Loading story…
LinkedIn has initiated legal action against ProAPIs Inc., a Delaware-based company, and its founder and CEO, Rahmat Alam, for orchestrating a massive data scraping operation using millions of fake accounts. The lawsuit alleges that ProAPIs created and maintained a vast network of fraudulent LinkedIn profiles to automate the extraction of member, company, and school data, as well as posts, reactions, and comments. LinkedIn claims that ProAPIs offered real-time access to this scraped data through a tool called iScrap, charging clients up to $15,000 per month for the service. The operation involved the continuous creation of hundreds or thousands of new fake accounts daily, which were used to bypass LinkedIn’s technical defenses and harvest data before being detected and restricted, often within hours. Despite LinkedIn’s efforts to block these accounts, the persistent activity allowed each fake account to scrape hundreds of profiles, contributing to a significant volume of unauthorized data collection. The lawsuit also names a Pakistan-based technical enabler, Netswift, as a party responsible for supporting the scraping activities. LinkedIn asserts that ProAPIs’ actions constitute a clear violation of its terms of service and misuse of its trademarks, as the defendants allegedly implied endorsement by LinkedIn. The company is seeking a permanent injunction to halt the scraping, deletion of all unlawfully obtained data, and monetary damages. LinkedIn emphasizes its ongoing investment in advanced technology and dedicated teams to combat unauthorized scraping and protect the integrity of its platform. The company has a history of taking aggressive legal action against scrapers, with previous lawsuits resulting in judgments prohibiting such activities. LinkedIn’s technical and human resources are regularly deployed to detect and block fake accounts, aiming to ensure that the platform remains a trusted space for professional networking. The scraping operation not only compromised user privacy but also placed additional load on LinkedIn’s servers, potentially impacting service performance. Official investigations clarified that the data involved in recent leaks originated from scraping rather than a direct security breach. LinkedIn’s legal action underscores the broader challenge faced by social networks in protecting user data from automated harvesting and the lengths to which some actors will go to circumvent platform defenses. The outcome of this lawsuit may set further precedent for how professional networks address large-scale scraping and the misuse of their services.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
LinkedIn sued ProAPIs, alleging the company used roughly 1 million fake accounts to scrape LinkedIn user data at scale as part of a paid scraping scheme reportedly worth about $15,000 per month. Multiple reports on October 6, 2025 describe the same legal action and allegations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LinkedIn faced multiple major security incidents involving both scraped profile data and compromised credentials. In one 2021 case, data from about **500 million** accounts was reported online, followed by a larger dataset allegedly covering roughly **700 million** profiles offered for sale on Raid Forums. Reports said the exposed information included public profile details such as names, job titles, locations, workplace email addresses, phone numbers, social links, dates of birth, and in some cases precise GPS data. LinkedIn said the 2021 incidents were not traditional intrusions but large-scale scraping of publicly accessible member information, potentially through abuse of its API, and maintained that no private member data was breached. Earlier, LinkedIn confirmed that a separate 2012 compromise exposed about **6 to 6.5 million** member passwords, prompting password invalidations, reset notices, and an FBI-linked investigation. Reporting said the leaked passwords were hashed but **not salted**, allowing many to be cracked more easily after being posted on a hacker site, and some decoded passwords were later published. The combined incidents raised persistent concerns that LinkedIn data could be weaponized for phishing, spam, identity theft, stalking, and account compromise, especially when profile information is paired with weakly protected credentials.
Jun 29, 2026
LinkedIn is expanding its **identity and trust** posture in response to rising AI-driven fraud, impersonation, and scams by promoting “Verified on LinkedIn” as a *portable trust signal* that can be used beyond LinkedIn itself. In an interview, LinkedIn’s VP of Trust Product described verification as a way to reduce repeated onboarding checks across services while giving other platforms an additional authenticity signal; LinkedIn reported **100M+ verified members** and a rate of **~75 verifications per minute**. Separately, technical analysis of LinkedIn’s client-side bot defenses described how its fingerprinting script attempts to detect **forged or inconsistent browser fingerprints**, including logic such as `getHasLiedOs` that compares signals like `navigator.userAgent`, `navigator.oscpu`, `navigator.platform`, and touch capability to flag mismatches indicative of spoofing. A third item (TransUnion research on gig-worker fraud and account renting) is adjacent in theme (digital trust/identity abuse) but does not describe LinkedIn’s verification program or LinkedIn’s bot-detection implementation and is best treated as separate context rather than the same specific story.
Jun 29, 2026
LinkedIn introduced identity-authentication and account-management tools aimed at limiting AI-enabled impersonation, fabricated employment histories, online manipulation, and scams. Members will be able to confirm that verified connections were colleagues or classmates during a stated period, creating peer-based confirmation of employment or education rather than a skills endorsement. A verifier must have a verified profile, have been connected to the member for at least one year, and use two-factor authentication. The platform is also giving organizations controls to remove profiles that falsely claim employment from their company pages and related search results, while piloting mandatory workplace verification for future company-page associations. LinkedIn is expanding identity-verification partnerships so users can display their LinkedIn-verified identity on third-party services, including Truecaller and PeerSpot.
Sep 24, 2026