THREAT Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team, published by Unit 42, notes that since August 2025 attackers have impersonated Palo Alto Networks recruitment staff to target senior‑level professionals. The campaigns exploit scraped LinkedIn data to craft highly personalised lures and use social engineering to manufacture a bureaucratic barrier around the candidate’s CV.
The scammers claim the resume does not meet applicant tracking system (ATS) requirements and offer paid services to deliver an aligned CV, with price points of $400 for Executive ATS alignment, $600 for a Leadership positioning package, and $800 for an end‑to‑end executive rewrite. The current scope shows phishing emails masquerading as Palo Alto Networks recruiters, employing flattering language, specific profile details and legitimate logos, then urging rapid action within a made‑up recruitment review window.
Interim guidance advises verifying sender domains, using official platforms, applying a zero‑payment policy and cross‑checking recruiters on official sites. According to Unit 42, the threat is a sophisticated social‑engineering campaign, and the Unit 42 Incident Response team can be engaged to assist targeted organisations.