Job listing and recruitment portals have been an attraction for cyber criminals given the volume of personal information uploaded to those sites in the form of CVs, cover letters and other data specific to individuals, but there’s more to criminals’ interest than just stealing personally identifiable information. Security shortcomings on some of these sites can expose job applicants, business account holders and the recruiters themselves to a number of different threats.
For example, when threat actors gain access to legitimate business accounts at recruiting sites, they can use social engineering to con job seekers into replying to fake listings and are inadvertently recruited as money mules, or otherwise lured into money laundering operations. Malicious documents in the guise of a PDF application can also slip past lax or non-existent scanning tools and target the recruitment portal directly, or enable an attacker access to data stored on the portal and expose applicants to identity theft.
Flashpoint analysts David Shear and Mike Mimoso have noticed a marginal increase in the number of mentions on The Deep Web and The Dark Web forums related to such activity around recruitment portals, many of which involve advertisements for the availability of compromised accounts, or criminals soliciting business accounts in order to list jobs on the platforms. Attackers want access to business accounts in order to leverage their false job listings and recruit people who would ultimately participate in fraud without their knowledge.
It’s likely that most of the recruitment portals are either unaware of such activity or hesitant to disclose it, meaning that analysts may not have a true handle on the full scope of the problem. Given the increasing number of mentions and interest in abusing these platforms, threat actors may find this to be a useful tactic going forward.
The recruitment of unwitting mules is a growing problem on a number of online platforms that accept classified ads, but most prominently on job recruitment portals. Desperate for employment, a candidate may think they’re applying for a legitimate position. In actuality, the non-existent positions – typically for merchandise handlers or payment processors – are a means of recruiting unwitting applicants into performing activity that facilitates fraud schemes, such as money laundering, by receiving unauthorised transfers of funds and sending the funds on to other recipients, typically for a nominal fee, which is frequently 10% of the amount they receive. The applicants are likely to believe the position is more credible if it’s posted by a reputable company on a popular recruitment platform.
The false job solicitations are professionally written and appear legitimate to casual observers and, at times, to the actual business, who may have numerous satellite campuses and could be unaware of where a local office or contractor could be listing a job.
Targeting recruitment professionals
When it comes to targeting recruitment professionals, the Flashpoint analysts have observed that threat actors typically target such employees via e-mail phishing campaigns, rather than attacking the recruitment portals given the continued relevant success of phishing schemes.
Credential stuffing, or account checking attacks, are more viable when targeting recruitment portal accounts. Credential stuffing attacks leverage the hundreds of millions of breached and leaked credentials available on The Deep Web and The Dark Web to gain unauthorised access to accounts. Attackers use automated login requests to repeatedly try username-password combinations until they gain access to an account. It’s a tactic that could have its advantages over using malware-laced PDF documents that may never be downloaded, or could potentially be flagged by a scanner.
Job recruitment portals are a warehouse of personal information, and by successfully compromising an applicant’s or a recruiter’s account, criminals are able to harvest applicants’ personally identifiable information, execute social engineering attacks that lead to identity theft or recruit unwitting mules for fraud.
Shear and Mimoso recommend the following mitigation advice for recruiters and platforms:
*Recruiters should always use the document parsers that many recruitment platforms have to avoid being infected by malicious documents
*Recruiters should enforce employees’ usage of the recruitment platforms, rather than passing around PDF CVs and cover letters
*Require proper document virus scanning
*Secure accounts with unique passwords and two-factor authentication in order to deter account takeover
*Recruiters should work with internal security teams to conduct cursory research across recruitment sites for fraudulent listings
*Recruitment portals should implement various security checks that analyse malicious documents and URLs for malicious activity
*Recruitment portals should always advise users of the risks around accepting third party documents