Fake recruiter campaign abuses trusted platforms to steal Google accounts

Attackers are running a large-scale phishing campaign that impersonates recruiters from more than 30 major brands to steal Google account credentials, primarily from job seekers and marketing professionals. The emails use real recruiters’ names and photos and direct victims to fake interview scheduling or career pages, including a confirmed fake McKinsey & Company careers site hosted on Netlify, before presenting a browser-in-the-browser Google sign-in prompt designed to capture Gmail logins.

The operation relies on a nested redirect chain through legitimate business services including PeopleForce, Salesforce Marketing Cloud infrastructure on exct.net, and Wise Agent to make the phishing flow appear trustworthy and evade detection. Researchers said the campaign has been active for at least five months and spans brands across consulting, technology, retail, travel, hospitality, entertainment, and consumer goods, while noting that abuse of those platforms does not necessarily indicate the services themselves were compromised.