A Growing Goldmine: Your LinkedIn Data Abused for Cybercrime

How data is stolen

This section provides a brief rundown on some of the most common techniques cybercriminals and threat actors abuse to collect and steal users' personally identifiable information (PII) from LinkedIn and other websites such as social media and networking platforms. Three of the most popular methods include:

• A criminal can exploit all scraped data for ill-intended purposes. Having a large amount of information at their disposal can allow threat actors to craft sophisticated attacks. It is not easy for a user to defend against scraping, but being mindful of what you share to the public can reduce the risks of having personal details used against you.
• A data breach occurs when the platform gets compromised by criminals with the aim of stealing confidential data. This data is then sold or used to gain access to key profiles to continue with attacks.
• Phishing is the most common way to get access to account credentials. The victim is deceived or forced to click on a link, which will bring or redirect them to a fake login page of the service. LinkedIn, much like other social networks, can be a valuable target platform for abuse due to the ease in coming up with a fictitious story as a lure to gain victims’ legitimate account credentials, among other PII.

How data can be used against users

Criminals can weaponize data in several ways. Having a thorough background knowledge of the target can easily lead to a sophisticated, tailored attack that will likely succeed. For example, knowing that a user wants to change jobs, is unhappy with the current employer, or is looking for a particular job, could allow a fake recruiter profile to induce the user to send their curriculum vitae filled with personal information, open malicious files, or fill in some forms. Moreover, if the criminals have access to a LinkedIn profile, they can have access to privileged connections depending on the kind of professional targeted.

In general, the more information the criminals have, the more knowledge they can leverage against the target. In having valuable stolen accounts, these profiles can bring threat actors a step forward to gaining a victim’s trust.

How data can be used against the respective employers

LinkedIn end users are not the only targets of campaigns developed using data gathered on the platform; employers can also be victims. In most cases, the first step in an attack kill chain is reconnaissance and gaining as much information as possible. Details shared by employees can be accidental data disclosures on how the company operates. While posted and done without malicious intent, it is still a leak of information that can offer strategic advantages to criminals. Gaining extensive company information or access to compromised LinkedIn accounts can be abused to gain trust among other people in the target company. At this point, malicious actors can achieve almost anything by sending malicious files to the right employee, allowing them to spread malware, steal information, or — eventually — even hold the organization’s data for ransom.

Databases of PII and credentials

Databases of LinkedIn data are often shared for free, though some forums require users to purchase credits to access download links. On average, these credits cost around US$10. In 2012, LinkedIn was breached, and the database from this intrusion is still offered for free in 2022. More specific databases, such as those divided by country or by year, can be found at a higher price of up to US$1,500.

Databases offered in the underground are often from breaches or scraping that occurred over the years. In April 2021, LinkedIn suffered a data leak that exposed personal information of over 700 million (92%) of its 756 million users.

To summarize some offers we found in underground forums:

• February 2021: A threat actor advertised a database of over 500 million LinkedIn accounts for sale on the now defunct Raid Forums, filtered by country.
• July 2021: An actor offered a 2021 database of 530 million users for $1,500 on Exploit, a Russian-based forum.
• July 2021: A cybercriminal hacked into LinkedIn’s API of 700 million LinkedIn users in 2021 and listed it for $5,000.
• August 2021: A data broker auctioned off 700 million LinkedIn records starting at $400 on Exploit (Figure 1).
• November 2022: An actor was selling what was allegedly the full 2022 LinkedIn database for $1,500 in forum breached[.]to.

New and aged accounts

As LinkedIn enforced stricter antifraud and account verification policies when registering a new profile, there is now a demand for new and aged compromised user accounts, or fake accounts created using fraudulent verification data, in the cybercriminal underground. A new account is a recently created profile that can have some connections. These new accounts are also usually empty, with no (or limited) information but have all the verification data required to be considered real.

On the other hand, aged accounts are accounts that have been registered for months or are a few years old (the average aged account is around five years old). These aged accounts have connections, basic interactions, and a verified phone number. These profiles are considered more valuable because they are less likely to be banned. Aged accounts are from breached data, scraped, or accounts compromised through spear phishing, but can also be created and aged with the aim to sell later.

New and aged accounts can be sold individually for an average price of $15, or sold in bulk. We often see forum users posting a request for a specific country or job title. Accounts are also listed by gender, though this distinction does not appear to influence the price.

Some forum posts include links to Storefront, a page dedicated to selling several social network accounts, including LinkedIn users’ accounts. The price ranges from $8 to $200, depending on the number of accounts needed.

