Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time.
CTM360, which detailed the activity in a new report titled RecruitTrap, said it identified more than 3,000+ phishing URLs over two months. The campaign impersonated real recruiters and recruitment processes associated with more than 50 organizations across 14 sectors. Marketing professionals accounted for the majority of observed targets.
The focus on marketing roles appears deliberate. Compromised marketing accounts can provide access to advertising platforms, corporate social media profiles, customer data, email, and other business-critical services.
Read the full report here: https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams
Two Recruitment Lures Lead to the Same Login Trap
