Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team
Summary: Since August 2025, Unit 42 has tracked phishing campaigns in which attackers impersonate Palo Alto Networks talent acquisition staff, using scraped LinkedIn data to target senior-level professionals with personalized lures. The scheme manufactures a bureaucratic barrier around the candidate's CV and pushes victims toward paying a third-party "expert" for resume reformatting and "executive ATS alignment" within a pressured review window.
Why it matters: The lure works because it turns a job seeker's ambition into a payment: attackers invent a review deadline and sell a paid fix that Palo Alto Networks states its recruiters will never request as a condition of employment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026