LinkedIn phishing now chains trusted cloud services to steal sessions

At a glance

What this is: This is Push Security’s analysis of a LinkedIn phishing campaign that used trusted cloud redirects and AiTM pages to steal Microsoft sessions while evading MFA.

Why it matters: It matters because phishing is moving outside email and into browser session theft, which forces IAM and security teams to govern identity risk where users actually authenticate and work.

Context

Phishing is no longer confined to email inboxes. This campaign used LinkedIn direct messages, then chained legitimate Google and Microsoft services to hide the final destination and reach a Microsoft credential-stealing page.

For identity programmes, the important shift is visibility. Traditional email filtering, URL reputation and domain blocking miss attacks that begin in collaboration tools and end in the browser session, where authentication and session theft actually occur.

The pattern is typical of modern browser-based phishing: trusted services are used as cover, not as the target. That means the control problem is session governance across user-facing channels, not just mail security.

Key questions

Q: What fails when phishing moves from email into LinkedIn and the browser session?

A: Email controls lose primary visibility when the lure arrives through a collaboration platform and the compromise happens after authentication in the browser. The failure mode is assuming the inbox is the main control point. Teams need detection and governance that follow the user into the session, because that is where AiTM theft occurs.

Q: Why do trusted cloud redirects make phishing harder to block?

A: Because they borrow the reputation of legitimate cloud infrastructure long enough to pass URL checks and reach the user. The visible link may look harmless while the real destination is hidden behind one or more redirects. Defenders need chain inspection and cloud-hosted landing page analysis, not only domain blacklists.

Q: How can security teams tell whether MFA bypass is happening through session theft?

A: Look for immediate post-login anomalies such as impossible travel, new device fingerprints, rapid SaaS pivots, and repeated use of the same session from inconsistent locations. Those signals indicate the authentication event succeeded legitimately but the resulting session is being replayed or hijacked. That is the pattern to detect and contain.

Q: How should teams respond when identity attacks start in LinkedIn rather than email?

A: Treat LinkedIn and similar collaboration tools as part of the identity perimeter, not as separate communications channels. That means user reporting, browser detection, and session monitoring must cover external social-platform messages, especially for executives and other high-value users.

Technical breakdown

Trusted redirect chains as a delivery layer

Attackers increasingly use legitimate services such as Google Search, Firebase and Microsoft Dynamics as intermediate hops in a redirect chain. The goal is not to compromise those services, but to borrow their reputation long enough to evade automated blocking and delay analyst review. Each redirect step reduces the odds that a scanner sees the final phishing page in a single pass. That means reputation-based controls are weakest when the malicious destination is several layers away from the initial link. Practical implication: inspect the full redirect path, not only the first URL or final landing page.

Practical implication: Inspect the full redirect path, not only the first URL or final landing page.

AiTM phishing and session theft

An adversary-in-the-middle phishing page proxies the login flow between the user and the real service. Instead of simply collecting a password, the attacker captures the authenticated session artefact after MFA completes, which lets the attacker act as the user without repeatedly prompting for credentials. This is why session theft is more operationally dangerous than password capture alone. It bypasses the security benefit of the MFA challenge by stealing the authenticated browser state that follows it. Practical implication: treat post-authentication session artefacts as governed credentials, not disposable browser state.

Practical implication: Treat post-authentication session artefacts as governed credentials, not disposable browser state.

Why browser-native detection matters here

The attack unfolds in the browser, not in the mail gateway. That matters because link scanners, inbox filters and domain reputation systems evaluate pre-click or pre-authentication signals, while AiTM activity often becomes visible only during live browser interaction. Browser telemetry can observe redirects, page obfuscation, bot checks and token handoff at the point of use. This does not replace email security or identity controls, but it closes the observation gap that browser-based phishing exploits. Practical implication: align detection with where identity is actually exercised, especially for external collaboration channels and session capture.

Practical implication: Align detection with where identity is actually exercised, especially for external collaboration channels and session capture.

Threat narrative

Attacker objective: The attacker aims to capture a valid Microsoft session and use it to impersonate the user without triggering MFA.