LinkedIn Premium accounts

LinkedIn offers options for different premium plans to upgrade personal profiles and enable advanced features. A parallel market in the underground exists for upgraded plans, each aimed to access different kinds and ranks of professionals.

These feature upgrades are offered for a ridiculously cheap price with respect to the real one. Malicious actors go for these upgrades because they allow users to send a vast number of messages, even to people outside the user’s network. InMail message is a premium feature, and it allows the user to directly message another LinkedIn member to whom a user profile is not connected. The profile is allotted a specific number of InMail message credits based on the subscription type, providing a large base for phishing attacks. Moreover, having a profile with these kinds of upgrades makes the account more flexible.

A Recruiter Lite account upgrade can be exploited in various ways. Since most of the conversations and exchanges a professional can have with a recruiter involve personal data, sending and receiving files, filling out online forms and so on, this can be a significant advantage for an attacker. Having a profile flagged as a recruiter can lead people to send their CVs without second-guessing the authenticity of the receiving account. On the other hand, it allows an attacker to search for precise requirements and details about the potential victim, opening users and organizations for a highly targeted attack. Users are more likely to follow a link or open a file sent to them through a recruiter’s account. We found a thread in an English-based forum where a malicious actor described how valuable it was to have a Recruiter account. The actor's inbox was flooded with resumes from people who blindly sent them just because it had a title of “Recruiter” on the profile.

Another advanced feature is the Sales Navigator, which allows users to conduct as many targeted audience searches as possible with all the available tools. Subscribers of the feature can narrow down search details by using filters, and will be informed of any changes in leadership, features, functions, or responsibilities. For illicit purposes, these features would also be good for a cybercriminal targeting a specific member of a company for deploying attacks with social engineering methods, such as fraud or ransomware. To offer these competitive prices, cybercriminal underground sellers use a discount code or stolen credit cards to offer lower prices than that of LinkedIn. Table 3 compares the prices advertised in the underground and the official prices.

How to monetize a considerable number of accounts

We found a post explaining in detail how to monetize many accounts by taking advantage of the accounts to create high engagement on posts and profiles of interest. The engagement rate is an important coefficient in social networks like LinkedIn or Instagram: the algorithm considers a profile more interesting (and more likely to promote it) if it has more interactions.

The method involves some fake accounts that, thanks to some scripts, will perform all the necessary actions to boost the target page. First, these fake users need to have a lot of connections so the threat actors can use automated tools to connect with as many profiles as they can. Then, the fake profile will spam their connections with messages to ask for likes, follows, and comments on specific pieces of content. These interactions make it possible to boost the page’s engagement rate. This service is sold in the underground for a subscription that costs around $100.

Cybercriminals take advantage of a group of LinkedIn users called LinkedIn Open Networkers (more popularly known as LION). These users connect with anyone regardless of their lack of familiarity or interest to the user, asking for the connection but are not necessarily malicious. In this manner, it is easy to rapidly increase the number of connections. We found an example of two of these accounts. LinkedIn does not consider LION accounts illegal; they are not new and have been around since 2011, and typically have “LION” or “L.I.O.N.” on their respective biographies. Underground forums often post links to LION accounts for others to use.

Additional LinkedIn services

In addition to LinkedIn accounts sold in the underground, we found other services that serve as tools for malicious activities that take advantage of the platform. Several actors offered phishing LinkedIn users as a service ranging from $150 to 400, depending on the number of emails the user wanted to send, and for the period ranging between 10 to 31 days.

We often see advertisements looking for LinkedIn experts, such as communications or marketers, to help in special projects. According to these ads, projects include filling out profiles, advertising on sites, and creating traffic to phishing sites. Pricing is not discussed in the advertisement and is negotiated via private messages.

As Steven continued with his phishing activities targeting high-level executives, he found a new victim: a successful businesswoman named Alice. He spent weeks studying her online profile and posts, and what he found made him think he had the biggest target he’s ever had. Steven thought this single scam would be enough to set up his family for the rest of their lives, and promised his wife this would be his last attack.

However, Alice is an acute tech user who had security software installed on her device.

In his home office, Steven crafted the message with the phishing URL and sent it to Alice. He was happy and satisfied, having spent weeks researching for vulnerabilities in Alice and her company, and deployed the attack that he thought was the most sophisticated he’s crafted yet. Sure of his success, Steven turned off his computer and went to pick up his kids from school.

Unbeknownst to Steven, Alice’s security solution immediately blocked his message and flagged the link as a phishing email, effectively killing the attack.