The pandemic opened up a new world of opportunities for many people. There’s a record number of individuals leaving their jobs in the Great Resignation. Companies face an incredible amount of their talent leaving, and the number one reason is pay.
Professionals are turning to websites like LinkedIn, looking for new jobs. But, there’s a hidden danger in the mix if you’re a job seeker. Cybercriminals are targeting people through sophisticated campaigns to have you install malware.
What’s going on?
Hackers are always thinking of new ways to harm. Employment websites like LinkedIn are the latest targets. It’s extremely easy to create a profile and make it look like you’re a professional in a specific niche. Usually, hackers represent themselves as part of HR for a particular company, and they publish fake job posts or contact users via direct messages. Here’s how the scenario usually plays out.
You receive a connection request from a recruiter that works for a renowned company that you know about. After you accept, they send you a message about a new position that would perfectly match your skills.
As you read through the requirements, it really looks like the ideal job. However, the hacker has already scanned your profile and purposefully made it that way. In addition to the message, they send you a file, usually ending with a “.exe” or a “.zip.” They claim you need to open the file to see the test trial or task.
Not expecting anything particular, you download the file and execute it. Suddenly, your computer starts to lag, and your screen freezes. The file was a backdoor trojan that started downloading even more malware files. When you allow access, multiple bad things could happen.
Your identity, credentials, and banking info can get stolen. If it’s ransomware, the hacker will ask for cash to unfreeze your device. That never happens. They could also sell your data or use the device as part of a botnet for a DDoS attack. Since thousands of people are looking for jobs, this activity is quite problematic.
What’s the solution?
You need to be extra careful when downloading files. Of course, everyone uses employment websites to find work. Conversations always start with a feeling of pressure, but you always think you’re talking to a genuine and authentic person.
Sites like LinkedIn have improved their defenses, and there are both automated and manual ways for them to look for fraudulent activity. But that doesn’t mean that some accounts won’t pass through the filters.
Be wary of files that end with “.exe” or “.zip,” especially if they have spelling errors. One of the best ways to be protected is to use a USA VPN with built-in threat protection. The VPN feature scans a file for malware whenever you select a file to download. That’s incredibly useful and could save you from a potential hack.
Another way to avoid scams is to treat the messages in your inbox as emails from an unknown source. That way, the chances of you falling for a phishing attack fall drastically. Also, accept connection requests only from people you know or have tons of mutual connections.
Can you get hacked if you click on a link?
Even though it’s not that common, you could get hacked if you click on a link. A “drive-by exploit” can do a lot of harm if you’re using older versions of browsers like Internet Explorer.
If you’re using something like Firefox, Opera, or Chrome, cybercriminals need to know something about you before launching an attack. Visiting their site and entering basic information could be enough if they’re experts. If you’re not using a VPN, they can read your IP address, which helps them immensely.
When they get your IP, they can either launch a DDoS or a MITM attack. The first one renders your device useless, while the latter is used to steal sensitive information. VPNs help because they hide your actual IP address while giving you a fake one. That way, the cybercriminal’s efforts will be in vain.
Another scenario is a fake link leading you to a spoofed version of a popular site. It will look exactly like the one you know, but when you enter your credentials, the hacker can use them to log in to your account. With access to your email account, they can enter your social media profiles and banking apps. If you don’t have two-factor authentication enabled, the attack will be like a walk in the park.
James is the head of marketing at Tamoco
