You Didn't Get Phished - You Onboarded the Attacker

"Meet "Jordan from Colorado," who has a strong resume, convincing references, a clean background check, even a digital footprint that checks out. On day one, Jordan logs into email and attends the weekly standup, getting a warm welcome from the team. Within hours, they have access to repos, project folders, even some copy/pasted dev keys to use in their pipeline. A week later, tickets close faster, and everyone's impressed. Jordan makes insightful observations about the environment, the tech stack, which tools are misconfigured, and which approvals are rubber-stamped. But Jordan wasn't Jordan. And that red-carpet welcome the team rolled out was the equivalent to a golden key, handed straight to the adversary."

"The modern con isn't a malicious link in your inbox; it's a legitimate login inside your organization. While phishing is still a serious threat that continues to grow (especially with the increase in AI-driven attacks), it's a well-known attack path. Organizations have spent years hardening email gateways, training employees to recognize and report malicious content, and running internal phishing tests. We defend against a flood of phishing emails daily, as there's been a 49% increase in phishing since 2021, and a 6.7x increase in large language models (LLMs) being used to generate emails with convincing lures. It's becoming significantly easier for attackers to run phishing attacks. But that's not how Jordan got in. Despite numerous defenses pointed at email, Jordan got in with HR paperwork."

Onboarding processes present a growing attack vector where adversaries pose as legitimate hires to gain immediate access to internal systems. Fake candidates can pass resumes, references, background checks, and produce valid-looking digital footprints to blend in. Warm onboarding and rapid access provisioning provide attackers with repos, project folders, and reusable dev keys. Organizations concentrate defenses on phishing and email security, but those controls do not address HR and onboarding trust gaps. Remote hiring and decentralized work increase exposure. Attackers exploit misconfigurations, weak approvals, and overlooked access policies to move quickly and harvest credentials, causing rapid, high-impact compromises.

Read at The Hacker News