What this bundle covers
LinkedIn does not get the same defensive attention as Microsoft 365. The detection content out there is thin, the mitigation guidance is mostly "enable 2FA" without saying which kind, and the IR procedures are scattered across LinkedIn help articles that read like marketing copy. We spent two weeks running a real AiTM proxy against LinkedIn in a controlled lab and used what we learned to write this bundle.
The attack itself is the same shape as the M365 version. Attacker registers a lookalike domain, deploys an evilginx-style proxy, sends a victim a link. Victim lands on a page that looks exactly like LinkedIn — same layout, same fonts, same flows. Every request goes through the proxy in real time. Credentials get captured on the way in. The session cookie (li_at) gets captured on the way out. With li_at alone, the attacker has the account for weeks. No password needed at replay time. Standard MFA does not help.
The bundle has four parts:
- Threat model. What the attack actually does, what gets captured at each step, and which controls break which step. Read this first.
- Detection. SPL queries for CASB and proxy logs, plus a standalone Python monitor that analyses LinkedIn login history exports. Three signals you can put into production today.
- Mitigations. FIDO2 first. CASB second. Everything else is depth. With the rollout sequence and where each control fails.
- Incident response. What to do when you suspect a LinkedIn AiTM compromise — revocation, scoping, notification, evidence preservation.
Who this is for
Anyone running a security program where LinkedIn is in scope: HR teams worried about recruiter accounts, exec protection programs, BD teams whose LinkedIn presence is critical, anyone who has had an executive's LinkedIn taken over and used to phish their network. The detection content assumes you have CASB or web-proxy log visibility into LinkedIn traffic. The mitigations work for individual users and for organizations on LinkedIn Enterprise products.
Why we wrote this
We build offensive tooling. We also publish defensive research from the same lab. This bundle is the second one — the Microsoft 365 AiTM Defense bundle was the first. Same approach: take a real attack we built and tested, then write up the defenses that actually stop it. No vendor pitches, no theoretical detections that look good but never fire on real traffic.
Status
Live. Threat model, detection bundle, mitigation guide, and IR runbook are published. Updates and additional detections will land here as the research continues.