Loading story…
Threat actors are conducting a phishing campaign that impersonates Google Careers recruiters to target job seekers. The attackers send messages that appear to be outreach from Google’s recruiting team, often asking if the recipient is open to a conversation. Victims are directed to a landing page designed to mimic Google’s meeting scheduler, which then leads to a fake Google login page. The primary goal is to harvest Google account credentials, along with personal information such as names, email addresses, and phone numbers. Researchers have observed that the campaign is actively evolving, with threat actors refining their tactics to evade detection and using newly registered domains that closely resemble legitimate Google infrastructure.
The phishing emails are being distributed in multiple languages, including English, Spanish, and Swedish, and employ various evasion techniques such as HTML tricks to bypass email security scanners. Notable red flags include brand impersonation, domain deception, urgent response requests, and misalignment between the claimed sender and the actual sender domain. The campaign relies heavily on social engineering and exploits the urgency and excitement associated with job offers to trick victims into divulging sensitive information. Security experts recommend heightened vigilance and security awareness training to help users recognize and avoid such scams.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A phishing campaign emerged that impersonated Google Careers recruiters and lured job seekers into credential-harvesting traps using fake recruitment-themed messages and pages. The operation was reported as targeting people seeking employment by abusing Google's brand and hiring process imagery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are running a large-scale phishing campaign that impersonates recruiters from more than 30 major brands to steal **Google account credentials**, primarily from job seekers and marketing professionals. The emails use real recruiters’ names and photos and direct victims to fake interview scheduling or career pages, including a confirmed fake **McKinsey & Company** careers site hosted on Netlify, before presenting a browser-in-the-browser **Google sign-in** prompt designed to capture Gmail logins. The operation relies on a nested redirect chain through legitimate business services including **PeopleForce**, **Salesforce Marketing Cloud** infrastructure on `exct.net`, and **Wise Agent** to make the phishing flow appear trustworthy and evade detection. Researchers said the campaign has been active for at least five months and spans brands across consulting, technology, retail, travel, hospitality, entertainment, and consumer goods, while noting that abuse of those platforms does not necessarily indicate the services themselves were compromised.
Jul 9, 2026
Cybercriminals have launched a sophisticated phishing campaign that exploits Google Cloud's Application Integration service to send emails that closely mimic legitimate Google notifications. By leveraging the service's "Send Email" task, attackers are able to distribute messages from the trusted `noreply-application-integration@google.com` address, effectively bypassing traditional email security measures such as DMARC and SPF. The phishing emails are crafted to resemble routine enterprise communications, including voicemail alerts and file access requests, increasing the likelihood that recipients will trust and interact with them. Over a two-week period, nearly 9,400 phishing emails targeted approximately 3,200 organizations across the U.S., Asia-Pacific, Europe, Canada, and Latin America. The attack chain employs a multi-stage redirection process to evade detection and maximize credential theft. Initial links in the emails direct users to legitimate Google Cloud URLs (`storage.cloud.google.com`), followed by a redirection to `googleusercontent.com` where a fake CAPTCHA is presented to bypass automated scanners. The final stage leads victims to a counterfeit Microsoft login page hosted on a non-Microsoft domain, designed to harvest user credentials. This campaign demonstrates the increasing abuse of trusted cloud infrastructure for phishing, highlighting the need for organizations to scrutinize even seemingly authentic emails originating from reputable domains.
Jun 29, 2026
Cybercriminals are increasingly exploiting the job search process to launch sophisticated social engineering attacks aimed at stealing credentials and compromising systems. In one widespread campaign, attackers send phishing emails that masquerade as job offers for Social Media Manager positions, leveraging the reputations of well-known brands such as KFC, Ferrari, and Red Bull to build trust with potential victims. These emails are often sent from legitimate-looking services like Google Workspace and Microsoft 365, making them harder to detect. Victims who click on the provided links are redirected through a series of deceptive web pages, including fake security checks and fraudulent job postings designed to mimic reputable sites like Glassdoor. The process culminates in a fake Facebook login page, where users are tricked into entering their credentials, which are then harvested by the attackers. Sublime Security researchers have identified telltale signs of these scams, such as suspicious URLs that appear to be associated with trusted brands but are actually redirects to malicious sites. The attackers use templates or large language models to generate convincing, varied phishing messages at scale, increasing the reach and effectiveness of their campaign. In a separate but thematically similar attack, developers are targeted on LinkedIn by a fake recruiter claiming to represent an AI-driven company called DLMind. The recruiter, using a well-crafted persona and a polished LinkedIn profile, invites victims to access a private GitHub repository under the pretense of a coding assessment. When the victim runs the provided setup script, a multi-stage malware payload is executed. This malware is designed to scan for sensitive files, steal browser credentials and cookies, hijack clipboard data, collect system information, and establish persistent remote access using tools like AnyDesk. The attack chain is carefully engineered to blend into a developer’s normal workflow, making detection difficult. Both campaigns demonstrate a trend of attackers weaponizing trust and exploiting the job-seeking process, using a combination of social engineering and technical sophistication to achieve their objectives. The impact of these attacks includes the theft of social media credentials, exposure of sensitive personal and professional data, and the potential for long-term system compromise. Security researchers emphasize the importance of vigilance when responding to unsolicited job offers, especially those that require logging in through unfamiliar portals or running code from unverified sources. Organizations are advised to educate employees about these tactics and implement technical controls to detect and block such phishing and malware delivery attempts. The use of legitimate platforms and convincing personas by attackers underscores the need for robust verification processes and heightened awareness among job seekers and professionals alike. These incidents highlight the evolving nature of social engineering threats and the critical importance of multi-layered defense strategies. The campaigns also illustrate how attackers are leveraging automation and AI to scale their operations and increase the sophistication of their lures. As the job market remains competitive, individuals and organizations must remain alert to the risks posed by these targeted attacks. Ongoing monitoring, user education, and rapid incident response are essential to mitigating the impact of such credential theft and system compromise campaigns.
Jul 8, 2026