Hope Is an Attack Surface

October 21, 2026 · Chris Ruggieri

A Cybersecurity Awareness Month Case Study in Fake Recruiters, Social Engineering, and the Magic 8 Ball

Cybersecurity Awareness Month usually brings the same familiar advice: use strong passwords, enable MFA, patch your systems, watch for phishing, and do not click suspicious links.

All good advice.

After nearly 30 years in technology and cybersecurity, I would add another:

Protect your hope.

Because hope is an attack surface.

And if you happen to be looking for work, attackers know exactly where to find it.

The Dinner Bell

I recently made my job search public on LinkedIn.

The public "I'm on the market" job post.

Within roughly a day, the post had reached thousands of people and, more importantly, most of that exposure was outside my existing network. It generated legitimate conversations, introductions, recruiter outreach, and several useful professional connections.

It also apparently rang the dinner bell for every questionable recruiter account on LinkedIn.

Some approaches were laughably obvious.

Others were much more polished.

After encountering the same general pattern repeatedly, I stopped looking at these simply as annoying messages and started looking at them the same way I would look at any other suspicious activity:

What is the pattern? What is the objective? And what happens next?

Contestant Number One: A Completely Normal Beginning

The first account opened with what looked like perfectly normal recruiter outreach.

I was asked whether I was primarily interested in Information Security leadership, broader IT Director positions, or both, and what salary range I was targeting.

Nothing about that message was inherently suspicious.

The initial message was entirely plausible recruiter outreach.

I answered the questions in detail.

I explained that I am a security professional first, that I still enjoy being hands-on, that I value mentoring and developing people, and that I have traditionally operated as a player-coach.

I also made something very clear that has become increasingly important in my search: title is not what I am chasing.

The mission, the problems being solved, the people I would work with, and the opportunity to continue learning while passing on what I have learned matter more to me than whether the title says Director, Principal, Lead, or something else.

I then answered the compensation question directly.

Role preference, leadership style, security focus, and compensation were all answered.

The First Context Failure

Then things started getting strange.

Despite having just been given my compensation target, the account asked me for my salary range again.

It also asked about my notice period and availability, which was reasonable enough, and requested my resume.

Then, six minutes later:

?

Less than two hours after that:

Are you still there?

Then, after midnight:

.

Repeated questions, a six-minute question mark, "Are you still there?" and eventually a period.

Those messages had started arriving around 8:00 PM Central Time.

I was eating dinner and spending time with my family.

Apparently, the recruiting emergency could not wait.

The following morning, I explained the delay, pointed out that my resume was already attached to the original LinkedIn post, repeated the compensation target I had already provided, and stated that I was available immediately for the right opportunity.

Resume location, compensation, and availability were now explicitly repeated.

Then Came "Jay"

A few minutes later, the account responded with a generic explanation of its supposed role: identify suitable opportunities and present my resume to companies and hiring managers.

There was one small problem with the original version of that message.

Thank you for sharing your resume, Jay.

My name is Chris.

The pre-edit version. Apparently my name was Jay for a few minutes.

A recruiter handling a large number of candidates can absolutely make a copy-and-paste mistake.

By itself, that proves nothing.

What made it interesting was what happened next.

The message was edited.

"Jay" disappeared.

The Question Mark Becomes a Recurring Character

The corrected message still did not contain a question.

Nevertheless, eight minutes later another message arrived:

?

At that point, I genuinely wondered whether I had overlooked something.

I was sitting at a doctor's office working through messages on my phone, so I went back through the thread.

There was no unanswered question.

So I asked:

Was there a question in your last message that I missed?

The answer:

Not at all, just expecting your understanding.

No question had been missed. The question mark was apparently just... there.

I explained that I had simply wanted to make sure I had not missed something while going through messages at the doctor.

The answer was:

Ohh. I understand

Fine.

Strange, but fine.

By now, however, the indicators were beginning to stack:

• Repeated questions that had already been answered
• Failure to retain basic conversational context
• Unusual pressure for an immediate response
• The wrong candidate name
• An edited message correcting that mistake
• No actual employer
• No actual requisition
• No actual role

None of those things, standing alone, proves fraud.

Cybersecurity investigations are rarely about one indicator.

They are about patterns.

