The Anatomy of an OT Cybersecurity Recruiting Scam

The message that started it

Here is what the sender wrote:

“Hi [Name], I came across your profile and noticed your experience in industrial network security. I'm helping Joyce connect with experienced professionals for an industrial technology and energy project she's developing. She's interested in people who understand both Cybersecurity and real-world industrial systems. She's also open to discussing consulting or project-based opportunities, depending on the fit. Would you be open to a quick conversation to see if there's a potential match?”

It's easy to see why someone might reply. The work sounds relevant, and a consulting project could interest someone who isn't looking to leave their current job. But who is actually behind the project? What would the work involve? And who is the person sending the message?

• The third-party handoff: The sender was helping someone else make connections. That put another person between the recipient and basic questions about the project, client and responsibilities.
• The consulting hook: Project work gave an established practitioner a reason to respond. From there, a conversation could move toward an NDA, project brief or assessment download.

A recruiter with a design studio's history

The signature caught our attention first. It used the name of a design studio instead of a person. When we followed the profile URL, we found a 3D visualization specialist and studio founder based in India.

The current profile told a different story: talent acquisition in Atlanta, right in my colleague's local market. There was no profile photo or custom banner, though there was a LinkedIn Premium badge. We kept looking.

A familiar name with two extra letters

Next, we checked the listed employer. Its name looked like a major staffing firm until we noticed two extra letters at the end. Those letters changed the name into that of a former UK Member of Parliament. It's the sort of detail you could easily miss while scrolling through messages on your phone.

The employer link led to an unclaimed LinkedIn Listing Page with no active company administrator. We opened the associated profiles, and that is where the trail got more interesting.

Then the other profiles started to look familiar

The design studio profile wasn't alone. Another account had work history in Dallas. Several profiles with unrelated backgrounds now presented themselves as Atlanta recruiters working for the same lookalike employer.

Then we noticed the tenure. Several listed exactly three years and three months at that employer. Different backgrounds, the same city, the same company name and the same length of time in the role.

That pattern was much easier to see across the group than in the original message. It pointed us toward established identities being repurposed together for recruiting outreach.

When a recruiting pitch becomes a security exposure

A message like this can lead to more than an unwanted call. Once a conversation starts, a recruiter might ask about your work, send a project brief or invite you to complete a technical exercise. Those are familiar steps in a real search, which is why checking who is on the other side matters.

• Malicious assessments and repositories: The joint government advisory on WaterPlum, also tracked as Contagious Interview, describes fake job offers, technical interviews and coding assignments used to deliver malware. A project repository, interview tool or troubleshooting command can become the execution path. Verify the organization and the exercise before running anything, including on a personal device.
• Architecture reconnaissance: The FBI's Foreign Virtual Targeting guidance describes consulting and employment approaches used to collect sensitive information. In OT Cybersecurity, screening questions can drift into DCS and SCADA vendors, remote access arrangements, segmentation, monitoring coverage and unresolved plant weaknesses. Those details can reveal how an industrial environment is built and defended.
• Identity collection: A convincing opportunity can move into requests for resumes, identity documents and onboarding information. Establish the organization, the purpose of each request and the process for handling sensitive material before providing it.

Verify the recruiter before sharing information

You don't have to investigate every recruiter like a threat analyst. A few deliberate checks can tell you whether a conversation deserves more of your time:

1. Inspect the profile and its company affiliation. Compare the URL, earlier work and current recruiting identity. Follow the employer link, check the exact name and look across the associated profiles for repeated histories or inconsistencies.
2. Confirm the organization independently. Find the recruiting firm's official website yourself, check the sender's full email address against its domain, and use a published contact channel to confirm the person and the search.
3. Establish the work early. Ask about the responsibilities, the industrial setting, the employment or consulting arrangement and the next step. Find out who is accountable for the introduction and how that relationship can be confirmed.
4. Protect operational details and devices. Explain your experience through responsibilities and decisions. Keep nonpublic diagrams, vendor configurations, credentials, customer identities and current vulnerabilities out of the conversation. Verify assessment files and repositories before opening or executing them.

Why practitioner-led OT Cybersecurity recruiting matters

If someone is recruiting you for an OT Cybersecurity role, they should be able to talk with you about the work. What kind of environment is it? What decisions will the person make? Why does your experience make sense for that opportunity? Those questions should lead somewhere useful.

At Zylarity, we recruit OT Cybersecurity specialists for industrial employers and the companies that support them. Our founder brings more than 20 years of experience in Cybersecurity and industrial operations, supporting organizations across manufacturing, chemical, oil and gas, and transportation. That experience informs how we discuss a role, explore a professional's background and connect the two.

You can reach us through zylarity.com. Our official recruiter emails use @zylarity.com, and support@zylarity.com is our published contact for confirming an introduction. Our recruitment safety page provides the verification details in one place.

That first conversation matters for employers, too. The person reaching out represents your organization before a candidate ever meets the hiring team. Clear answers and a recruiter who understands the work give that relationship a better start.

Take action if you have already engaged

Save the message, sender details, profile URL and dates, then use LinkedIn's reporting controls. If you opened a suspicious file, ran a command or exposed work information, contact your internal security team promptly and follow its incident response process. Keep the original material for that team to review.

If you want to confirm a Zylarity introduction, send the sender details and a short description to support@zylarity.com. Keep sensitive attachments out of the message.