Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Sunday, 29 January, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Cybercriminals Targeting Popular Job Recruitment Portals About More Than PII

by The Gurus
August 9, 2018
in This Week's Gurus
Share on FacebookShare on Twitter

Job listing and recruitment portals have been an attraction for cybercriminals given the volume of personal information uploaded to those sites in the form of resumes, cover letters and other data specific to individuals.

 

But there’s more to criminals’ interest than just stealing personally identifiable information. Security shortcomings on some of these sites can expose job applicants, business account holders and the recruiters themselves to a number of different threats. For example, when threat actors gain access to legitimate business accounts at recruiting sites they can use social engineering to con job-seekers into replying to phony listings and are inadvertently recruited as money mules, or are lured into money laundering operations. Malicious documents in the guise of a PDF’d application can also slip past lax or non-existent scanning tools and target the recruitment portal directly, or enable an attacker access to data stored on the portal and expose applicants to identity theft.

 

Flashpoint analysts have noticed a marginal increase in the number of mentions on Deep & Dark Web forums related to such activity around recruitment portals, many of which involve advertisements for the availability of compromised accounts, or criminals soliciting business accounts in order to list jobs on the platforms. Attackers want access to business accounts in order to leverage their phony job listings and recruit people who would ultimately participate in fraud without their knowledge.

 

It’s likely that most of the recruitment portals are either unaware of such activity, or hesitant to disclose it, meaning that analysts may not have a true handle on the full scope of the problem.

Given the increasing number of mentions and interest in abusing these platforms, threat actors may find this to be a useful tactic going forward.

 

The recruitment of unwitting mules is a growing problem on a number of online platforms that accept classified ads, but most prominently on job recruitment portals. Desperate for employment, a candidate may think they’re applying for a legitimate position. In actuality, the nonexistent positions—typically for merchandise handlers or payment processors—are a means of recruiting unwitting applicants into performing activity that facilitates fraud schemes, such as money laundering, by receiving unauthorised transfers of funds and sending the funds on to other recipients, typically for a nominal fee, frequently 10% of the amount they receive. The applicants are likely to believe the position is more credible if it is posted by a reputable company on a popular recruitment platform.

 

The phony job solicitations are professionally written and appear legitimate to casual observers and at times to the actual business, who may have numerous satellite campuses and could be unaware of where a local office or contractor could be listing a job.

When it comes to targeting recruitment professionals, Flashpoint analysts have observed that threat actors typically target such employees via email phishing campaigns, rather than attack the recruitment portals given the continued relevant success of phishing schemes. Credential stuffing, or account checking attacks, are more viable when targeting recruitment portal accounts. Credential stuffing attacks leverage the hundreds of millions of breached and leaked credentials available on the Deep & Dark Web (DDW) and the surface web to gain unauthorised access to accounts. Attackers use automated login requests to repeatedly try username-password combinations until they gain access to an account; it’s a tactic that could have its advantages over using malware-laced PDF documents that may never be downloaded, or could be flagged by a scanner.

 

Job recruitment portals are a warehouse of personal information, and by successfully compromising an applicant’s or recruiter’s account, criminals are able to harvest applicants’ PII, execute social engineering attacks that lead to identity theft, or recruit unwitting mules for fraud.

 

Flashpoint recommends the following mitigation advice for recruiters and platforms:

 

  • Recruiters should always utilise the document parsers that many recruitment platforms have to avoid being infected by malicious documents.
  • Recruiters should enforce employees’ usage of the recruitment platforms, rather than passing around PDF resumes and cover letters
  • Require proper document virus scanning
  • Secure accounts with unique passwords and two-factor authentication in order to deter account takeover.
  • Recruiters should work with internal security teams to do cursory research across recruitment sites for fraudulent listings
  • Recruitment portals should implement various security checks that analyse malicious documents and URLs for malicious activity.

Recruitment portals should always advise users of the risk of accepting third-party documents.

FacebookTweetLinkedIn
Tags: CybersecurityTechnology
ShareTweetShare
Previous Post

98% of leading apps do not comply with GDPR according to Crownpeak study

Next Post

Accenture mid-year Threatscape report identifies five global cybersecurity threats

Recent News

Data Privacy Day: Securing your data with a password manager

Data Privacy Day: Securing your data with a password manager

January 27, 2023
#MIWIC2022: Carole Embling, Metro Bank

#MIWIC2022: Carole Embling, Metro Bank

January 26, 2023
Lupovis eliminates false positive security alerts for security analysts and MSSPs

Lupovis eliminates false positive security alerts for security analysts and MSSPs

January 26, 2023
Threat actors launch one malicious attack every minute

Threat actors launch one malicious attack every minute

January 25, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information