LinkedIn Chat Leads to Screen-Share Scam Calls

How the Attack Worked

This attack breakdown describes a pattern observed across four suspected social engineering attempts, all starting with a friendly LinkedIn message. The conversation feels professional and legitimate at first, which lowers the target's guard. From there, the attacker moves quickly to schedule a meeting, often using a scheduling platform such as Calendly, shifting the interaction off LinkedIn and into a video call.

Once on the call, several suspicious behaviors emerge. The caller frequently refuses to turn on their camera, claiming unspecified technical issues. Communication often comes from a personal email address, such as Gmail, rather than a corporate domain. The attacker then asks the target to share their screen, but when asked to reciprocate, they decline, again citing technical problems. The suspected end goal is to direct the victim to fraudulent websites and encourage them to install code or software.

Why It Succeeded

The approach works because it exploits trust built through a familiar platform. LinkedIn is widely used for legitimate professional networking, so an incoming message does not immediately trigger suspicion. Excessive praise and flattery during the conversation can further disarm the target before the request to move off-platform is made. By the time screen sharing or a link is requested, the target has already invested time in what feels like a normal business interaction.

What to Watch For

• A new LinkedIn contact who quickly pushes for an off-platform meeting
• Meeting invitations sent through scheduling tools like Calendly from unfamiliar contacts
• A caller who refuses to enable their camera and cites technical issues
• Communication coming from a personal email address instead of a corporate domain
• A request to share your screen while the caller avoids sharing theirs
• Links that lead to installing software or running code

When one target confronted the caller about a suspicious website, the caller ended the meeting immediately, a behavior worth noting as a possible confirmation signal.

Building Resistance

• Treat unsolicited LinkedIn contacts who push for off-platform meetings with extra caution and verify their identity first
• Avoid screen-sharing with unknown or unverified contacts, especially if they will not reciprocate
• Insist on corporate communication channels for any business-related request rather than personal email
• Never install software or run code from links shared by new or unverified contacts, regardless of how friendly the conversation seems
• Report suspicious LinkedIn outreach that follows this chat, meeting invite, screen-share pattern to your security team

How does the LinkedIn to screen-share scam start?

It begins with a seemingly legitimate professional conversation on LinkedIn that transitions off-platform, often through a Calendly meeting invitation.

What happens during the video call in this attack?

The attacker typically refuses to turn on their camera citing technical issues, communicates from a personal email like Gmail instead of a corporate domain, and asks the target to share their screen.

What is the attacker's end goal?

The suspected end goal is to send the victim fraudulent website links and encourage them to install code or software.

How many cases were observed?

The author reported being made aware of four cases of suspected social engineering attempts initiated through LinkedIn messaging.