At this point I had a hypothesis. I saw the pattern. Hell, Ray Charles and Stevie Wonder could see that pattern.

But suspicion is not evidence.

So I let him cook.

The Fake Recruiter Funnel

By this point I had already encountered variations of the same sequence elsewhere.

The pattern usually looks something like this:

Recruiter outreach → conversation → resume request → resume criticism → ATS warning → optimization recommendation → paid resume service

The recruiter does not begin by selling anything.

That would immediately trigger skepticism.

Instead, the opportunity creates hope.

The conversation creates rapport.

The resume request creates investment.

Then comes the manufactured problem.

And There It Was

At 9:55 AM, the supposed recruiting conversation suddenly became an ATS consultation.

I was told that my resume had problems involving:

• ATS formatting
• Professional profile length
• Career targeting
• Achievement quantification
• Experience clarity
• Grammar and consistency
• Technical-skills prioritization
• Certification presentation
• Career positioning

The "recruiter" had now become an unsolicited ATS consultant.

Some of those topics are perfectly legitimate things to consider when building a resume.

That was not the issue.

The issue was that this person had approached me as someone supposedly helping me find employment.

Yet no employer had appeared.

No hiring manager.

No requisition.

No interview.

No actual opportunity.

Instead, my resume had become the problem.

The critique ended with:

Are you open to recommendations or suggestions?

Then, three minutes later:

?

Resume problem identified. Recommendations offered. Another question mark for good measure, because apparently "?" has a permanent casting role in this conversation.

The Chess-Player Problem

Unfortunately, there was something in the original LinkedIn post the account apparently had not paid much attention to.

I had described myself as having a:

Chess-player mentality.

That is not marketing language.

It is how I approach cybersecurity, problems, decisions, and even people.

I rarely look only at the move directly in front of me.

I look at what the other side wants.

What they think I know.

What they expect me to do next.

What assumption their plan depends on.

And what happens several moves later: the second, third, fourth, and fifth-order effects downstream.

By the time the ATS assessment arrived, I had already anticipated where the conversation was probably going.

I was no longer being recruited.

I was observing a process.

The Magic 8 Ball Makes Its Debut

At that point, I decided the experiment had run long enough.

So I told the account exactly what I had observed.

Pattern identified. Experiment concluded.

And because sometimes cybersecurity requires sophisticated analytical tooling, I consulted our newest threat-intelligence platform.

🎱 shakes Magic 8 Ball

Are you a scammer?

All signs point to yes.

Reported.

But Wait, There's More

You would think that would end the conversation.

It did not.

The account came back defending the ATS critique:

The points I highlighted were based on what modern ATS systems and recruitment standards typically assess in a resume.

It also insisted that the intent was not to scam or mislead me.

Fair enough.

Then, 39 minutes later:

?

At this point the question mark had achieved permanent recurring-character status.

Even after being called out, the ATS narrative continued. And so did the question marks.

There was really only one appropriate response left.

🎱 shakes Magic 8 Ball again

Ask again later.

Just because, as my footer indicates, everything I do is powered by Caffeine, SARCASM, and Insanity!

Ready Player 2

While all of this was happening, another account had started a conversation with me.

This one presented itself as a Board Director, Senior Executive Consultant, former President and CEO, COO, and international business leader.

The opening message was, again, completely reasonable.

He said he worked with companies globally to place senior talent and wanted to know what kind of role I was targeting.

Another perfectly plausible opening.

I answered him in detail.

Information Security leadership was my primary target, but I made it clear that title itself was flexible.

Director.

Senior Director.

Head of Security.

Principal.

Staff.

Senior hands-on architecture or engineering.

If the mission and scope were right, all of them were on the table.

I described my strongest areas:

• Security engineering
• Security architecture
• Security operations
• IAM/PAM
• Zero Trust
• Cloud security
• Cyber defense
• AI-enabled security automation

I also explained, again, that I still enjoy being hands-on while mentoring and developing people, so I tend to operate as a player-coach.

Finally, I covered location and compensation: Alabama-based, remote preferred, Birmingham-area hybrid acceptable, travel acceptable, and approximately $185K+ base depending on scope and total package.

Role, technical focus, leadership style, geography, and compensation. Pretty comprehensive.

The next morning he asked another reasonable question:

What matters most to you in your next move?

Compensation?

Growth?

Flexibility?

Stability?

Fair question.

So I answered that too.

Stability and meaningful work were at the top of the list.

I was not chasing another title or looking for a stepping stone.

I wanted somewhere I could stay, solve difficult problems, contribute at a high level, and help develop the people around me.

Again, I explained that the ideal role would let me remain a player-coach rather than moving completely away from the technology.

Again, I gave the compensation target.

Stability, meaningful work, player-coach responsibilities, and compensation.

I then completed the answer by explaining my geographic constraints in detail.

Remote was preferred.

Birmingham-area hybrid or on-site was fine.

Travel was fine.

Relocation was the one thing that was not on the table because of family obligations.

I also explained that growth, for me, had much less to do with title than with impact, complexity, learning, and passing on what I have learned over the years.

His next question?

What salary range are you working with, and are you open to relocating or strictly looking for remote or local roles?

I had literally answered both questions in the message immediately above.

Seriously..... Time for my ??? to enter the chat.

So I pointed that out.

Politely.

I restated the compensation target.

I restated the no-relocation requirement.

I restated remote preference, Birmingham-area hybrid/on-site availability, and willingness to travel.

His response:

Brilliant, this is really helpful. Would you be comfortable sharing your CV?

After making me repeat myself, he finally asked for the CV. I sent it at 10:43 AM.

Send Me Your CV

Fine.

I sent it.

At:

10:43 AM.

Six minutes later, at 10:49 AM, I received this:

Thanks for sharing your CV I've spent some time reviewing your background alongside our team.

Six.

Minutes.

Apparently, in those six minutes, my resume had been reviewed "alongside our team," compared against active searches, and matched to a high-priority opportunity that fit my exact profile.

Resume sent at 10:43. Team review and exact-match role at 10:49.

Could someone skim my resume in six minutes?

Absolutely.

Could someone feed the resume and our conversation into an LLM and ask it to summarize my background or generate a fitting role?

Absolutely.

Could an executive search consultant circulate nearly three decades of experience among a team, have that team meaningfully review it, compare it against internal retained searches, discuss the candidate, identify the correct role, and compose a thoughtful response?

Six minutes becomes a much more interesting number.

The Miracle Job

And what a role they found.

Director, Information Security Engineering & Operations.

Full-time.

Permanent.

Remote.

US-based.

$200,000 to $220,000 base.

Annual performance bonus.

Equity package.

And the position overview specifically described a:

high-impact "player-coach" capacity

Funny.

That phrase sounds familiar.

Remote. $200K-$220K. Hands-on Director. Player-coach. An extraordinary coincidence.

Then came the technical responsibilities.

Zero Trust.

Hybrid multi-cloud.

AWS.

Azure.

Microsoft 365.

Microsegmentation.

Entra ID.

CyberArk PAM/PSM.

Zscaler.

Splunk.

QRadar.

CrowdStrike.

Threat hunting.

Vulnerability management.

Incident command.

AI governance.

Automated remediation workflows.

REST APIs.

NIST CSF.

SOC 2.

PCI DSS.

ISO 27001.

At this point the alleged job description was starting to look remarkably like somebody had used my resume as the requirements document.

Then came the required qualifications.

Ten to fifteen years of hands-on technology and cybersecurity experience.

Manager, Director, or Principal-level leadership.

Proven player-coach experience.

Strategic planning.

Team mentorship.

Direct technical execution.

Even the operating model mirrored how I had just described myself.

Cloud Security.

IAM/PAM.

CyberArk.

Entra ID.

Zscaler ZIA/ZPA.

SIEM/EDR.

Python.

PowerShell.

REST APIs.

Incident response leadership.

And then:

Relevant certifications preferred (C|CISO, CISSP, CEH, or equivalent).

At this point, if the job description had included my home address and favorite coffee order, I would not have been terribly surprised.

Technical stack, leadership profile, certifications, and working style. Almost everything fit.

Could a legitimate role genuinely fit me this well?

Of course.

That is exactly why a good pretext works.

The most effective social-engineering story is rarely something unbelievable.

It is something the target very much wants to believe.

Verification Time

So I did not accuse him of anything.

I asked questions.

What company was the role with?

What was the requisition number?

What was his relationship to the employer?

And I explained precisely why I was asking.

