Loading story…
Organizations are facing a growing risk from insider threats, as cybercriminals increasingly exploit both the hiring process and employee online behavior to gain unauthorized access to sensitive data. Attackers are now impersonating cybersecurity and IT professionals, using fabricated resumes, deepfake technology, and stolen identities to secure legitimate positions within companies. Once inside, these "fake workers" can access confidential databases and systems, often leveraging remote work vulnerabilities and sophisticated obfuscation techniques such as VPNs and proxy servers to mask their true origins.
At the same time, employees' tendency to overshare on professional and social platforms like LinkedIn, GitHub, and X provides threat actors with valuable intelligence. Publicly available information about job roles, internal relationships, technical stacks, and even travel plans can be weaponized for spearphishing, business email compromise, and other targeted attacks. The combination of lax vetting in remote hiring and excessive online disclosure significantly increases the attack surface, making it easier for adversaries to infiltrate organizations and execute sophisticated social engineering campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Security reporting highlighted a growing insider-threat trend in which remote work and weak in-person verification make it easier for impostors posing as cybersecurity or IT staff to pass hiring processes. Managed service providers were identified as especially exposed because of their access to multiple client environments.
Researchers warned that employee posts on platforms such as LinkedIn, GitHub, Instagram, and X can provide OSINT that threat actors use for spearphishing, credential theft, malware delivery, and BEC. They also noted that groups such as SEABORGIUM and TA453 routinely use this reconnaissance approach.
Organizations reported cases in which malicious actors, including groups linked to North Korea, used stolen or fabricated identities, AI-generated resumes, fake credentials, and deepfake interviews to obtain remote cybersecurity and IT roles. The goal was to gain privileged access for data theft, financial fraud, or espionage.
Children's Healthcare of Atlanta was hit by a business email compromise attack that resulted in a $3.6 million loss, illustrating how attackers can weaponize publicly available employee and organizational information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly exploiting the job search process to launch sophisticated social engineering attacks aimed at stealing credentials and compromising systems. In one widespread campaign, attackers send phishing emails that masquerade as job offers for Social Media Manager positions, leveraging the reputations of well-known brands such as KFC, Ferrari, and Red Bull to build trust with potential victims. These emails are often sent from legitimate-looking services like Google Workspace and Microsoft 365, making them harder to detect. Victims who click on the provided links are redirected through a series of deceptive web pages, including fake security checks and fraudulent job postings designed to mimic reputable sites like Glassdoor. The process culminates in a fake Facebook login page, where users are tricked into entering their credentials, which are then harvested by the attackers. Sublime Security researchers have identified telltale signs of these scams, such as suspicious URLs that appear to be associated with trusted brands but are actually redirects to malicious sites. The attackers use templates or large language models to generate convincing, varied phishing messages at scale, increasing the reach and effectiveness of their campaign. In a separate but thematically similar attack, developers are targeted on LinkedIn by a fake recruiter claiming to represent an AI-driven company called DLMind. The recruiter, using a well-crafted persona and a polished LinkedIn profile, invites victims to access a private GitHub repository under the pretense of a coding assessment. When the victim runs the provided setup script, a multi-stage malware payload is executed. This malware is designed to scan for sensitive files, steal browser credentials and cookies, hijack clipboard data, collect system information, and establish persistent remote access using tools like AnyDesk. The attack chain is carefully engineered to blend into a developer’s normal workflow, making detection difficult. Both campaigns demonstrate a trend of attackers weaponizing trust and exploiting the job-seeking process, using a combination of social engineering and technical sophistication to achieve their objectives. The impact of these attacks includes the theft of social media credentials, exposure of sensitive personal and professional data, and the potential for long-term system compromise. Security researchers emphasize the importance of vigilance when responding to unsolicited job offers, especially those that require logging in through unfamiliar portals or running code from unverified sources. Organizations are advised to educate employees about these tactics and implement technical controls to detect and block such phishing and malware delivery attempts. The use of legitimate platforms and convincing personas by attackers underscores the need for robust verification processes and heightened awareness among job seekers and professionals alike. These incidents highlight the evolving nature of social engineering threats and the critical importance of multi-layered defense strategies. The campaigns also illustrate how attackers are leveraging automation and AI to scale their operations and increase the sophistication of their lures. As the job market remains competitive, individuals and organizations must remain alert to the risks posed by these targeted attacks. Ongoing monitoring, user education, and rapid incident response are essential to mitigating the impact of such credential theft and system compromise campaigns.
Jul 8, 2026
Cybercriminals are increasingly targeting employees within banks, telecommunications companies, and technology firms, offering substantial payments in exchange for insider access to sensitive systems and data. Recent research by Check Point highlights that these recruitment efforts are conducted via darknet forums, with payouts ranging from $3,000 to $15,000 for one-time access or specific information, and even higher for particularly valuable data such as large cryptocurrency exchange records. The campaigns specifically name high-profile organizations, including major banks, cryptocurrency exchanges like Coinbase and Binance, and tech giants such as Apple and Samsung, as well as cloud service providers and consulting firms. Insiders are being solicited to provide network access, leak credentials, disable security defenses, or facilitate attacks such as SIM-swapping, which can be used to bypass two-factor authentication. The recruitment tactics often employ emotional manipulation, promising financial freedom and long-term arrangements, with some offers including weekly payments for ongoing cooperation. The financial sector remains a primary target due to the direct access to funds and customer data, but the threat extends to other industries, including telecommunications and technology, where employees can enable attacks on infrastructure and user accounts. These developments present a significant security challenge, as insider threats are more difficult to detect and mitigate compared to external attacks, and highlight the need for organizations to strengthen internal monitoring and employee awareness programs.
Jun 29, 2026
Organizations across industries are facing a surge in email-based attacks, with phishing, impersonation, and account takeover attempts driving a significant increase in breaches. Attackers are leveraging email as the primary entry point, with malware delivered via email rising by over 130% year-over-year and scams and phishing incidents also seeing substantial growth. The manufacturing, retail, and healthcare sectors are particularly targeted, with attackers exploiting outdated systems and user behavior to bypass security controls, resulting in business disruption, data loss, and financial fraud. At the same time, advancements in AI-driven technologies such as voice cloning are making social engineering attacks even more effective. Red teaming exercises have demonstrated that AI-enabled deepfakes can convincingly impersonate employees, tricking help desks into resetting credentials and granting unauthorized access. These sophisticated vishing attacks highlight the urgent need for organizations to test their defenses against both traditional and emerging social engineering techniques, and to educate staff on recognizing and responding to these evolving threats.
Jul 12, 2026