LinkedIn has always felt different to email.
It’s professional. Familiar. Often friendly. People expect to have conversations there that would feel odd in an inbox. Introductions, document sharing, collaboration, even informal problem-solving.
That’s exactly why cyber criminals are paying more attention to it.
Recent research from ReliaQuest highlights a growing trend: attackers using LinkedIn private messages as the starting point for malware infections, including remote access trojans (RATs). These aren’t crude scams. They’re carefully built interactions designed to look legitimate from start to finish.
…And they’re working.
How these attacks actually play out
Most people imagine malware arriving via an obvious phishing email. A strange sender. Poor spelling. A suspicious link.
That’s not what’s happening here.
Instead, attackers contact people directly through LinkedIn. They often target senior staff, technical roles, finance teams, or anyone likely to handle documents and systems as part of their job.
The conversation starts normally. A connection request. A shared industry. A reasonable reason to talk.
Over time, trust is built. Then comes a file.
It might be positioned as:
a document to review
a project file
a PDF
something relevant to a previous conversation
Behind the scenes, that file is anything but harmless.
Why the files don’t raise alarms
The campaigns being tracked use a technique called DLL side-loading. In simple terms, the attacker bundles a malicious file alongside a legitimate application. When the user opens the “safe” application, it quietly loads the malicious component as well.
What makes this effective is that:
the software looks real
the file runs as expected
security tools often see normal behaviour at first
nothing obvious breaks or crashes
Once opened, the malware can install persistence, communicate with external servers, and give attackers long-term remote access to the device.
From there, they can explore the network, steal data, or wait for the right moment to act.
Why LinkedIn makes this easier for attackers
There are a few reasons social media messages are attractive to criminals.
First, they sit outside most organisations’ security tooling. Email is scanned, filtered, logged and monitored. LinkedIn messages usually aren’t.
Second, LinkedIn gives attackers a lot of intelligence for free. Job titles, reporting lines, suppliers, tone of voice, even posting habits can all be used to make messages more convincing.
Third, people don’t expect an attack to start there. That assumption lowers defences.
Checking a profile isn’t enough. Fake accounts, cloned profiles, and compromised real accounts are common. A professional-looking profile doesn’t equal a trustworthy sender.
Who this affects
This isn’t limited to large enterprises or highly technical environments.
The activity being tracked is broad and opportunistic. Schools. Care providers. Councils. Finance firms. SMEs. Trades. Anywhere people use LinkedIn as part of their professional life.
Busy teams are particularly at risk. When workloads are high, a message that looks reasonable often gets dealt with quickly. That speed is what attackers rely on.
Why traditional controls don’t always help
Even strong technical controls have limits here.
Multi-factor authentication doesn’t stop someone opening a file they’ve been persuaded to trust.
Email security doesn’t help when the conversation never touches email.
Endpoint tools may not immediately flag activity that hides behind legitimate processes.
This isn’t a failure of technology. It’s a reminder that attack paths change.
What actually helps
The answer isn’t to ban LinkedIn or discourage networking. It’s to treat social platforms as external and untrusted, even when conversations feel familiar.
Some practical guidance worth sharing with teams:
Be cautious of files sent via LinkedIn DMs, even from credible-looking profiles
Don’t install or open software sent through social media messages
If a request involves documents, payments, access or systems, verify it out of band
Encourage staff to pause rather than rush when something feels “slightly off”
Most importantly, remove blame from the conversation. These attacks succeed because they’re designed around normal human behaviour.
A quieter but growing entry point
What’s changed isn’t just the malware. It’s the route in.
Attackers don’t need to break down doors anymore. They blend in, start conversations, and wait for a moment of trust.
LinkedIn remains a valuable platform.
It just needs to be treated with the same caution as email, not more trust.
Because sometimes the breach doesn’t begin with a click.
It begins with a chat.
