TLDR
Cybercriminals are running a LinkedIn phishing campaign that uses fake business inquiry emails carrying a malicious "contract" attachment. The HTML attachment opens an obfuscated login form that hardcodes the victim's email address and...
How it works
Cybercriminals are running a LinkedIn phishing campaign that uses fake business inquiry emails carrying a malicious "contract" attachment. The HTML attachment opens an obfuscated login form that hardcodes the victim's email address and...
Red flags
- : Double file extension on the attachment (e.g. pdf.html ) disguising a phishing page Sender name, email address, and signature do not match
- the named company does not operate in the stated country After submitting credentials you are silently redirected to the legitimate site while data is exfiltrated in the background
What to do
- 1: Never open unsolicited attachments
- 2access LinkedIn only through the official app or by typing the URL directly into your browser Verify file extensions in your file explorer and enable multi factor authentication on LinkedIn and email accounts Use a real time anti malware solution with web protection and report suspicious "business inquiry" emails to your IT team or p
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-linkedin-emails-abuse-adobe-to-track-victimsFAQ
Is Fake LinkedIn phishing emails abuse Adobe infrastructure to steal passwords a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Double file extension on the attachment (e.g. pdf.html ) disguising a phishing page Sender name, email address, and signature do not match; the named company does not operate in the stated country After submitting credentials you are silently redirected to the legitimate site while data is exfiltrated in the background
What should I do first?
: Never open unsolicited attachments; access LinkedIn only through the official app or by typing the URL directly into your browser Verify file extensions in your file explorer and enable multi factor authentication on LinkedIn and email accounts Use a real time anti malware solution with web protection and report suspicious "business inquiry" emails to your IT team or p
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.