Job Recruitment Scams Rising Due to Social Engineering
Job scams are a rising form of socially engineered cybercrime. And while it’s easy to imagine the trouble they cause individuals who innocently fall for them (lost opportunities, identity theft, financial loss, and so on) this form of fraud also affects businesses.
Suppose your employees are looking at the job market. They’ll do that, whether they intend to leave or not, and they’re especially likely to do so when they’re working remotely, from home. Should job browsers be successfully compromised, they place their employer at risk of infection as well. Security Intelligence explains, “Many job seekers look to sites such as Indeed, LinkedIn, ZipRecruiter, Flexjobs and Craigslist to find employment. Freelancers also look for work on sites like Upwork, Fiverr and Freelancer.com. However, these platforms have no easy way to identify infiltrators posting fake job listings. Some job seekers might even receive a phishing email with a fake job offer that looks legitimate.”
The article notes that companies which participate in the gig economy are particularly vulnerable from that quarter as well.
One of the threat actors making heavy use of job recruitment scams is UNC2970, a North Korean organization. Like other North Korean threat groups, it’s state directed and mixes espionage with hacking-for-profit. The profit is also sought on behalf of the state, helping to redress the pariah state’s chronic financial shortfalls. In the job recruitment scams, the phish hook is a backdoor that’s subsequently used for a range of malicious post-exploitation activities.
Security Intelligence closes with some advice. “Looking for a new job is stressful, and threat groups have made it even more challenging. Now more than ever, it’s critical to be aware of these threats. From the individual looking for gainful employment to enterprises assessing their risks, it’s time to raise awareness about job recruitment scams.”
New school security awareness training can help employees learn to recognize and fend off the approaches designed to lure job-seekers.
Security Intelligence has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW