Security researchers have flagged a surge in phishing attacks targeting LinkedIn direct messages, with cyber-criminals using a complex series of redirects through trusted Google and Microsoft services to mask the destination of malicious links.

Push Security’s latest research reveals the ‘undetected and unreported’ threat lurking within the professional networking platform, as threat actors increasingly exploit LinkedIn DMs to deliver seemingly benign links.

After a series of redirects through legitimate platforms and cloud services, such as Google Sites, Google Search, Firebase, and Microsoft Dynamics, Push found victims were presented with a Microsoft-branded “view document” page, protected by a Cloudflare Turnstile challenge. 

Once completed, the victim was served an adversary-in-the-middle (AiTM) phishing page designed to steal the user’s Microsoft session, bypassing controls like MFA.

By embedding redirects through reputable domains, the cyber firm said that attackers can dramatically reduce the likelihood of their links being flagged or blocked by automated tools, while deploying Cloudflare Turnstile bot protection can prevent automated analysis of their phishing sites.

That, coupled with page obfuscation techniques, such as randomised visual elements, titles, and code structures, can defeat detection signatures, bypassing routine safeguards with inboxes.

“These tactics are becoming increasingly common in the phishing ecosystem and reflect just how well attackers understand how modern defences operate,” said Jacques Louw, chief product officer at Push Security.

“Because LinkedIn sits outside enterprise phishing filters and other traditional cybersecurity solutions, attackers are able to initiate contact, send malicious links, and socially engineer victims with fewer barriers.

“The result is a blind spot in enterprise visibility and control, leaving employees exposed even on devices managed by corporate IT.”

This is the second LinkedIn-targeted campaign identified by Push in recent months, suggesting that attackers are increasingly viewing the platform as a reliable route to reach high-value targets such as executives, sales leaders, and hiring managers.

The security firm said that the rise of social media–delivered phishing campaigns underscores a broader shift in the evolution of attacker strategy, with adversaries turning to less-guarded communication channels as corporate email defences improve.

Recommended reading

• Darcula Phishing Scam Claims 800K+ Victims
• Hackers Hiding Phishing Sites in Split and Layered QR Codes
• Report: Phishing Beats Ransomware as Top Security Concern in 2025

Push researchers expect this trend to continue, with future phishing operations blending across channels and platforms that sit outside traditional enterprise security visibility, and attackers utilising legitimate cloud services to maximise reach and minimise the chance of detection.

“These campaigns show how attackers are bypassing every traditional control point — email gateways, link scanners, domain filters — by abusing the same trusted tools that enterprises rely on,” added Louw.

“We’re seeing adversaries take advantage of the trust placed in legitimate services like Google and Microsoft to build redirect chains that hide their activity. This level of sophistication means phishing is becoming increasingly difficult to detect and stop for most organisations.”