3 minutes reading time
Nine days ago, I received a paid Sponsored InMail on LinkedIn from an AI assisted quantum chip partnership lead selling fake Google Ads contracts. The link in the message led directly to gate-oracle.com, a lookalike domain complete with a stolen Oracle logo and a fake Google OAuth window designed to harvest account credentials.
Right after taking screenshots of the whole circus, I hit the report button and submitted a safety ticket to LinkedIn's ad review team.
This morning, the verdict arrived in my inbox.
After taking more than a week to process a straightforward credential harvesting report, LinkedIn sent a short automated reply:
"We reviewed your report. Here’s what happened: Thanks for reporting the ad. Our automated systems reviewed the ad and determined it complies with our Ads Policies."
Read that line twice. Look at the little cartoon illustration of three corporate workers in lab coats happily checking off clipboards next to it.
A paid ad, delivered straight to the top of user inboxes, featuring an unverified profile, a fake company title, a stolen corporate logo, and a landing page built specifically to steal Google sign in credentials, officially complies with LinkedIn Ads Policies.
If you are a regular person trying to connect with an old colleague, LinkedIn's algorithms monitor your activity and restrict your account if you send too many invites. If you post an external link in a text update, the feed algorithm throttles your reach to keep users inside their walled garden.
But if you set up a fake domain, copy an enterprise logo, and hand LinkedIn a credit card to run a credential harvesting campaign, their automated review bot gives you a rubber stamp and tells the victim that everything is operating according to company policy.
It is a hilarious, brutal confirmation of what every corporate platform actually cares about.
Identity verification, trust and safety panels, and community guidelines are just marketing window dressing for users. The moment money enters the equation, ad revenue overrides safety. As long as the payment clears, a phishing campaign gets the exact same VIP delivery as a legitimate hiring campaign.
Since LinkedIn's internal review system considers credential theft a policy-compliant feature, the next step is making noise where automated bots cannot quiet it down. The case is now being sent directly to LinkedIn's support escalations, Oracle's security alert team, and the National Cyber Crime Reporting Portal.
Next time LinkedIn sends you a notification about their commitment to professional trust and platform safety, just remember that in their official handbook, phishing for your passwords is a compliant business model.
Image Credit: Les Gens de Justice by Honoré Daumier via Wikimedia Commons