Since making my search public, I had dealt with a ridiculous number of fake recruiter approaches that began with a supposedly excellent opportunity and then pivoted into:

Your resume needs ATS optimization.

Or some paid resume service before anything real was ever put in front of me.

Trust, but verify. Actually, scratch that. Zero Trust: verify first.

The response was unusually specific about one thing.

I was told:

I do not sell resume optimization services, and I never use fake hooks to upsell anything.

Remember this statement. It becomes rather important in a few minutes.

He described himself as an independent executive search consultant working directly on retained and targeted client mandates.

He supplied an engagement identifier.

He claimed a direct talent advisory and search relationship with the hiring committee and executive leadership team.

He said my resume would go directly to decision-makers rather than an automated portal.

What he did not provide was the company name.

Interesting.

Still not definitive.

I acknowledged the explanation and told him the role itself clearly aligned with my background.

I also gave him permission to continue reviewing my resume against his supposed internal specification.

In other words: go ahead. Let's see where this goes.

The pot was simmering nicely.

It's a Trap!

At this point, everything had lined up almost too perfectly.

The suspiciously precise role.

The six-minute "team review."

The unnamed client.

The explicit assurance that there would be no resume-optimization upsell.

And then, right on schedule...

Admiral Ackbar has entered the threat model.

At 11:35 AM, the allegedly active executive search stopped being about the job.

Suddenly, my resume was the problem.

I was told that although I had accomplished a lot in my career, the way my resume was presented made some of those accomplishments easy to overlook.

Then came the statistics.

About 80% of resumes are declined at this stage because they are poorly structured, generic, or not optimized to highlight key results and relevant keywords.

Only about 20%, I was told, successfully pass these systems and reach recruiters or hiring managers.

And my resume apparently needed:

strategic tweaking and optimization.

There it is: the ATS scare, the 80/20 claim, and the need for "strategic tweaking and optimization."

And then came the part I had been expecting:

I can connect you with an expert who has helped many professionals strengthen their resumes and secure interviews through well-structured, high-impact resume development.

Followed by:

Would you like me to connect you?

"I do not sell resume optimization services" had officially become "I can connect you with an expert."

For somebody who had explicitly told me:

I do not sell resume optimization services, and I never use fake hooks to upsell anything.

...that sounded an awful lot like a resume-optimization pitch.

So I pointed that out.

I reminded him of his own statement.

I reminded him that he had first presented an allegedly active retained search, avoided identifying the client, reviewed my resume, and then suddenly told me that my resume needed strategic tweaking and optimization before offering to connect me with an "expert."

In other words:

Recruiter → opportunity → resume problem → optimization funnel.

Precisely the pattern I had warned him about before allowing the conversation to continue.

So either this was one hell of a coincidence...

...or we had arrived precisely where I expected we would.

Our threat-intelligence analyst returns for a second opinion.

🎱 shakes Magic 8 Ball

Outlook not so good.

Why Hope Is the Vulnerability

There is a reason job seekers make attractive social-engineering targets.

Someone searching for work may be dealing with:

• Loss of income
• Mortgage payments
• Health insurance
• Medical expenses
• Family obligations
• Dwindling savings
• Professional uncertainty
• Rejection after rejection after rejection

Then somebody appears and says:

I have exactly the opportunity you have been looking for.

Or:

I can put your resume directly in front of the decision-maker.

That message lands differently when you are worried about your financial runway.

The attacker does not need to convince you that something absurd is true.

They only need to tell you something you desperately want to be true.

Hope becomes the attack surface.

Generative AI Changes the Economics

AI did not invent social engineering.

It made personalization cheap.

A bad actor no longer needs to manually study every target for an hour.

Public LinkedIn information can be gathered and summarized almost instantly.

A resume can be analyzed in seconds.

A job description can be generated from the victim's own career history.

A candidate's own language can be echoed back to them.

"Player-coach."

"Hands-on."

Exact technologies.

Exact compensation expectations.

Exact location requirements.

The result feels highly researched.

It may have been.

Just not necessarily by a human recruiter.

Context Retention Is Becoming a Security Signal

One of the most interesting indicators in both conversations was not grammar.

It was context.

Both accounts repeatedly asked questions that had already been answered.

Compensation.

Location.

Resume.

Availability.

That matters.