1. Entry begins with a LinkedIn direct message carrying a seemingly benign link sent outside enterprise email controls.
2. Escalation occurs as the link traverses legitimate Google and Microsoft redirects, then uses a Microsoft-branded lure and Cloudflare Turnstile to reach the phishing page.
3. Impact is Microsoft session theft through an AiTM page, allowing the attacker to bypass MFA and act as the victim in the live browser session.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-visible identity is now the control plane for phishing defence: This campaign shows that the decisive security boundary is no longer the inbox, but the authenticated browser session. Email-centric controls can stop some commodity lures, yet they do little when the user is reached through LinkedIn and the theft occurs after MFA in the browser. Practitioners need to treat browser telemetry, session state and identity signals as one governance surface.

Trusted cloud services now function as concealment infrastructure: Google Search, Firebase and Microsoft Dynamics were not the target, but they were central to the attack path. That means trust in well-known domains can become an attack dependency, not a defence. The implication is a sharper focus on redirect lineage, not just domain reputation, because trusted infrastructure can be weaponised as a delivery layer.

Session theft is the more durable phishing outcome: Password capture is increasingly secondary when adversaries can steal the authenticated session itself. This shifts risk from login events to post-authentication state, where MFA has already done its job and the attacker still wins. Teams should read this as a control boundary problem: the security model must extend beyond primary authentication to session handling and reuse.

LinkedIn has become a viable identity attack channel, not just a recruitment or networking platform: Push Security’s findings indicate that attackers are selecting channels based on control gaps, not user expectations. When collaboration platforms sit outside enterprise phishing visibility, they become attractive entry points for high-value targeting. Security programmes that still model phishing as an email problem are working from an outdated threat assumption.

Identity attack surface management needs browser-level scope: This article reinforces that unmanaged logins, weak MFA coverage and risky OAuth integrations are symptoms of a larger visibility problem. The named concept here is browser-session trust debt: the accumulation of assumptions that a successful login remains benign after authentication. Once attackers can reuse that trust in-session, governance has to start at the browser, not at the mailbox.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
• Read next: Identity Provider and SSO Security Guide

What this signals

Browser-session trust debt: phishing controls that stop at the inbox assume the browser session remains trustworthy after MFA. This campaign shows that assumption failing in practice, so teams need to govern the authenticated session as a first-class identity asset.

The practical shift is toward visibility at the point of use. When attackers chain LinkedIn, Google and Microsoft services to conceal a phishing page, the control gap is not just detection quality but where detection is anchored in the user journey.

For practitioners

• Harden browser-session visibility Correlate browser telemetry, IdP events and session signals so phishing can be detected after authentication, not only at the link or inbox stage.
• Review collaboration-channel phishing exposure Treat LinkedIn direct messages and other external collaboration channels as entry points for identity attacks, then validate whether those channels are covered by detection and user reporting workflows.
• Inspect redirect lineage before trust decisions Trace multi-hop redirects through trusted services such as Google and Microsoft before allowing links to pass reputation-only checks or user-safe branding assumptions.
• Reclassify session artefacts as governed credentials Map where authenticated browser sessions can be stolen, replayed or extended, and apply controls that assume session state can be more valuable than the original password.

Key takeaways

• LinkedIn-based phishing is now part of the enterprise identity attack surface, not an edge-case social-media nuisance.
• Trusted cloud redirects and AiTM pages let attackers bypass inbox-centric controls and steal authenticated Microsoft sessions.
• Browser-level detection and session governance are the controls that address the failure mode this campaign exposes.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Session Theft: Session theft is the reuse of an already authenticated access context, usually through stolen cookies, tokens, or browser artifacts. It is dangerous because the attacker may not need to know the password at all. For IAM and NHI governance, it means authentication success cannot be treated as proof of legitimate intent.
• Redirect chain: A redirect chain is a sequence of intermediate links that forwards the victim from an initial lure to the final malicious page. Attackers use it to hide the destination, defeat static URL analysis, and exploit trusted services that are less likely to be blocked early.
• Browser telemetry: Browser telemetry is the event data produced by enterprise browser activity, including logins, profile changes, downloads, session starts, and extension or site interactions. In identity governance, it becomes useful when those events are correlated with account state and privilege context rather than treated as generic activity logs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.