Anatomy of Social Engineering on LinkedIn: Real-World Tactics & Protection
Author: Mari Cherry Published on: March 25, 2025
Anatomy of Social Engineering on LinkedIn
This message exchange is a real-world example of a social engineering attack. Names and profile links have been removed for privacy.
The attacker posed as an attractive, highly educated engineer and used flattery, perceived common interests, and emotional manipulation to build rapport.
Whether human-operated or AI-generated, the messages repeatedly used the target’s name to create familiarity and attempted to provoke guilt by implying disrespect.
This type of manipulation is deceptive and should not be engaged with. If you receive messages like this, the safest response is to ignore them.
How the Social Engineering Attack Unfolded
Initial Contact
The attacker began with a friendly message after the LinkedIn connection request was accepted:
“I'm glad you accepted my link invitation. I hope I didn't bother you.”
After receiving no response, the attacker followed up the next day with another greeting.
Building Rapport
Once the target responded, the attacker:
- Complimented the target’s experience and achievements.
- Asked professional questions to appear credible.
- Shared a fabricated story about working in AI and engineering investments.
- Referenced local landmarks and hobbies such as golf to create common ground.
Frequent Re-Engagement Attempts
The attacker repeatedly sent follow-up messages such as:
“Hello, Target.”
“Are you still here?”
“😊”
These tactics are designed to maintain attention and encourage continued conversation.
Emotional Manipulation
When the target did not respond quickly, the attacker attempted to induce guilt:
“I feel disrespected because you saw the message I sent. Can you tell me why?”
This tactic pressures the target to continue engaging.
Attempt to Move the Conversation Off LinkedIn
After building rapport, the attacker tried to move the conversation to WhatsApp:
“I rarely use LinkedIn and usually use WhatsApp to keep in touch with family and friends. Do you use it?”
When the target declined, the attacker asked:
“What apps do you usually use to keep in touch with family and friends?”
Moving the conversation to another platform reduces visibility and increases the risk of fraud.
Key Social Engineering Techniques Used
- Flattery and compliments
- Use of an attractive or impressive persona
- Repeated use of the target’s name
- Manufactured common interests
- Frequent follow-up messages
- Guilt and shame tactics
- Attempts to move communication off-platform
How to Protect Yourself
- Be cautious of unsolicited connection requests.
- Verify the legitimacy of profiles before responding.
- Avoid sharing personal or business information.
- Do not move conversations to WhatsApp, Telegram, or personal email.
- Ignore messages that use guilt or emotional pressure.
- Report suspicious profiles to LinkedIn.
Compliance and Security Implications
Social engineering attacks can lead to credential theft, data breaches, and compliance violations.
Businesses subject to frameworks such as compliance requirements, NIST, and PCI DSS should include social engineering awareness in their security training programs.
Learn more in our related article: Introduction to Compliance Standards: NIST, PCI DSS, and Why They Matter for SMBs .