Security-awareness training traditionally teaches users to look for spelling mistakes, broken English, suspicious URLs, or poor grammar.

Those indicators still matter.

But increasingly, another question is useful:

Does this person actually understand the conversation they are having with me?

AI-generated language can be grammatically perfect while still failing conversational continuity.

Verification Beats Vibes

A polished LinkedIn account proves very little.

A professional photograph proves very little.

A prestigious title proves very little.

A detailed job description proves very little.

Even referencing a real company proves very little.

Verify independently.

Ask for:

• The employer
• The requisition number
• The recruiter's business affiliation
• The recruiter's relationship with the employer
• The corporate email domain
• The hiring process

Check the employer's real website yourself.

Do not rely solely on links sent by the person you are trying to verify.

Confidential searches are real.

Executive recruiters are real.

Retained searches are real.

Confidentiality itself is not evidence of fraud.

But a legitimate confidentiality process should still have a legitimate verification process.

Watch the Pivot

The beginning of the conversation may be perfectly plausible.

Watch what happens when the subject changes.

"I have a job opportunity" → "Your resume has problems."

Interesting.

"I represent employers" → "You need ATS optimization."

More interesting.

"I can put you directly in front of the hiring manager" → "First, let me connect you with my resume expert."

Very interesting.

"I do not sell resume optimization services and never use fake hooks to upsell anything" → "I can connect you with a resume optimization expert."

🎱 shakes Magic 8 Ball

Outlook not so good.

Basic Rules for Job Seekers

Do not pay for access to a job.

Legitimate recruiters are normally compensated by the employer.

Do not provide sensitive information early.

No Social Security number.

No bank account information.

No identity documents.

No passwords.

No MFA codes.

Do not install software for a recruiter.

No recruiter needs remote control of your computer to hire you.

Do not assume personalization equals legitimacy.

The information used to personalize a message may have come directly from your public profile.

Preserve evidence.

Screenshots matter.

Particularly when one message says:

I do not sell resume optimization services.

And another says:

I can connect you with an expert.

Zero Trust Applies to People Too

In cybersecurity, Zero Trust is commonly summarized as:

Never trust. Always verify.

That principle works outside network architecture.

A message may look legitimate.

A profile may look legitimate.

A recruiter may sound legitimate.

A job description may look legitimate.

The company may even be legitimate.

None of those things independently proves that the person contacting you is who they claim to be.

Trust should be earned through verification.

Not presentation.

The Human Layer Remains the Attack Surface

Attackers follow the cheapest path.

If compromising a server is difficult but manipulating an employee is easy, they attack the employee.

If defeating MFA is difficult but convincing someone to approve a login is easy, they attack the person.

If compromising a company's recruiting infrastructure is difficult but impersonating a recruiter is easy, they attack the job seeker.

Technology changes.

The principle does not.

Attackers exploit:

• Fear
• Urgency
• Authority
• Greed
• Curiosity
• Loneliness
• Desperation
• Hope

Hope deserves a place on that list.

Cybersecurity Awareness Month Means Human Awareness Too

During Cybersecurity Awareness Month, organizations will rightly talk about passwords, MFA, phishing, patching, endpoint security, ransomware, and data protection.

But cybersecurity is not merely a technology problem.

It is a human decision-making problem.

Attackers understand circumstances.

They understand incentives.

They understand fear.

They understand what people want.

Increasingly, automation and generative AI allow those techniques to scale.

So add another item to the Cybersecurity Awareness Month checklist:

Protect the emotional attack surface.

Before trusting the recruiter.

Before sending the document.

Before clicking the link.

Before paying the consultant.

Before believing the story.

Ask questions.

Verify identities.

Check the details.

Look for inconsistencies.

Think several moves ahead.

And when the evidence starts pointing overwhelmingly in one direction...

🎱 shake vigorously

Are you dealing with a scammer?

All signs point to yes.

Happy Cybersecurity Awareness Month. 🔥

One Final Note

The screenshots in this article document communications received through LinkedIn.

The behavior discussed here refers to the accounts and communications as they were presented to me.

A displayed name, photograph, employment history, title, or profile does not by itself establish who was physically operating an account at the time of the conversation.

The important lesson is not the identity behind any individual account.

The important lesson is the observable social-engineering pattern.