LinkedIn Impersonated in Identity Theft Scheme

January 27, 2021

In a recent attack uncovered by Abnormal Security, the attacker impersonates LinkedIn to send a malicious attachment that could lead to identity theft. Once the attachment is opened, the victim is asked to put in personal identifying information, including their social security number.

Summary of Attack Target

Abnormal Security first observed this attack targeting one of our customers.

  • Platform: Office 365
  • Victims: Executives and VIPs
  • Payload: Malicious Attachment
  • Technique: Name Impersonation

LinkedIn Impersonated in Original Attack

In this attack, the recipient receives an email from what appears to be LinkedIn, at least according to the display name. The email contains only an HTM attachment named “PolicyChange2845,” prompting the recipient to open the file. At first glance, the recipient may think that this is a policy change notification coming from LinkedIn. The email subject states “Changes that affect you,” increasing the urgency to open the attachment.

However, when taking a closer look, we can see that while the display name is LinkedIn, the actual sending email address is ‘,’ which has no relation to LinkedIn. The attacker is using name impersonation in hopes of deceiving the recipient.

When opening the attachment, the recipient is asked to complete a form that looks similar to the LinkedIn login or sign-up page. This form contains boxes to input the recipient’s name, social security number, date of birth, and driver’s license number. Meanwhile, the legitimate LinkedIn site would only ask for an email and password to login.

If the recipient of this email falls victim to this attack and fills out the form they are prompted with, they will have released extremely sensitive information to the attacker. The attacker would not only have their name and date of birth, but also their social security number and driver’s license information—all of which can quickly lead to identity theft.

Why This Attack Bypassed Traditional Security

Because this attack does not contain a traditionally malicious attachment, it would likely bypass a secure email gateway that would look for malware hidden within the attachment. Instead, this attack uses urgency and credential phishing to encourage someone to open the attachment and complete the form.

By understanding identity and impersonation, Abnormal Security is able to detect the nature of the message and understands that it is likely dangerous—despite not containing malicious code. Further analysis of the text within the email also indicates that the body contains text and spaces with a size zero font, a common pattern that we've observed in email attacks.

Taken together, Abnormal has enough signals to mark this email as an attack, and prevent it from reaching end users.

Curious how Abnormal can stop name impersonation and prevent your end users from becoming victims of identity theft? Request a demo for a full overview.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More