HR Phishing: Fake Job Offers as an Attack Vector

How recruitment phishing works

Recruitment phishing takes two forms. In the first, attackers impersonate candidates — they send resumes with infected attachments (often Word documents with macros or PDF files with embedded code) to HR departments that naturally open attachments from unknown senders. In the second form, criminals create fake job offers impersonating well-known companies, collecting candidates’ personal data. Both scenarios are particularly effective because HR departments must open correspondence from strangers — it is their job.

Infected resumes — the most dangerous attack vector targeting HR

The most common attack vector against HR is the infected resume. Cybercriminals prepare documents that look like professional CVs — often in .docx format with hidden macros or .pdf with embedded JavaScript. Upon opening, malicious code runs installing a backdoor, keylogger, or ransomware. The ATS does not always filter such attachments. Advanced attackers tailor resumes to the company’s current job openings, increasing credibility.

Methods to protect HR departments from recruitment phishing

The first line of defense is technology: deploying a sandbox system to analyze attachments before delivery to the recruiter’s inbox, configuring filters to block macros in Office documents, and enforcing protected view for attachments. The second line is procedures: using an ATS with built-in attachment analysis instead of opening CVs directly from email. The third line is training: regular sessions for recruiters on recognizing suspicious applications. MFA on all recruitment accounts is absolutely essential.

Cybersecurity for Your Industry

Learn more about cybersecurity in your industry:

• Cybersecurity for HR & Recruitment

Why this matters for organizations

Cybercriminals use fake job offers to steal personal data and install malware. Learn attack patterns and protection methods for HR departments. In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.

Best practices for implementation

Effective implementation requires several key steps:

1. Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
2. Policy development — document requirements, roles, and responsibilities.
3. Technical controls — deploy tools and configurations proportionate to identified risks.
4. Training and awareness — engage employees in protecting organizational security.
5. Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.

Why HR is structurally the hardest department to protect

Security advice tells employees not to open attachments from unknown senders. For a recruitment team that instruction describes their job: unsolicited documents from strangers are the work, and refusing them is not an option. No amount of awareness training resolves that contradiction, which is why HR remains a reliable entry point long after the rest of an organisation has improved.

What helps is changing where the file is opened rather than who opens it: applications arriving through a portal that converts documents rather than through a mailbox, attachments detonated in a sandbox before delivery, and macros disabled by policy on the machines that handle them. The remaining risk is the impersonation of a candidate or a recruiter, and testing whether that works on a specific team — with their real processes and real public footprint — is the scope of social engineering tests.

Related terms

• Phishing
• Social Engineering
• Deepfake

Our services

• Social Engineering Tests
• Security Awareness Training

Related services and products

• Rapid7 InsightCloudSec
• Rapid7 Metasploit
• Rapid7 Threat Command