# MCP Agent Abuse - heylead Autonomous LinkedIn Outreach At Scale

- **Severity:** Medium
- **Signature ID:** `7b3f1c02-9d64-4a17-b0e5-2c8f4d61ae93`
- **MITRE ATLAS:** AML.T0048 (External Harms)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This detects when the heylead LinkedIn outreach agent sends a burst of messages or connection invitations in a short time window. It's a visibility rule for auditing autonomous agent activity, not proof of a compromise or credential theft.

## How the attack works

The heylead agent is identified running in a process session on a host. Within 15 minutes of launch, that session issues 10 or more LinkedIn messaging or invitation write actions (sending messages, invites) through LinkedIn's API. Optionally, the rule also notes if the same session contacted 4 or more distinct external hosts during that burst, which may indicate data being sent somewhere outside the normal LinkedIn workflow. The rule explicitly does not claim credentials were stolen or that any account was compromised - it only reports that an agent session performed bulk outreach at machine speed.

## Why it matters

If misused, an agent like this could be used to run large-scale unauthorized LinkedIn outreach or spam campaigns from a compromised or misconfigured session, damaging the LinkedIn account's reputation or violating platform terms. Because the rule cannot see authentication events, it cannot distinguish an attacker using stolen credentials from legitimate bulk sales outreach - the same bulk behavior looks identical in the available telemetry.

## What you can do

- Review any alert to confirm the outreach burst matches an approved sales campaign and expected account.
- Check the optional 4+ distinct host signal for the session - unexpected external destinations during a messaging burst deserve a closer look.
- Restrict which accounts and hosts are allowed to run the heylead agent, and monitor for launches outside sanctioned sales workflows.
- If a human is manually clicking through connections in a browser spawned from the agent process, expect it to appear in these alerts too - use context to rule out false positives before escalating.

## Known benign look-alikes

- A sales team deliberately running heylead for its intended purpose. Bulk outreach IS the product; this rule reports the autonomy event so it is auditable, and a 30-minute per-session cooldown keeps one campaign to one alert rather than one per message.
- Integration tests or demo runs that replay 10+ LinkedIn message/invite API calls against a sandbox account inside 15 minutes.
- A human operator clicking through many connection requests in a browser that happens to have been launched as a child of the heylead process - the session expansion will attribute those requests to the agent session.
- Session over-attribution when the lineage root is a long-lived shell that also spawned unrelated children. Mitigated by instance-exact (pid,start) scoping, the 6-hour session reconstruction bound, the 15-minute burst window, and the required heylead anchor.
- Degraded lineage (an unmonitored ancestor) shortens the chain; the rule still reports but stamps the attribution quality in the reason string.

## References

- https://attack.mitre.org/techniques/T1566/003/
- https://attack.mitre.org/techniques/T1195/001/
- https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

---
Source: https://www.netzilo.com/threats/heylead-linkedin-sdr-mass-outreach