Security researchers have uncovered a massive covert surveillance operation reportedly run by Microsoft-owned LinkedIn.
According to a new investigation named BrowserGate by the commercial user association Fairlinked e.V., LinkedIn executes hidden code on user devices to scan for installed software and browser extensions. This campaign affects a large portion of the platform’s one billion global users.
Every time a user visits the website, this undocumented script secretly searches the local machine without asking for consent or notifying the user.
Because LinkedIn ties this telemetry data to real names, job titles, and current employers, the scanning exposes the exact software stacks used by identified professionals. Millions of companies are reportedly impacted by this continuous, daily scanning.
Privacy Breaches and Data Theft
The covert scanning operation crosses several strict privacy boundaries by collecting highly sensitive personal information.
Under European Union law, much of this collected data falls under prohibited categories that require explicit consent. The BrowserGate report highlights several alarming violations:
- The hidden code detects browser extensions related to religious beliefs, political orientations, and neurodivergent accessibility aids.
- LinkedIn actively tracks 509 specific job search tools, revealing to the platform exactly who is secretly looking for new employment.
- The platform maps the customer bases of over 200 direct competitors, including popular sales tools like Apollo, Lusha, and ZoomInfo.
- LinkedIn uses this gathered intelligence to identify corporate targets and send enforcement threats to users of third-party applications.
The Fairlinked investigation suggests LinkedIn expanded this surveillance specifically to bypass the EU’s Digital Markets Act. In 2023, the EU designated LinkedIn as a regulated gatekeeper and legally ordered it to open its ecosystem to third-party tools.
Instead of complying fairly, LinkedIn allegedly misled European regulators. The company presented two heavily restricted APIs to the European Commission as proof of compliance, but these handle roughly 0.07 calls per second.
Meanwhile, LinkedIn completely omitted its core internal “Voyager” API, which powers all of its web and mobile applications at a massive 163,000 calls per second.
Rather than allowing third-party tools as ordered by the government, LinkedIn aggressively scaled its hidden scanning list from 461 products in 2024 to over 6,000 by February 2026 to punish users of competing tools.
This harvested intelligence does not stay solely within Microsoft’s corporate servers. The investigation reveals that LinkedIn utilizes hidden tracking pixels and covert scripts to siphon user data directly to external organizations.
The platform loads an invisible, zero-pixel element from HUMAN Security, an American-Israeli cybersecurity firm, which drops hidden cookies onto user browsers.
Additionally, LinkedIn runs its own heavily encrypted fingerprinting script alongside silent execution scripts from Google.
None of these tracking mechanisms or partnerships are disclosed in LinkedIn’s official privacy policy, raising severe legal and criminal questions about the platform’s massive data harvesting practices.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
