Credential Phishing Campaign Uses LinkedIn Smart Links to Target Microsoft Accounts

In a new phishing campaign targeting Microsoft credentials, hackers were seen exploiting the Smart Links feature of LinkedIn to evade detection and bypass email security measures.

Connected to LinkedIn Sales Navigator services, the smart links or ‘’slink’’ is used for marketing and tracking purposes by LinkedIn business accounts. This feature allows users to promote and measure content engagement via embedded links in emails.

As it uses a trusted domain, followed by a “code” parameter with an 8-alphanumeric character ID, the link easily bypasses various security email gateways (SEGs). Thus, it was exploited by threat actors to lure victims into clicking malicious links and disclose personal or official information.

Researchers at email security company, Cofense have observed the usage of this technique in September 2022, as well. However, this extensive credential phishing campaign was targeted at multiple industries. It was seen using 80 unique smart links embedded in over 800 emails of various subjects, sent from newly created or previously compromised LinkedIn business accounts.

‘’The emails use generic subject lines that fit the themes of financial, human resources, documents, security, and general notifications,’’ Cofense revealed. Moreover, to add a sense of legitimacy, the victims were not only directed to a seemingly authentic Microsoft login page, but the designated link also contained their email addresses.

‘’The designated phishing kit will read the victim’s email attached to the Smart Link to autofill the malicious form to add to the illusion of legitimacy that the victim has landed at the legitimate Microsoft sign-in,’’ the investigation revealed.

According to Cofense, the primary targets of the campaign seemed to be users from the Finance and Manufacturing industries. However, victims from the Energy, Technology, Healthcare, Construction, Insurance, and Mining, were targeted as well.

‘’While it’s important to use email security suites, it is also essential for employees to constantly be up to date on their training to combat any phishing campaign. Employees must be taught not to click links from emails that seem suspicious or unexpected. ‘’