← Back

Isolate Social Network Referrals

Isolate Social Network Referrals

Links shared through social networks are increasingly used to distribute malware, phishing sites, and scams due to implicit trust in social connections. Attackers compromise social media accounts or create fake profiles to share malicious links that appear legitimate.

Example Policy

Screenshot for Isolate Social Network Referrals

Follow These Steps

  1. Click on Launch Attack Simulation button
  2. Click on the "website" link provided in "About us" section
  3. As referrals is from Linkedin, the page will be blocked

Details

Social networks have become fertile ground for cybercriminals due to their extensive user bases and the inherent trust users place in content shared by friends, family, and influential accounts. Attackers exploit this trust by compromising legitimate profiles or fabricating fake accounts that disseminate malicious links cloaked as benign content. These links often lead to drive-by downloads, credential-harvesting websites, or scams designed to steal personal and financial information. Cybercriminals also manipulate social engineering tactics on these platforms by leveraging current events, trending topics, or emotional triggers to increase user engagement with malicious content. For example, during tax season or major news events, attackers embed malware or phishing links within posts or messages that appear relevant and trustworthy. The rise of third-party apps and integrations within social media ecosystems further widens the attack surface, allowing attackers to infiltrate these apps or use them as carriers for malware or scams.

Impact

Social media–based threats can severely impact both individuals and organizations. Victims risk malware infections, credential theft, and unauthorized access to other online services, often leading to identity fraud and financial losses. Sensitive information exposed in these attacks may also be sold on dark web markets, creating long-term exploitation risks. For organizations, compromised employee accounts disrupt operations, expose intellectual property, and damage reputation. Hijacked accounts are then weaponized to propagate malicious content further, exploiting the inherent trust of social connections to create cascading compromises across entire networks of users, customers, and business partners.

Indicator of Compromise (IOC)

- Malicious links repeatedly shared via compromised or fake social profiles - Shortened or obfuscated URLs redirecting to phishing or malware-hosting sites - Links pointing to newly registered or suspicious domains spread through social platforms - Multiple users reporting identical malicious links from trusted contacts - Unusual surge of outbound clicks to flagged or blacklisted URLs from corporate networks