Sunday, June 15, 2025
HomeVirusNew Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and...

New Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and Compromise the Victims PC

Published on

SIEM as a Service

Follow Us on Google News

World’s largest professional network  LinkedIn That has more than 500 Million Registered users. LinkedIn messenger Platform Vulnerability Allows attacker spread Malware into victims by taking advantage of LinkedIn’s security restrictions Flow.

LinkedIn messenger is the Mostly used Future Platform which helps for professional Community to Share their skills, Messenger easily sends resumes, transfer academic research and share job descriptions from the LinkedIn community.

Normally, LinkedIn security restrictions scan the Malicious activities of the attached File when user send valid files via messenger.

- Advertisement - Google News

But this LinkedIn messenger Flow allows attacker bypass the LinkedIn security restriction and send a Malicious file which normally looks like a legitimate file but actually its Malicious one.

Based on the LinkedIn Security Restriction, following file format allow to upload and attach to a message.

  • Documents – csv, xls, xlsx, doc, docx, ppt, pptx, pdf, txt.
  • Images– gif, jpeg, jpg, png.

Also Read: Bypass an Anti-Virus Detection with Encrypted Payloads using VENOM Tool

How Does This  Vulnerability Works

This Vulnerability Allows to Attacker upload any Malicious file into LinkedIn messenger by Modifying the file Extension of the Malicious file.

According to Checkpoint Research, A PowerShell script was uploaded into LinkedIn messenger by modifying the Malicious file Extension as .pdf .

LinkedIn Messenger

Malicious File uploading into LinkedIn

Later, Attacker Successfully sends the Malicious file by controls the name of the file (Name parameter), the format of the file (MediaType parameter), and the file extension.

In this Below Response , we could see that LinkedIn Security Restriction will be allowed(Virus Not Detected) to upload the Malicious file because of Modifying the File Extension.

LinkedIn Messenger

LinkedIn Virus Check ByPassed

so Finally Malicious File will be successfully uploaded without detecting by the LinkedIn security restrictions and once Victims click the file then it will be triggered and successfully infect the victim’s Machine.

Video Demo For Malware Upload into Messenger

Also Abuse the DOCX, XLSM file with embedded Malicious Macro then uploaded successfully to LinkedIn’s CDN, passing the virus check and sent to the victim.later Victims will be Compromised by the Malware.

Checkpoint Reported to LinkedIn Security on 14 June 2017 and LinkedIn Successfully Fixed the Issue.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

New KBOT Virus Injecting Malicious Code in Windows Executable Files to Steal the Victim’s Bank & Personal Data

You're hearing the term "Virus" instead of malware after a long time right!! Yes,...

The Olpair Virus – how to get rid of it

Olpair occasionally referred to as Openload.co Pair is a pop-up virus attributed to the...

Top 10 Dangerous Computer Viruses of All Time

1. Storm Worm The latest virus on our list is the dreaded Storm Worm. It...