Loading story…
LinkedIn is expanding its identity and trust posture in response to rising AI-driven fraud, impersonation, and scams by promoting “Verified on LinkedIn” as a portable trust signal that can be used beyond LinkedIn itself. In an interview, LinkedIn’s VP of Trust Product described verification as a way to reduce repeated onboarding checks across services while giving other platforms an additional authenticity signal; LinkedIn reported 100M+ verified members and a rate of ~75 verifications per minute.
Separately, technical analysis of LinkedIn’s client-side bot defenses described how its fingerprinting script attempts to detect forged or inconsistent browser fingerprints, including logic such as getHasLiedOs that compares signals like navigator.userAgent, navigator.oscpu, navigator.platform, and touch capability to flag mismatches indicative of spoofing. A third item (TransUnion research on gig-worker fraud and account renting) is adjacent in theme (digital trust/identity abuse) but does not describe LinkedIn’s verification program or LinkedIn’s bot-detection implementation and is best treated as separate context rather than the same specific story.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A Castle blog post examined LinkedIn's client-side bot-detection and fingerprinting logic, highlighting checks such as getHasLiedOs and getHasLiedLanguages that look for inconsistencies in browser-reported attributes. The analysis described these cross-attribute checks as useful for detecting spoofed environments commonly used by bots.
LinkedIn said it is making its verification a portable trust signal through 'Verified on LinkedIn' and a self-serve API so third-party platforms can display verified identity or workplace details. The initiative is positioned as a way to help counter AI-driven fraud, impersonation, deepfakes, and online scams across services beyond LinkedIn.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LinkedIn introduced identity-authentication and account-management tools aimed at limiting AI-enabled impersonation, fabricated employment histories, online manipulation, and scams. Members will be able to confirm that verified connections were colleagues or classmates during a stated period, creating peer-based confirmation of employment or education rather than a skills endorsement. A verifier must have a verified profile, have been connected to the member for at least one year, and use two-factor authentication. The platform is also giving organizations controls to remove profiles that falsely claim employment from their company pages and related search results, while piloting mandatory workplace verification for future company-page associations. LinkedIn is expanding identity-verification partnerships so users can display their LinkedIn-verified identity on third-party services, including Truecaller and PeerSpot.
Sep 24, 2026
Multiple reports highlighted a surge in **AI-enabled social engineering** that blends convincing pretexts with increasingly effective lures to steal credentials, money, or sensitive data. One account described a near-miss **LinkedIn job/recruiter scam** in which an attacker impersonated a recruiter tied to a well-known tech brand and attempted to draw the target into a fraudulent hiring/workflow process, illustrating how professional networking platforms are being used to seed high-trust approaches and extract personal information. Separately, threat reporting cited a sharp rise in **fake CAPTCHA** lures—up **563% over 2025** per *CrowdStrike’s 2026 Global Threat Report*—as attackers shift away from older “malicious browser update” prompts toward CAPTCHA-themed interactions that can trick users into executing malicious steps or handing over access. ESET also warned that **deepfake voice** has lowered the barrier for **CEO/CFO impersonation**, supplier fraud, and account takeover attempts: attackers can clone a voice from short public audio samples (e.g., interviews, earnings calls, social media) and then target finance or helpdesk staff (often identified via LinkedIn) to pressure wire transfers or bypass authentication and KYC checks.
Jun 29, 2026
LinkedIn was reported to be running a hidden JavaScript fingerprinting script on its website that checks visitors’ browsers for **6,236 Chrome extensions** and collects device characteristics including CPU core count, available memory, screen resolution, time zone, language settings, battery status, and storage capabilities. BleepingComputer said it independently verified the script’s presence and behavior, finding that it used randomized filenames and probed static resources associated with extension IDs to determine which add-ons were installed. LinkedIn confirmed that it scans for extensions, saying the practice is intended to detect tools that scrape member data without permission, violate its terms of service, or generate unusual data-fetching activity that could affect platform stability. Reports said the extension list includes competing sales-intelligence tools such as **Apollo, Lusha, and ZoomInfo**, alongside unrelated categories like grammar and tax software, and noted the scope of the scanning had expanded from roughly 2,000 extensions to more than 6,000; questions remain about how the collected data is stored, linked to user identities, or used for enforcement.
Jun 29, 2026