Social media

Summary

Attackers are delivering phishing links via social media platforms like LinkedIn, Facebook, and X, as well as message boards like Reddit and Discord — essentially, anywhere you can be contacted directly by an unknown sender.

By nature, social media apps are typically accessed via personal accounts and are designed to enable users to communicate outside of the organization, but may still be used for work purposes and accessed from corporate devices. This makes them one of the easiest and least-monitored vectors for external attackers to reach corporate targets.

Users expect to engage with, and be contacted by, individuals outside of your organization, increasing the likelihood of engagement with malicious links.

In many cases, these apps straddle our business and personal lives and can expect to be accessed from corporate devices for work purposes.

Examples