2

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows passwordless sign in if you know (and can access) the email address. Basically I get some one time instant login link in my inbox, which theoretically allows anyone access to my linkedin. The link is valid for just 15 minutes. These emails seem legit, although I still didn't click on the links. So they seem to be using the legit linkedin functionalities.

In any case, I am not particularly concerned about this. All accounts involved has 2FA enabled, so they can't hijack either the email nor linkedin without me knowing.

Now my curiosity is why would anyone repeatedly try his?

  1. Are they trying to bypass my 2FA?
  2. Do they hope that one day I'd need one of those instant login links for legit reasons and hope I'd click on one of the links they generated? can they somehow hijack the session?
  3. Is this some sort of complex social engineering meant to confuse me so hard that's I'd somehow click on the links?

This might sound similar to his other unanswered question: Repeated microsoft password reset requests - Should I be concerned?

But the vector of attack is different. In that question, OP gets password reset link to their secondary address. Here, the attacker appears to be using some sort of passwordless login feature of linkedin, which they can't use without my email anyways.

10
  • 1
    Yes, I got one of those recently as well. And no, I'm not in the U.S.A. When and where this happened: Date: February 11, 2024, 6:42 PM (GMT) Browser: Chrome Operating System: Windows Approximate Location: Bardstown, Kentucky, United States Didn't do this? Be sure to change your password right away.
    – Dijkgraaf
    Commented Feb 12 at 22:59
  • @Dijkgraaf yes. That exact same location as mine!
    – Ccm
    Commented Feb 12 at 23:00
  • I followed the advice and changed my password (not using the link in the email, even though it looked correct)
    – Dijkgraaf
    Commented Feb 12 at 23:01
  • See also this Redit thread. reddit.com/r/linkedin/comments/193atde/…
    – Dijkgraaf
    Commented Feb 12 at 23:03
  • And as others have noted in that Redit thread, it sends an email to your Secondary email address, rather than the primary one in Sign in & security. And it does come from LinkedIn, even despite the bad grammar in the first line.
    – Dijkgraaf
    Commented Feb 12 at 23:14

0

You must log in to answer this question.