Phishing Campaign Impersonates Google Careers to Steal Credentials

Threat actors are conducting a phishing campaign that impersonates Google Careers recruiters to target job seekers. The attackers send messages that appear to be outreach from Google’s recruiting team, often asking if the recipient is open to a conversation. Victims are directed to a landing page designed to mimic Google’s meeting scheduler, which then leads to a fake Google login page. The primary goal is to harvest Google account credentials, along with personal information such as names, email addresses, and phone numbers. Researchers have observed that the campaign is actively evolving, with threat actors refining their tactics to evade detection and using newly registered domains that closely resemble legitimate Google infrastructure.

The phishing emails are being distributed in multiple languages, including English, Spanish, and Swedish, and employ various evasion techniques such as HTML tricks to bypass email security scanners. Notable red flags include brand impersonation, domain deception, urgent response requests, and misalignment between the claimed sender and the actual sender domain. The campaign relies heavily on social engineering and exploits the urgency and excitement associated with job offers to trick victims into divulging sensitive information. Security experts recommend heightened vigilance and security awareness training to help users recognize and avoid such scams.