Securing Your LinkedIn Account Against Attacks and Scams

LinkedIn is the one social network most defense contractors treat as safe. It’s professional, it’s where the recruiters are, and it feels like a business tool rather than social media. That reputation is exactly why attackers like it.

If you work in the defense industrial base, your LinkedIn profile is an advertisement listing your employer, your skills, your programs if you’re careless, and the names of everyone you work with. For a foreign intelligence service or a criminal crew, it’s the best targeting database ever built, and you filled it out yourself.

This post covers the attacks that actually show up on LinkedIn, then walks through locking down your account and profile. Most of it takes about twenty minutes.

The attacks that matter

The fake recruiter

This is the big one for anyone in aerospace and defense, and it has a long, documented history.

In 2020, ESET published research on a campaign it called Operation In(ter)ception. Between September and December 2019, attackers posed as HR representatives from Collins Aerospace and General Dynamics on LinkedIn, approached employees at European and Middle Eastern aerospace and military companies with job offers, and delivered malware disguised as job documents. ESET found several hints pointing to North Korea’s Lazarus Group. The pattern has been repeated for years under the name Operation Dream Job, and it’s still running. Iran-linked groups have used the same playbook: Mandiant reported in 2024 on fake job offers and spoofed company pages aimed at aerospace and defense targets in Israel and the UAE.

The fake recruiter works because it flatters you, gives you a reason to open a file, and arrives through a channel you trust.

The coding test that’s really malware

A newer variant targets developers and engineers. A “recruiter” moves you through a friendly interview process, then sends a take-home coding assignment, usually a project you’re asked to download and run. Palo Alto Networks’ Unit 42 documented a North Korean campaign it called Contagious Interview, where running the interview code installed malware that steals browser credentials and cryptocurrency wallets and leaves a backdoor behind.

If you’d never run an unknown executable from a stranger’s email, don’t run one from a stranger’s GitHub repo just because it came with a job title attached.

Intelligence recruitment

Not every approach is about malware. Some are about you.

Kevin Mallory, a former CIA officer, was contacted on LinkedIn in 2017 by someone posing as a think-tank representative who turned out to be a Chinese intelligence officer. Mallory was in serious debt. He was sentenced to twenty years in prison in 2019. The FBI and National Counterintelligence and Security Center later made a short film based on the case, The Nevernight Connection, and their list of red flags is worth memorizing: an unusually well-paid remote opportunity, flattery, urgency, vague details about the company, pressure to move the conversation off the platform, and requests that escalate a little at a time.

The scale of these approaches is bigger than people assume. In 2023, MI5’s director general was reported as saying more than 20,000 people in the UK had been approached online by Chinese intelligence through LinkedIn and similar sites. In 2025, Australia’s security service chief said more than 35,000 Australian profiles claimed access to classified information, and around 2,500 disclosed holding a clearance. He called that recklessly inviting the attention of foreign intelligence. He’s right.

Account takeover

Your account is valuable even if you’re not a target yourself, because it comes with your network’s trust.

In 2023, security researchers tracked a widespread hijacking campaign. Attackers who got into accounts changed the email address to one they controlled, then did something clever: they turned on two-step verification themselves, which locked the real owner out of account recovery. Some owners got ransom demands. Others watched their account send scam messages to their connections.

That’s the detail I’d want every reader to remember. If you haven’t turned on two-step verification, an attacker who gets your password will happily turn it on for you.

Phishing that looks like LinkedIn

Fake “you appeared in 9 searches” and “you have a new message” emails are a staple of credential phishing. Check Point’s brand phishing reports have ranked LinkedIn among the most impersonated brands for years, and its Q2 2026 report put it at number two, behind Microsoft. The fix is simple: never sign in from a link in an email. Open the app or type the address yourself.

Fake profiles

LinkedIn says that in the second half of 2025 it stopped 25.3 million fake accounts at registration, and caught 99.7 percent of the fakes it removed before anyone reported them. That’s impressive and still leaves plenty. Researchers have found more than a thousand LinkedIn profiles using AI-generated faces. A polished photo and 500+ connections prove nothing.

