LinkedIn Confidential — Pt. 2

“Spencer Johnson” lists jobs at Confidential from a location that does not exist — Atlantis. The invented geography is a tell, but the jobs are live and accepting applicants.

“Mia Susan” appears on a hiring team alongside Lucia Milan — the only real profile in the group. Every other profile attached to the listing is fabricated. The Confidential page exploit allows any profile to attach to any job listing without the original job poster’s knowledge or consent.

The same operation behind “Mia Susan” was also running “Vivian K. Collins.” The “Mia Susan” profile came down. “Vivian K. Collins” remained active. Two profiles, one operation — a redundancy strategy used throughout this network to survive takedowns.

Christine Orlando is a real person who works for Johnson & Johnson. “Vivian K. Collins” is using Christine’s name to make the scam look credible. This is identity fraud against a named individual at a named employer — attaching a real professional’s identity to a fabricated LinkedIn account.

“Helen (Thompson) Thomas” presents as a professional recruiter attached to the Confidential network. The parenthetical middle name construction is a documented pattern in this network — an attempt to appear more formal and credible.

Part 2 documents a pattern not seen in Part 1: Confidential fake recruiters are not just posting original fraudulent listings — they are scraping real jobs from legitimate staffing firms and re-posting them under the Confidential banner.

Aerotek: A real Aerotek job was lifted and re-posted as a Confidential listing. It cannot be a Confidential job if the source is on the firm’s own website. This job should only be applied to on Aerotek’s site.

Adecco: A real Adecco listing was similarly scraped and re-posted.

Robert Half: Same pattern. Real job. Fake wrapper.

“Lyra Selene” uses a profile photo stolen from Alison Neely Stone. The name has the same constructed quality as others in this network — a first name and a second name that don’t form a natural surname. One of “Lyra Selene’s” listings surfaces a hiring team where every profile except Lucia Milan is fake. The real Lucia Milan’s presence is what makes the listing appear legitimate.

“Linda James” uses a photo stolen from Louise Pinkerton — the same real person whose image was used by “Jonny Smith” in Part 1. One stolen photograph. Two fraudulent identities. Two separate attack vectors using the same real person’s face.

“John Castle” uses the photograph of a sitting U.S. President for identity fraud. Using a federal official’s picture to construct a fake identity and defraud others falls under federal law: 18 U.S.C. § 912 (False Impersonation of an Officer or Employee of the United States) and 18 U.S.C. § 1028 (Fraud and Related Activity in Connection with Identification Documents).

“Hellen Grey” uses a photo stolen from Hedvig Wessel, a Norwegian skier. The geographic and professional distance between a Norwegian athlete and a LinkedIn recruiter for “Confidential” illustrates how broadly this network casts its identity theft net.

“Charlotte Flair” uses a photo stolen from Dr. Amy Loden Tiffany and is attached to 38 job listings. One fake profile. One stolen face. 38 separate attack vectors through which job seekers can submit their personal information to a threat actor.

“Kimberly Jan Christine” uses a stock photo sourced from Freepik. The triple-given-name construction is artificial. No identity theft required — a freely available stock image constructs a fake professional identity.

“Azeezat Omosalewa” uses a photo stolen from Carol Cadou and is attached to 88 job listings at time of capture. 88 separate opportunities to harvest personal data from job seekers who believe they are applying to real roles.

“Enitanlo Moadama” uses a photo stolen from Betty McCollum, a U.S. Representative. Using the image of an elected official carries the same federal implications as “John Castle.” The network’s willingness to steal the faces of politicians is a strategy for borrowed legitimacy.

“Marigold Bramwell” uses a photo stolen from Donna Shalala — a former U.S. Secretary of Health and Human Services and former U.S. Representative. The pattern of stealing from Cabinet members and elected officials continues across multiple profiles.

A real job, posted by a verified job poster, with fake profiles attached to the hiring team. This is the core vulnerability documented in Part 6 and evidenced here in Part 2: threat actors attach themselves to real listings without the actual poster’s knowledge. “Cynthia Robert,” “Williams Precious,” “Charlotte Hannah,” and “James Matter” appear alongside the real poster — none of them are real.

“James Matter” uses a photo stolen from Damien English and is one of the fake profiles documented above — attached to a real, verified job posting. The face belongs to a real person. The name is constructed. The job listing is someone else’s.

“Petty S. Kendra” uses religious language and scripture references in their profile to appear trustworthy and authentic — weaponizing faith as a credibility signal to deceive job seekers. “Richard Brandney” operates within the same network.