Ankura CTIX FLASH Update - September 23, 2022

Ransomware/Malware Activity

Recent Phishing Campaign Abuses LinkedIn's Smart Link Feature to Bypass Email Security

LinkedIn's Smart Link feature is beginning to be abused by threat actors to bypass email security products in phishing campaigns and gain insight into how effective their lures are. Smart Link is a premium feature of LinkedIn (for Enterprise and LinkedIn Sales Navigator users) where users can bundle up to fifteen (15) documents of links into one "packaged link" that is trackable for marketing purposes. Researchers at Cofense observed this technique in a recent phishing campaign impersonating Slovakian Postal Service (Slovenská Posta). The email contained a lure about a shipment being held, and confirmation for payment being needed through the click of an embedded link. Threat actors can abuse the legitimate Smart Link feature with "added alphanumeric variables at the end of the URL to redirect users to malicious websites." The campaign then redirects