Locking down your account

All of this lives under Me > Settings & Privacy. LinkedIn moves its settings around, so if a label below doesn’t match exactly, use the search box at the top of the settings page.

Sign in & security

• Turn on two-step verification. Choose an authenticator app rather than text message. SMS is better than nothing, but SIM-swap attacks make it the weaker option.
• Set up a passkey if your device supports it. It’s tied to your phone or computer and can’t be phished the way a password can.
• Review where you’re signed in. Look for sessions you don’t recognize, in places you’ve never been, and end them. Do this now and every few months.
• Check the email addresses and phone numbers on the account. Remove old ones. An old work email you no longer control is a recovery path for someone else.
• Use a unique password that lives in a password manager and isn’t reused anywhere.

Data privacy

• Review permitted services. Remove any third-party apps you’ve connected to LinkedIn and no longer use.
• Check job seeking preferences. If you use Open to Work, set it to recruiters only. It’s not a guarantee your own company won’t see it, but it narrows the audience.
• Look at the generative AI setting. LinkedIn uses member data, such as public profile information and posts, to train content-generation AI unless you turn it off. The setting is called Data for Generative AI Improvement. Turning it off doesn’t undo past training, but it stops future use.

Locking down your profile

This is where cleared and defense professionals need to think harder than everyone else.

• Never list a clearance level, program name or classified project. A joint bulletin from NCSC, the FBI and DCSA in April 2025 warned specifically that posting about your work, and particularly about security clearances, can draw unwanted attention. A recruiter who needs to know your clearance can ask through proper channels.
• Describe your work by function, not by program. “Led network operations for a 3,000-person organization” tells a hiring manager what they need. A contract number and a codename tell an adversary what they want.
• Restrict who can see your connections. Under Visibility, set connections to visible only to you. Your network map is a targeting list for whoever is working on your colleagues.
• Control who can see your email address. Limit it to first-degree connections or less.
• Edit your public profile. This controls what people who aren’t signed in, and search engines, can see. Trim it to what you’d put on a business card.
• Turn off profile update broadcasts. That stops your network from getting a notification every time you change jobs or add a skill.
• Get verified, and know what it means. LinkedIn’s free identity verification (through CLEAR in the US) adds a badge confirming your name matches a government ID. It’s worth doing because it makes impersonating you harder. But a badge on someone else’s profile confirms their name, not their intentions or their employer.

Checking out a recruiter in five minutes

When a recruiter you don’t know reaches out, run through a quick check before you engage.

• Look at the profile’s age and history. A brand-new profile with a polished photo and few posts is a warning sign.
• Check whether they’ve verified their workplace. LinkedIn now asks people adding recruiter and executive titles to verify where they work, so a recruiter title without that verification deserves a second look.
• Search for the company’s own careers page and find the job there. If it doesn’t exist on the company’s site, be very skeptical.
• Call or email the company through contact details you found yourself, not ones the recruiter gave you.
• Notice the pace. Real hiring processes take time. An offer that arrives in days, for a remote job paying well above market, is following the script in the FBI’s red-flag list.

Habits that matter more than settings

Settings protect your account. Your habits protect you.

Be suspicious of any recruiter who wants to move to WhatsApp, Telegram or personal email quickly. Real recruiters at real companies are happy to stay on the platform or use a corporate address. Look up the recruiter’s company yourself and contact it through its own website. Don’t open documents or run code from someone you met on LinkedIn until you’ve verified who they are by some independent means.

If you hold a clearance or work at a cleared facility, report suspicious contacts to your Facility Security Officer. DCSA guidance says everyone associated with a cleared facility is a target, and reporting is part of the job. If an approach looks like recruitment by a foreign service, the FBI wants to hear about it at tips.fbi.gov.

And if your account does get taken over, report it to LinkedIn immediately and warn your connections through another channel, because the attacker is about to use your name to go after them.

---

Where to go next

• Account security covers only a few of the 110 requirements. See where the rest stand with the CMMC readiness quiz.
• Our CMMC guide for small contractors walks through the requirements in plain language.
• Need the policies and SSP behind your security program? Start with our CMMC packets.