I know many of you are retired, but maybe this will help someone in your family. I got this warning from work today and it apparently happened to a local company. Never even thought about this being something they would do. I can't imagine the person that thinks they just got a great new job only to find out it was all fake and on top of that they have probably stolen their ID and made their personal finances a mess.
The most interesting new method of attacking people takes advantage of the fact that virtual jobs are starting to become widely available. Take the below scenario.
Attacker – cyber attacker
Recruiter – company’s legitimate HR Recruiter
Victim – unfortunate victim of the attack
The Recruiter posts a job req for a new software engineer. The attacker then copies that posting and goes to a site that the recruiter doesn’t use, such as Monster or Hot Jobs and reposts the job, but with their own contact information. The Victim is out searching for a job and stumbles upon the posting on Monster, and decides its worth a shot. The Victim then reaches out to the contact info on the job posting, and gets the attacker instead of the Recruiter. The Attackers have then gone on to conduct multiple interviews and asking all sorts of experience related questions, making it really hard to tell it’s a fake. The Attacker then sends the Victim a job offer and new hire paperwork. The paperwork is usually very generic and designed to look like standard IRS forms. Once the Victim has accepted the job, the Attacker then uses this same information to target the Victim with other attacks before anyone is the wiser. The job offers usually have a starting date of 3 to 4 weeks out, so the Attacker has time to exploit what they got before the Victim would expect to start working.
