Kaspersky has highlighted seven ways employees and organisations with social media business accounts can protect themselves from falling victim to job scams, where cybercriminals pose as Human Resource managers from high-end fashion brands to lure victims to download fraudulent files with the intent to steal credentials for Facebook Business accounts and run ads for monetary gain.
The seven recommendations are:
- Restrict access and establish rules for the use of social media business accounts.
- Create a strong password and refrain from using the same password for other websites.
- Companies should use two factor authentication to safeguard online business accounts.
- Companies should ensure BYOD devices are also protected.
- Ensure you have a security solution on your personal devices
- Do not access business accounts through a personal device.
- Avoid accessing business accounts via public Wi-Fi.
Kaspersky noted that people working in the field of digital marketing and sales are prime targets for this scam, explaining that as a first step, the scammers proactively contact victims on LinkedIn highlighting a lucrative salary package for a job role. After gauging the victim’s interest, the scammers share a malicious link and persuade candidates to download documents related to the job from a cloud storage platform to successfully meet their objective.
“Upon investigating the malicious files, Kaspersky experts found that scammers were using a malware named Ducktail to infiltrate devices. Ducktail is designed to steal user logins and passwords for Facebook Business accounts and uses stealthy techniques to remain undetected. The scam is targeted at the META region, with detections in the UAE, Turkey, Iraq, Nigeria and Lebanon,” it said.