Rogue hirer, rogue hiree: workplace cyber threats to individuals and businesses

Thursday 25 September 11:30 - 12:00, Red room

Chris Boyd (Rapid7)

In a volatile job market, fraudsters and threat actors are causing misery, data loss, and financial harm for employers and employees alike.

While DPRK threat actors use elaborate laptop farms and stolen identities to work their way inside organizations, individual applicants exploit gaps in the hiring process to make their way from shortlisting to onboarding. Meanwhile, unwary job applicants are forced to run a gauntlet of fake companies, tax fraud, money muling, and data harvesting while looking for genuine employment.

This presentation zeroes in on business-centric threats, exploring the most common archetypes of rogue hires. We explain what attackers want, how they intend to get it, and the tactics used to make a beeline for your organization's most valuable assets. We provide actionable guidance for securing the riskiest stages of hiring, and how you can channel adversaries toward total process failure.

Attendees will gain insight into the kind of attacks an organization needs to defend against, and a list of questions they can take back to base to ask, "Do we have a plan for this?".

The paper expands on these questions, covering business-centric threats and also the many risks which face individual job applicants.

From LinkedIn to dedicated hiring portals, the potential for falling into a fake job trap and get-rich-quick schemes is high. Malicious files hidden in coding tests, compromised LinkedIn pages promoting money muling, and spam mails arising from genuine job portal applications will all be highlighted and countered with common-sense solutions.

Both paper and presentation aim to highlight the most significant hazards facing the workplace, or emanating from it, and give attendees practical steps to reduce the risk arising from malware attacks, data exfiltration, and sending funds to sanctioned regimes. Your hiring activities and digital defences will ultimately become more robust, no matter which side of the hiring table you sit at.

Chris Boyd Chris is a seven-time Microsoft MVP in consumer security and former Director of Research for FaceTime Security Labs. He has presented at RSA, Rootcon, VB and SecTor, and has been thanked by Google for his contributions to responsible disclosure in their Hall of Fame. He has been credited with finding the first rootkit in an IM hijack, the first rogue web browser installing without consent via IM, and the first DIY Twitter botnet kit.

Back to VB2025 Programme page

Back to VB2025 conference page

Other VB2025 papers