Topic starter
05/07/2026 6:52 pm
TL;DR: Attackers are using LinkedIn messages, Google and Microsoft redirect chains, and AiTM phishing pages to steal Microsoft sessions while bypassing MFA and traditional email controls, according to Push Security. The pattern shows that browser-visible identity attacks now outrun inbox-centric defenses and demand stronger session-level governance.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Push Security Identifies Surge in Sophisticated LinkedIn-based Phishing Campaigns”.
Key questions
Q: What fails when phishing moves from email into LinkedIn and the browser session?
A: Email controls lose primary visibility when the lure arrives through a collaboration platform and the compromise happens after authentication in the browser.
Q: Why do trusted cloud redirects make phishing harder to block?
A: Because they borrow the reputation of legitimate cloud infrastructure long enough to pass URL checks and reach the user.
Q: How can security teams tell whether MFA bypass is happening through session theft?
A: Look for immediate post-login anomalies such as impossible travel, new device fingerprints, rapid SaaS pivots, and repeated use of the same session from inconsistent locations.
Practitioner guidance
- Harden browser-session visibility Correlate browser telemetry, IdP events and session signals so phishing can be detected after authentication, not only at the link or inbox stage.
- Review collaboration-channel phishing exposure Treat LinkedIn direct messages and other external collaboration channels as entry points for identity attacks, then validate whether those channels are covered by detection and user reporting workflows.
- Inspect redirect lineage before trust decisions Trace multi-hop redirects through trusted services such as Google and Microsoft before allowing links to pass reputation-only checks or user-safe branding assumptions.
Bottom line: LinkedIn-based phishing is now part of the enterprise identity attack surface, not an edge-case social-media nuisance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:12 pm
Browser-visible identity is now the control plane for phishing defence: This campaign shows that the decisive security boundary is no longer the inbox, but the authenticated browser session. Email-centric controls can stop some commodity lures, yet they do little when the user is reached through LinkedIn and the theft occurs after MFA in the browser. Practitioners need to treat browser telemetry, session state and identity signals as one governance surface.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: How should teams respond when identity attacks start in LinkedIn rather than email?
A: Treat LinkedIn and similar collaboration tools as part of the identity perimeter, not as separate communications channels. That means user reporting, browser detection, and session monitoring must cover external social-platform messages, especially for executives and other high-value users.
👉 Read our full editorial: LinkedIn phishing now chains trusted cloud services to steal sessions