# Heylead Autonomous LinkedIn SDR Outreach Burst

- **Severity:** Medium
- **Signature ID:** `7b3d9c14-2f6a-4d58-9c21-8ae5f0b47d63`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This detects an AI agent (or a LinkedIn automation tool like heylead) sending a burst of connection requests, invitations, or messages on LinkedIn far faster than a human could type or personalize them. It flags the pattern of behavior, not the mere presence of the automation tool.

## How the attack works

An AI agent or an automation process derived from one calls LinkedIn's endpoints that send invitations, connection requests, or messages. The detection looks for at least 8 of these outreach actions within a 10-minute window, all coming from one traceable process session, with at least 4 of those actions spaced 20 seconds or less apart — a pace no person typing individual messages could sustain. It's reinforced when the same session also does heavy profile or search browsing (15+ lookups) in that window, consistent with scraping targets before messaging them.

## Why it matters

LinkedIn accounts can get flagged, rate-limited, or banned for automated behavior, and prospects can be spammed at scale without any human reviewing who is being contacted or what is being said, creating compliance and reputational risk for the sales organization.

## What you can do

- Confirm whether the outreach burst matches an approved, scheduled sales campaign before treating it as abuse.
- Require a human-in-the-loop approval step for any automated LinkedIn outreach tool before it sends invitations or messages.
- Set internal rate limits for LinkedIn automation tools well below LinkedIn's own thresholds to reduce account-ban risk.
- Restrict which processes or agents are allowed to spawn LinkedIn automation tools like heylead, and log/alert on new spawns.

## Known benign look-alikes

- Sanctioned outbound campaign - the sales team deliberately runs heylead under an approved, scheduled campaign. The burst signature is identical to abuse; the rule reports so an owner can confirm the campaign was authorised.
- Sales Navigator / Recruiter bulk workflow launched from an IDE terminal or a scheduled job that happens to descend from a monitored agent process.
- QA or integration testing of the heylead MCP server replaying invitation and messaging endpoints against a test account.
- A user asking an agent to clear a large backlog of pending invitations or unread messages after a conference - genuinely bulk, genuinely intended.
- Browser-automation or accessibility test harnesses spawned by an agent that click through the LinkedIn messaging UI at scripted speed.

## References

- https://attack.mitre.org/techniques/T1119/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/heylead-linkedin-sdr-burst