Why Do Cybercriminals Use LinkedIn for Phishing?

Today, phishing no longer remains confined to the inbox. In fact, over 30% of attacks happen outside of email, leveraging social networks, search engines, and messaging apps to deceive victims.

And among all platforms, LinkedIn has become the new favorite ground for cybercriminals. At TecnetOne, we’ve observed how attackers are launching increasingly sophisticated spear phishing campaigns, specifically targeting executives and companies in industries such as finance, technology, and professional services.

The problem is that this type of phishing is rarely detected or documented. Most industry reports rely on email security data, so attacks occurring outside that environment often go unnoticed.

You might think: “Why should I care if someone falls for a fake message on LinkedIn?” Well, it matters—a lot. Even if the platform is used for personal purposes, many employees access it from corporate devices, and attackers are well aware of that. Their goal isn’t just the LinkedIn account, but gaining access to enterprise systems like Microsoft Entra or Google Workspace.

That’s why at TecnetOne, we believe LinkedIn phishing is one of the most significant threats facing companies today. In this article, we’ll explain the top 5 reasons why attackers are using LinkedIn to launch phishing campaigns—and what you can do to protect yourself.

1. Evades Traditional Defenses

LinkedIn direct messages slip through a gap many companies haven’t closed: they don’t pass through email filters. Your employees may receive suspicious messages on their corporate laptops or phones, but security teams don’t see them because traditional solutions focus on the inbox.

To make matters worse, modern phishing kits use obfuscation and evasion techniques that bypass automated scans and web proxies. In practice, this leaves organizations relying almost entirely on user training and someone reporting the incident—a fragile defense when the attacker is well-prepared.

And if someone reports the attack on LinkedIn, things get more complicated: there’s no easy way to track how many employees received the same message or to mass-remove it the way you would with an email.

You can report the account and, with luck, the platform will suspend it—but by then, the attacker may have already achieved their goal. Blocking URLs helps, yes, but malicious domains change quickly; it’s a cat-and-mouse game that often favors the attacker.

2. Cheap, Simple, and Easy to Scale for Attackers

Compared to running an email campaign (creating a domain, “warming up” reputation, evading filters), operating on LinkedIn can be quicker and cheaper. Creating profiles, connecting with people, and appearing legitimate is enough in many cases.

Additionally, hijacking legitimate accounts is very common: many leaked credentials belong to social media profiles, and many of those accounts don’t have MFA enabled. That gives attackers a real “facade” that exploits the trust of their network.

Add to that tools that automate messages (or even AI-generated messages), and you have a formula to scale attacks at low cost with high impact.

Read more: Why are phishing attacks still working in 2025?

3. Direct Access to High-Value Targets

LinkedIn is practically a public database of job titles and responsibilities: with just a few clicks, you can map out who has access to finance, IT, or critical infrastructure within a company. For an attacker, that’s gold—it allows for highly targeted spear phishing campaigns with real context.

There are no robust filters controlling who can contact whom, nor are there assistants verifying the authenticity of messages. That’s why LinkedIn is ideal for pinpointing the exact person who, if compromised, could open the door to corporate accounts (Microsoft Entra, Google Workspace, etc.). In short, it’s the most direct path to attacking privileged users and launching successful spear phishing campaigns.

4. Users Tend to Let Their Guard Down

On LinkedIn, interacting with strangers is part of the game: accepting connection requests, receiving messages from recruiters or industry peers—it’s all normal. That’s why it’s far more likely that an executive will open and respond to a LinkedIn direct message than a cold email that ends up in their spam folder.

If the attacker uses a hijacked account (or impersonates someone familiar), the response rate skyrockets. It’s just like receiving an email from a real vendor or colleague’s account—trust does the rest. In fact, several recent incidents began exactly this way—a compromised account within the organization was used to launch targeted attacks on executives.

And when the message includes the perfect pretext (“urgent approval,” “review this document now”), the pressure to respond quickly plays into the attacker’s hands. In short: on LinkedIn, social signals lower suspicion and increase the likelihood of the trap working.

5. The Rewards for Attackers Can Be Massive

The fact that the attack comes through a “personal” app like LinkedIn doesn’t make it any less dangerous—in reality, it can be the entry point to the entire corporate infrastructure. Many phishing attacks have a specific goal: gaining access to cloud platforms (Microsoft 365, Google Workspace) or identity providers (Okta, etc.). Once inside, the attacker can leverage SSO and credentials to move laterally and access any connected service.

This means that compromising just one account can grant access to emails, documents, backups, internal systems, and all kinds of critical data. From there, it becomes much easier to launch internal attacks (e.g., messages via Slack or Teams), use techniques like SAMLjacking, or even pivot to higher-privilege accounts.

If the target is an executive (well-executed spear phishing), the reward can be enormous: what starts as access to a single account can end in a multi-million dollar breach.

Even when an attacker only compromises an employee’s personal device, the damage can still reach the company. Cases like Okta’s in 2023 showed how sessions and credentials stored in browsers or personal devices can sync and provide access to corporate accounts and clients.

And let’s be clear: this isn’t a LinkedIn-only problem. Modern work relies on hundreds of SaaS applications and communication channels (messaging, SMS, social media, malicious ads), many with inconsistent security settings. That multiplies the entry points and complicates containment.