Fake employement email

[AlanJones]

Hello everyone !

A few days ago I registered on a few website to look for a job. It's often via recruiting companies so you never really know who is hiring you.

Today I received an email from [email protected] telling me :

Hello XXX. Your CV was received and I am interested in hiring you. The company is currently undergoing a major restructuring, and has new and interesting open positions. Do you accept the offer to join a team that strives to change the world for the better?

I answered to know more about it and received a second email:

Dear XXX,

My name is Monique Chisolm. I am a manager at Liberation Investment Group LLC.
Liberation Investment Group LLC is looking for highly motivated individuals willing to achieve big goals and results and eager to gain new experiences and competences.
Talented employees with diverse backgrounds provide skill development and gaining of experience.
A recruiting company forwarded your CV to the Liberation Investment Group LLC HR department.
The company is hiring in your city to fill a number of vacancies in a new office to be open soon.
Check out "Application and Description.pdf" attachment to see the vacancies you could apply to at Liberation Investment Group LLC.
Also fill out the Application Form in electronic format to be able to work in our company.
We believe that you have the skills and competencies to become a great employee.
Liberation Investment Group LLC team sets the pace for the whole United States market with our services always being in high demand.
Developing a growing client base, improving services and showing increase in results are our ambition and commitment.
Liberation Investment Group LLC provides professional growth opportunities for the most skilled and competent employees.
Those who demonstrate commitment to progress, are highly motivated to gain results and show reliability, can enjoy a special bonus and award program.
Check out website to learn more about the business of the company.

Liberation Investment Group LLC currently has offices in: New York, Los Angeles, Chicago, Houston, Philadelphia, Phoenix, San Antonio, San Diego, Dallas, San Jose, Austin, San Francisco, Columbus and 10 more US cities.

We interview all prospects to define the best skills and create a positive working environment.
1. What experience of yours will be the most useful for the company?
2. What do you need for a comfortable and productive office work?
3. What are your best and worst (if any) personal features?
4. What characteristics should a team possess to be your perfect collaboration match?
5. Why do you think you are the best candidate for this job?
6. When will you be able to begin your work?
Please provide either short or long answers to these questions in your response.

Please note:
* To ensure my messages get to your inbox please add my email to your address book or white list.
** If your response takes too much time, we will have to consider other candidates.
*** If you think that this message was sent by mistake or you want to unsubscribe, reply to this mail with "NOT INTERESTED" message and I will make sure that all your personal data is deleted.
**** This job will be based in your city, in a new office to be opened soon.
***** You have been PRELIMINARILY approved for the positions in the Job Description file. If you are ready to accept our offer, a number of actions will have to be taken to hire you.

We hope you will join our friendly and ambitious team.
Should you have any questions related to working for our company, do not hesitate to ask me.
I am always online to help you.
Thank you!

Sincerely,

Manager Monique Chisolm.
Company: Liberation Investment Group LLC.
Head office phone number: (315)504 2318
Head office address: 270 Park Avenue Floor 12, New York, NY 10017


©2021 Liberation Investment Group LLC.

Well it looked kind of like a scam but i really needed a job so I downloaded the attached pdf and completed it via Gimp with some personnal info (adress name and phone number)

On top of it the website https://www.liberation-investment.com/index.html from the mail adress looked legit.

Without surprise no answer from them but I was still not feeling right about all this... Even if the PDF didn't raise any anti-malware alert on my computer (analyzed with windows security and malwarebytes) I kept searching for more infos.

Nothing on this "Liberation Investment Group LLC", there is indeed a company named like this in the US with the same CEO name (one letter close) But no link to the website I visited. The minneapolis journal that they mention doesn't appear to have any reference of that company neither...

Feeling unsatisfied and like someone got me, I kept searching and searching until...

I trier to google search via image from the CEO photo on their website and the name of the image was Andy-Grossman-100x100.png !
( link to subpage of scammer website with the image : https://www.liberation-investment.com/awards/index.html)

I then searched with that in hand and found my graal : Removed AJ

This is a real company with a linkedin profile of 10k and a direct link to this website. The scammers website liberation inv. is a pure copy of it, with some usurpation of identity.


I filled a IC3 Complaint for the U.S. and I tried contacting Removed AJ but no answers yet.

I'm here hoping this post can help others avoid it and also ask for advises into what to do about this security breach on my computer.

Thanks and have a nice week,
Lucien

Sorry for the double post but here is the link to the virustotal.com analysis of the attached pdf file form the second mail received from the scammer :

https://www.virustotal.com/gui/file/86429fe3044de399cf7d8bdd46b303345555bdd6226fca44dc28012bed18f20a/detection

I have to say that I'm impressed buy the quantity of work put in that scam compared to others.