Scammers are flooding posts this week with fake " " that appear to come from the platform itself, warning users of bogus policy violations and urging them to visit an external link.
The messages convincingly impersonate branding and in some cases even use the company’s official lnkd.in URL shortener, making the phishing links harder to distinguish from legitimate ones.
Over the past few days, users have been targeted with bot-like activity from several -themed profiles commenting on their posts.
These posts falsely claim that the user has "engaged in activities that are not in compliance" with the platform and that their account has been "temporarily restricted" until they visit the specified link in the .
The fabricated bearing the logo, shown below and archived here , appears fairly convincing depending on how viewers are interacting with the area and on what device.
"We take steps to protect your account when we detect signs of potential unauthorized access. This may include logins from unfamiliar locations or..." also states the link preview generated in the crafted .
The example shared above shows an alphanumeric ".app" domain that is not associated with and may raise suspicion among some users. However, other posts take this lure a step further by masking the destination links via 's official URL shortener, lnkd.in , making phishing domains harder to spot without clicking on them. This can be especially concerning if the link preview does not fully appear on certain devices.
Examples of such replies and were shared by several members, including Ratko Ivekovic , Jocelyn M. , Candyce Edelen , and Adama Coulibaly .
The very1929412.netlify[.]app phishing site in particular, seen by BleepingComputer, first elaborates on the false "temporary restriction" and advises the viewer that they need to "verify" their identity to lift the restriction:
When clicked, the "Verify your identity" button directs the user to yet another phishing domain, which is where credential harvesting actually occurs:
These are being posted from fake company pages using 's official logo and a variation of the platform's name, e.g. Linked Very.
Edelen shared several such "Linked Very" accounts that popped up on the professional networking platform in the past week.
At the time of writing, the page shown below has been taken down by :
BleepingComputer reached out to to ask if the platform was aware of this ongoing campaign.
"I can confirm that we are aware of this activity and our teams are working to take action," a spokesperson stated to BleepingComputer.
"It's important to note that does not and will not communicate policy violations to our members through public , and we encourage our members to make a report if they encounter this suspicious behavior. This way we can review and take the appropriate action."
In 2023, BleepingComputer first reported a convincing X (then Twitter) scam in which accounts impersonating major banks replied to customers’ complaints directed at the real institutions, urging them to a scammer-controlled phone number.
Users should remain vigilant and avoid interacting with , replies, or private messages that appear to impersonate and urge recipients to click external links.
As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are moving fast to keep these new services safe.
This free cheat sheet outlines 7 best practices you can start using today.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
