Job listing and recruitment portals have been an attraction for cybercriminals given the volume of personal information uploaded to those sites in the form of resumes, cover letters and other data specific to individuals.
But there’s more to criminals’ interest than just stealing personally identifiable information. Security shortcomings on some of these sites can expose job applicants, business account holders and the recruiters themselves to a number of different threats. For example, when threat actors gain access to legitimate business accounts at recruiting sites they can use social engineering to con job-seekers into replying to phony listings and are inadvertently recruited as money mules, or are lured into money laundering operations. Malicious documents in the guise of a PDF’d application can also slip past lax or non-existent scanning tools and target the recruitment portal directly, or enable an attacker access to data stored on the portal and expose applicants to identity theft.
Flashpoint analysts have noticed a marginal increase in the number of mentions on Deep & Dark Web forums related to such activity around recruitment portals, many of which involve advertisements for the availability of compromised accounts, or criminals soliciting business accounts in order to list jobs on the platforms. Attackers want access to business accounts in order to leverage their phony job listings and recruit people who would ultimately participate in fraud without their knowledge.
It’s likely that most of the recruitment portals are either unaware of such activity, or hesitant to disclose it, meaning that analysts may not have a true handle on the full scope of the problem.
Given the increasing number of mentions and interest in abusing these platforms, threat actors may find this to be a useful tactic going forward.
The recruitment of unwitting mules is a growing problem on a number of online platforms that accept classified ads, but most prominently on job recruitment portals. Desperate for employment, a candidate may think they’re applying for a legitimate position. In actuality, the nonexistent positions—typically for merchandise handlers or payment processors—are a means of recruiting unwitting applicants into performing activity that facilitates fraud schemes, such as money laundering, by receiving unauthorised transfers of funds and sending the funds on to other recipients, typically for a nominal fee, frequently 10% of the amount they receive. The applicants are likely to believe the position is more credible if it is posted by a reputable company on a popular recruitment platform.
The phony job solicitations are professionally written and appear legitimate to casual observers and at times to the actual business, who may have numerous satellite campuses and could be unaware of where a local office or contractor could be listing a job.
When it comes to targeting recruitment professionals, Flashpoint analysts have observed that threat actors typically target such employees via email phishing campaigns, rather than attack the recruitment portals given the continued relevant success of phishing schemes. Credential stuffing, or account checking attacks, are more viable when targeting recruitment portal accounts. Credential stuffing attacks leverage the hundreds of millions of breached and leaked credentials available on the Deep & Dark Web (DDW) and the surface web to gain unauthorised access to accounts. Attackers use automated login requests to repeatedly try username-password combinations until they gain access to an account; it’s a tactic that could have its advantages over using malware-laced PDF documents that may never be downloaded, or could be flagged by a scanner.
Job recruitment portals are a warehouse of personal information, and by successfully compromising an applicant’s or recruiter’s account, criminals are able to harvest applicants’ PII, execute social engineering attacks that lead to identity theft, or recruit unwitting mules for fraud.
Flashpoint recommends the following mitigation advice for recruiters and platforms:
- Recruiters should always utilise the document parsers that many recruitment platforms have to avoid being infected by malicious documents.
- Recruiters should enforce employees’ usage of the recruitment platforms, rather than passing around PDF resumes and cover letters
- Require proper document virus scanning
- Secure accounts with unique passwords and two-factor authentication in order to deter account takeover.
- Recruiters should work with internal security teams to do cursory research across recruitment sites for fraudulent listings
- Recruitment portals should implement various security checks that analyse malicious documents and URLs for malicious activity.
Recruitment portals should always advise users of the risk of accepting third-party documents.
