Cybersecurity researchers have identified a large-scale, global phishing campaign targeting job seekers through deceptive interview scheduling pages and advanced credential theft techniques. This operation employs Browser-in-the-Browser (BitB) windows to harvest Google and Facebook login credentials and, in more sophisticated instances, intercept multi-factor authentication (MFA) prompts in real time.
Over a two-month period, more than 3,000 phishing URLs were detected, impersonating recruitment processes of over 50 organizations across 14 sectors. The primary targets were marketing professionals, likely due to their access to advertising platforms, corporate social media accounts, customer data, and other critical business services.
Deceptive Recruitment Tactics
The attack initiates with unsolicited emails or meeting invitations that appear to originate from recruiters at well-known organizations. These messages reference the recipient’s professional background and invite them to schedule an interview or informal discussion.
Victims are directed to one of two deceptive pathways: a counterfeit scheduling page resembling services like Calendly or a brand-specific recruitment portal. Both avenues lead to a prompt to “Continue with Google/Facebook,” where the BitB technique displays a fake authentication popup, complete with a spoofed address bar and padlock. On mobile devices, this may manifest as a full-screen counterfeit login page.
Advanced Phishing Mechanisms
Technical analysis of these phishing pages reveals that they function as dynamic state machines rather than static credential forms. Utilizing a Svelte/SvelteKit front end, victims are guided through staged scenes for CAPTCHA, username, password, and various two-factor authentication methods, including one-time passwords (OTP), phone number matching, and suffix verification.
A browser-specific session identifier is stored in sessionStorage, while a persistent Socket.IO channel allows the backend to control the sequence of screens presented. CAPTCHA and browser-reload checks are employed to filter traffic before credentials are collected. Notably, the pages filter out personal email domains, advancing only corporate accounts, thereby focusing the campaign on valuable enterprise identities.
Upon entering their login details, attackers use them to sign in to the legitimate service. The fake page then displays the same MFA request, capturing the victim’s code and sending it back to the attackers. If authentication succeeds, the attacker gains an authenticated session, while the victim may be redirected to a legitimate scheduling page to reduce suspicion.
Extensive Phishing Infrastructure
Analysis of the phishing infrastructure reveals that approximately 96% of the detected pages utilized a Calendly theme, with many employing Cloudflare to obscure the attackers’ real servers. The counterfeit brand-specific recruitment portals were hosted across 116 unique domains, with a significant portion hosted on AWS EC2 IP addresses. The reuse of hostnames and infrastructure indicates that multiple phishing sites were deployed through a shared setup.
Among the 813 deduplicated registered domains, the .cfd top-level domain was the most prevalent at 40%, followed by .com at 25.1%, .info at 15.1%, and .works at 10.2%.
This campaign underscores the evolving sophistication of phishing attacks targeting job seekers. The use of BitB techniques and real-time MFA interception highlights the need for heightened vigilance. Job seekers should verify the authenticity of recruitment communications and be cautious of unsolicited interview invitations. Organizations must educate employees on recognizing such threats and implement robust security measures to protect against credential theft.
