122496/how-are-spammers-using-linkedin-http-linkedin-com-slinkcode-urls ? – Limit Dec 08 '16 at 04:06
  • @Limit That is interesting, but the other question involves an slink parameter, which is apparently a type of LinkedIn redirect. In my case, it does not appear to be a redirect. – Tyler Durden Dec 08 '16 at 04:25
  • true. I noticed lots of LinkedIn spams being some variant of slink problem so wondered if this would help you. – Limit Dec 08 '16 at 07:02

1 Answers1

1

If you have verified that this email actually comes from LinkedIn, then the spoofing is likely on the other side: somebody pretending to be your friend wanted to connect to you, possibly to better impersonate that friend or to otherwise traverse their (or your) professional networks.

From there, they can launch a more sophisticated attack (think APT or BEC).

Adam Katz
  • 9,718
  • 2
  • 22
  • 44