Impersonation of AECOM HR - The malicious actors continue to target individuals on the search for their next job.
Yesterday I spent the afternoon writing up a response to (what I thought) a reach out by AECOM for potential roles with the company. Having crafted thoughtful responses to the questions, I went to reply –
And realized this was fake. This is a scammer.
The tell-tale signs I missed at first:
· The name not matching the email address
· Weird subject line
· The email coming from GMail rather than their aecom.com domain
· The work signature block including a LinkedIn profile URL
· Email interaction tracking URL
This sample was specifically targeted as they pulled background from LinkedIn regarding my background and experience, hence my blocking the other telltale signs.
These threat actors are using mailsuite [DOT] com a Gmail plugin to track their targeted individuals (aka the u.list-opt-center [DOT] com URL). This appears to be a legit service being used for malicious activities. I have reached out to Mailsuite but have not received a response.
They are impersonating a pamlevesque [AT] aecom.com; I have reached out on LinkedIn Pam Levesque to warn them & connect with their abuse team but have not received a response. I also reached out to multiple other individuals in InfoSec/Risk/Abuse roles at AECOM with no response.
#jobsearch #fraud #impersonation #informationsecurity #abuse #risk #riskmanagement #gethired #hiring #threatlandscape #getFediHired #threatIntel #threatInteligence #cybersecurity #phishing
The full documentation of the initial interaction is on my Github:
https://github.com/obrientg/Analysis/blob/main/Impersonation%20of%20AECOM%20HR%202026Feb-3
and my #Linkedin posting:
https://www.linkedin.com/posts/activity-7425234187286351872-z1Wx
#stinkedin