Scammers are using realistic LinkedIn recruiter profiles and even verified company pages to post fake jobs that push people to off-platform sites or email addresses. The scams aim to take money (e.g., paid “resume help”) or collect sensitive personal data like driver’s licenses or Social Security numbers. A job seeker tracking these schemes says some attackers hijack dormant verified accounts to look legitimate while targeting applicants.
Scammers built out fake job listings across LinkedIn using several tactics at once. Some created polished recruiter profiles from scratch, often in batches using copied photos and similar account details, to reach out to job seekers directly. Others went further and hijacked dormant, verified LinkedIn accounts, changing the work history to make the account holder appear to be a recruiter for a legitimate business. A third approach placed fraudulent job ads directly on legitimate, verified company pages, then routed applicants to outside websites or email addresses that had nothing to do with the real employer.
The scams worked because they borrowed credibility from real platforms and real companies. A verified company page or a recruiter profile with a professional photo and consistent details reads as trustworthy to most job seekers, especially those who are recently laid off or applying for entry-level roles and eager to respond quickly. Attackers reportedly used AI to tailor job pitches to a person's résumé or career history, making outreach feel personalized rather than generic. Because verification does not guarantee legitimacy, applicants had little reliable way to distinguish a real recruiter from a fake one just by looking at a profile.
Organizations and job seekers can reduce exposure to these scams with a few consistent habits:
HR, recruiting, and brand protection teams also have a role to play by monitoring for spoofed listings tied to their company name and by educating applicants on the official channels used for real job postings.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They use polished recruiter profiles, copied photos, and in some cases hijacked dormant verified accounts or even legitimate verified company pages to make fraudulent postings appear trustworthy.
Some scams charge a fee for supposed resume help, while others try to collect high-value personal data such as a driver's license or Social Security number.
No. Verification is a trust signal, not proof of legitimacy, since scammers can still create convincing profiles or take over verified accounts.
Unsolicited resume criticism paired with a payment request, links to external sites not affiliated with the employer, and instructions to email a resume to an outside address instead of using the official careers portal.
That “perfect” LinkedIn job from a verified company page? It might be one of 60,000 fake listings built to drain you, not hire you. Scammers hijack or copy recruiter profiles, even on verified company pages, then post roles like data-entry or customer service that send you to an outside site or email. Next, the 'recruiter' says your résumé needs work and offers paid help or asks for your driver’s license or Social Security number. Here’s the twist: LinkedIn verification and slick AI-written messages make this look real. But the tell is the path. If a verified page sends you to a site not affiliated with the company, or a recruiter wants to move fast, go off LinkedIn, and get paid to 'fix' your résumé, it’s a scam. One move: before you click or pay, pause and independently check that job and recruiter on the company’s official careers site, if it’s not there, walk away.
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
Anthropic reports multiple real-world threat groups used Claude to support cyber operations, including credential harvesting and data theft across many victims. The report includes specific, simulation-ready lures such as a fake ESET NOD32 login portal that sends stolen passwords to Telegram and a…
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
Proofpoint reported at least four espionage groups (mostly linked to Chinese state intelligence) using the same Chrome zero-day exploit kit (“BlueMoon”) to compromise victims and deliver malware. The operations used believable business and event-themed lures (internship inquiries, procurement…
