Topic starter
11/06/2026 11:58 pm
TL;DR: A targeted LinkedIn phishing campaign chained trusted web properties, layered redirects, and CAPTCHA-based evasion to reach an attacker-in-the-middle login page aimed at an executive’s Google Workspace account, according to Push Security. The incident shows how one compromised SSO-linked account can widen blast radius across downstream applications and turn browser-level phishing into an identity governance problem.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “How Push stopped a high risk LinkedIn spear-phishing attack against a company exec”.
Key questions
Q: What should teams do first when an executive is targeted by AiTM phishing?
A: Preserve browser and identity telemetry before resetting anything.
Q: Why does LinkedIn phishing create more risk than email phishing in some campaigns?
A: LinkedIn can bypass email controls entirely and reach users in a context where external messages feel normal.
Q: How can security teams tell if a phishing login page is trying to evade sandbox analysis?
A: Watch for human-interaction gates such as CAPTCHA, Turnstile, or other steps that prevent automated rendering from reaching the malicious stage.
Practitioner guidance
- Instrument browser-level detection for AiTM phishing Monitor the full navigation chain inside the user session so redirect hops, CAPTCHA gates, and final login destinations can be correlated in one timeline.
- Hunt for executive access to the lure chain Look for executive-level users who visited linked combinations of sites.google.com, Microsoft Dynamics, and the final phishing domain within a short time window.
- Review SSO-connected downstream applications after account exposure Inventory SaaS apps federated to the exposed Google Workspace account and verify whether tokens, sessions, or hidden integrations were created.
Bottom line: This campaign demonstrates that browser-mediated phishing can defeat controls built around email, reputation, and static URL blocking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 8:55 am
Browser-delivered phishing is now an identity governance problem, not just a mail-security problem. When the lure starts in LinkedIn and moves through trusted web properties, the control surface shifts from inbox filtering to session, redirect, and application access governance. That means identity teams need visibility into how users reach authentication pages, not just whether an email was delivered. The practitioner conclusion is simple: account compromise pathways now span browser, federation, and SSO policy.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What should IAM teams review after a Google Workspace account compromise?
A: They should review all downstream applications that trust the account through SSO, plus any integrations, tokens, or alternate login paths that may have been created quietly. The main question is not only whether the account was recovered, but whether the attacker left a second foothold elsewhere in the identity estate.
👉 Read our full editorial: LinkedIn AiTM phishing exposes executive Google Workspace blast radius