Facebook Job Scam

Qualys has confirmed ongoing attacks against multiple brands offering work-from-home remote job offers, advertised through Facebook. Unfortunately, these scams typically see a rise in prevalence following the holidays. 

Qualys has confirmed cyber criminals are advertising jobs within Facebook to lure victims into private messaging and purporting to be Qualys recruiters advertising work-from-home jobs. These job scam texts often occur in group chats soliciting users to private message the scammer who posts the job opening. In several cases, the scammer appears to have compromised legitimate Facebook users and then targeted their direct connections.  

Victims are privately lured into installing a messaging app (e.g., Go Chat or Signal) and sharing additional details in order to receive and sign what appears as an official Qualys job offer (fake offer contains logos, correct corporate addresses, and signature lines). Victims are asked to send a copy of a government-issued photo ID, front and back, and told to digitally cash a check (explicitly told to not go to the bank) and spend funds on software for a new computer being shipped to them.

Note that Qualys only posts official job postings on our own website and other reputable job sites, never social media.

Qualys encourages users to be aware of these scams and to implement best practices to lower cyber risk, including but not limited to the following guidance specific to tactics, techniques, and procedures (TTPs) for this scam:

• Always verify offers by looking up a job opening on an organization’s official website and contacting the company directly instead of going through social media contacts that could be abused as part of a scam.
• Be highly skeptical of any job posting or solicitation that does not come from an official source, even if it appears to come from a trusted source in social media.
• Adopt the mindset: If it’s too good to be true, it probably is.
• Listen to your intuition. If it doesn’t feel right, you should probably not proceed.
• You do not need to install an app to get any job, ever! Real recruiters will call you, email, or set up a multimedia interview call at their expense without any concern – they are set up for it if they are a recruiter.
• Never accept a check and cash it digitally from an unknown virtual or digital source. Always go to the bank and treat any such check with high suspicion.

If you’ve been a victim of this fake job scam, we encourage you to visit the Facebook Help Center and report the incident to them. The Federal Trade Commission also offers helpful advice and access to resources if you believe you’ve been a victim of identity theft.

Qualys has notified Facebook and law enforcement of the scam and will continue to monitor the situation.