LinkedIn Users Get A 'Profile Makeover' They Never Asked For – Thanks To Hackers!

Well, according to a recent report, a wave of cyberattacks is sweeping through LinkedIn, with hackers exploiting vulnerabilities to gain control of user accounts. The situation has escalated to the point where some victims are being extorted to pay up ransom to regain access, under threat of permanent deletion.

Although LinkedIn has yet to make a public statement regarding this alarming situation, its impact has been felt worldwide in recent weeks. Conversations across social media platforms and Google search queries all point to a concerning surge in account breaches on LinkedIn. 

Coral Tayar, a security researcher at Cyberint, noted that the increased demand for LinkedIn support has led to extended response times, indicative of a troubling situation. "Search queries such as 'LinkedIn account hacked' or 'LinkedIn account recovery' have experienced a substantial upward trend… with the term 'breakout' indicating a staggering growth rate of over 5,000%," Tayar highlighted in the report.

Tayar explained, "In this case, the threat actors possibly attempted to breach accounts with two-factor authentication or tried brute-force attacks on passwords, leading LinkedIn to block these attempts."

Reports of account breaches have outlined two distinct scenarios, shedding light on LinkedIn's varying responses. In the first scenario, LinkedIn proactively takes action by temporarily locking accounts displaying suspicious activities or hacking attempts. The affected user is then notified and requested to verify their account, updating passwords to regain access. 

Expressing frustration, one affected individual vented on X (formerly Twitter), "Absolutely furious with LinkedIn right now! Fell victim to a hack and their pathetic excuse for a security system couldn't stop it. No response from them either."

Unfortunately, the second scenario paints a graver picture, where victims are locked out of their LinkedIn accounts without independent recovery. In this scenario, attackers successfully breach the account, altering the associated email address to a different one—often utilizing addresses generated via the rambler.ru email system.

So, LinkedIn has a history of attracting the attention of cybercriminals; the platform earned the unenviable distinction of being the most exploited brand in phishing attempts in 2023. This is likely due to its widespread use and recognition within the corporate sphere. 

Notably, in June 2023, the North Korean APT Lazarus was discovered employing fake LinkedIn profiles to execute a phishing campaign targeting security researchers.

In an spear-phishing attempt detected last July, LinkedIn was targeted as part of a larger scheme aimed at hijacking Facebook Business accounts for malvertising activities.