From LinkedIn to X, GitHub to Instagram, there are many alternatives to share work-related data. However posting might additionally get your organization into hassle.
01 Dec 2025
•
,
5 min. learn
Worker advocacy has been round as an idea for over a decade. However what began out as a well-intentioned solution to improve company profile, thought management and advertising and marketing, additionally has some unintended penalties. When professionals submit about their work, their firm and their position, they’re hoping to achieve likeminded professionals, in addition to prospects and companions. However risk actors are additionally paying consideration.
As soon as that data is within the public area, it’s usually used to assist construct convincing spearphishing or enterprise e mail compromise (BEC)-style assaults. The extra data, the extra alternative for nefarious exercise that might find yourself hitting your group onerous.
The place are your workers sharing?
The principle platforms for sharing such data are the same old suspects. LinkedIn is probably the obvious. It might feasibly be described as the most important open database of company data on the earth: a veritable treasure trove of job titles, roles, tasks and inside relationships. It’s additionally the place recruiters submit job listings, which can overshare technical particulars that may be leveraged in a while in spearphishing assaults.
GitHub is probably higher identified in a cybersecurity context as a spot the place absent-minded builders submit hardcoded secrets and techniques, IP and buyer particulars. However they may additionally share extra innocuous details about undertaking names, CI/CD pipeline names and knowledge on what tech stacks and open supply libraries they’re utilizing. They could additionally share company e mail addresses in Git commit configurations.
Then there are the basic consumer-facing social platforms like Instagram and X. That is the place workers are more likely to share particulars on their journey plans to conferences, and different occasions which may very well be weaponized in opposition to them and their group. Even data in your firm web site may very well be helpful to a would-be fraudster or hacker. Suppose: particulars on technical platforms, distributors and companions, or main company bulletins reminiscent of M&A exercise. It might all present a pretext for classy phishing.
RELATED READING: Is your LinkedIn profile revealing an excessive amount of?
Weaponizing data
The primary stage of a typical social engineering assault is intelligence gathering. The following is weaponizing that intelligence in a spearphishing assault designed to trick the recipient into unwittingly putting in malware to their system. Or doubtlessly to sharing their company credentials for preliminary entry. This may very well be achieved by way of an e mail, textual content or perhaps a cellphone name. Alternatively, they may use data to impersonate a C-level government or provider in an e mail, cellphone or video name requesting an pressing wire switch.
These efforts normally require a mix of impersonation, urgency and relevance. Listed here are some hypothetical examples:
- An adversary finds LinkedIn data on a brand new starter in an IT position at firm A, together with their core position and tasks. They impersonate a key tech vendor claiming that an pressing safety replace is required, referencing the goal’s title, contact particulars and position. The replace hyperlink is malicious.
- A risk actor finds data on two colleagues in GitHub, together with the undertaking they’re engaged on. They impersonate one in an e mail asking the opposite to evaluate an hooked up doc, which is booby-trapped with malware.
- A fraudster finds a video of an government on LinkedIn, or a company web site. They see on that concentrate on’s Instagram/X feed that they’re going to be presenting at a convention and might be away from the workplace. Realizing that the exec could also be onerous to contact, they launch a deepfake BEC assault utilizing video or audio, to trick a finance group member to wire some pressing funds to a brand new vendor.
Cautionary tales
The above are solely hypotheticals. However loads of actual examples exist of risk actors utilizing “open supply intelligence” (OSINT) methods within the early levels of assaults. They embrace:
- A BEC assault which price Youngsters’s Healthcare of Atlanta (CHOA) $3.6m: Menace actors doubtless scoured press releases a couple of newly-announced campus, to seek out out extra particulars together with the hospital’s building accomplice. They might then have used LinkedIn and/or the company web site to determine key executives and finance group members of the development agency concerned (JE Dunn). Lastly, they impersonated the CFO in an e mail to the CHOA finance group requesting they replace their fee particulars for JE Dunn.
- Russia-based SEABORGIUM and Iran-aligned TA453 teams use OSINT for reconnaissance forward of spearphishing assaults on pre-selected targets. In response to the UK NCSC, they use social media {and professional} networking platforms to “analysis their [targets’] pursuits and determine their real-world social or skilled contacts.” As soon as belief and rapport have been established over e mail, they ship a hyperlink to reap victims’ credentials.
Cease the share? The way to mitigate spearphishing threat
The dangers of oversharing are actual, however luckily the cures are simple. Probably the most potent weapon in your armory is training. Replace safety consciousness packages to make sure that all workers, from executives down, perceive the significance of not oversharing on social media. In some instances, this may require a cautious rebalancing of priorities, away from worker advocacy in any respect prices. Warn employees to keep away from sharing by way of unsolicited DMs, even when they acknowledge the person (as their account might have been hijacked). And guarantee they’ll spot phishing, BEC and deepfake makes an attempt.
Again this up with a strict coverage on social media use, defining pink traces on what can and might’t be shared, and making use of clear boundaries between private {and professional}/official accounts. Company web sites and accounts might also should be reviewed and up to date to take away any data that may very well be weaponized.
Multi-factor authentication (MFA) and robust passwords (saved in a password supervisor) also needs to be a given throughout all social media accounts, in case skilled accounts are hijacked to focus on colleagues.
Lastly, monitor publicly accessible accounts the place potential for any data that may very well be leveraged for spearphishing and BEC. And run pink group workouts in opposition to workers to check their consciousness.
Sadly, AI is making it quicker and simpler than ever for risk actors to profile targets, gather OSINT after which craft convincing emails/messages in excellent pure language. AI-powered deepfakes improve their choices but additional. The underside line must be, if it’s within the public area, anticipate a cybercriminal additionally is aware of about it … and can come knocking quickly.
