Loading story…
A phishing campaign has targeted marketing professionals with fake job interview invitations and scheduling requests that impersonate recruiters from major brands including Netflix, Coca-Cola, Adidas, and FIFA. Researchers said the activity has been ongoing for at least five months and relies on dozens of lookalike domains—at least 34 identified so far—to make the offers appear legitimate and draw victims into the hiring workflow.
The attackers use a multi-step redirection chain to evade detection, abusing legitimate services such as the HR platform PeopleForce and a domain tied to Salesforce Marketing Cloud before landing victims on the final phishing site. That page displays a counterfeit Google sign-in prompt embedded inside the webpage, rather than a real browser authentication window, to capture credentials. Reporting also linked the operation to a similar campaign documented earlier that used Coca-Cola and Ferrari-themed job lures to steal Facebook credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Analysis of the campaign showed attackers routing victims through a multi-step redirection chain that abused legitimate services such as PeopleForce and a domain associated with Salesforce Marketing Cloud. The final phishing page displayed a fake Google login pop-up embedded in the webpage to capture credentials.
Reporting noted a similar campaign documented in April 2026 that used Coca-Cola and Ferrari-themed fake job lures to steal Facebook credentials. This earlier activity was cited as related context for the later marketer-targeting campaign.
A phishing campaign active for at least five months targeted marketing professionals with fake interview invitations and scheduling requests impersonating recruiters from brands including Netflix, Coca-Cola, Adidas, and FIFA. Researchers identified at least 34 lookalike domains used in the operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are running a large-scale phishing campaign that impersonates recruiters from more than 30 major brands to steal **Google account credentials**, primarily from job seekers and marketing professionals. The emails use real recruiters’ names and photos and direct victims to fake interview scheduling or career pages, including a confirmed fake **McKinsey & Company** careers site hosted on Netlify, before presenting a browser-in-the-browser **Google sign-in** prompt designed to capture Gmail logins. The operation relies on a nested redirect chain through legitimate business services including **PeopleForce**, **Salesforce Marketing Cloud** infrastructure on `exct.net`, and **Wise Agent** to make the phishing flow appear trustworthy and evade detection. Researchers said the campaign has been active for at least five months and spans brands across consulting, technology, retail, travel, hospitality, entertainment, and consumer goods, while noting that abuse of those platforms does not necessarily indicate the services themselves were compromised.
Jul 9, 2026
Cybercriminals are increasingly exploiting the job search process to launch sophisticated social engineering attacks aimed at stealing credentials and compromising systems. In one widespread campaign, attackers send phishing emails that masquerade as job offers for Social Media Manager positions, leveraging the reputations of well-known brands such as KFC, Ferrari, and Red Bull to build trust with potential victims. These emails are often sent from legitimate-looking services like Google Workspace and Microsoft 365, making them harder to detect. Victims who click on the provided links are redirected through a series of deceptive web pages, including fake security checks and fraudulent job postings designed to mimic reputable sites like Glassdoor. The process culminates in a fake Facebook login page, where users are tricked into entering their credentials, which are then harvested by the attackers. Sublime Security researchers have identified telltale signs of these scams, such as suspicious URLs that appear to be associated with trusted brands but are actually redirects to malicious sites. The attackers use templates or large language models to generate convincing, varied phishing messages at scale, increasing the reach and effectiveness of their campaign. In a separate but thematically similar attack, developers are targeted on LinkedIn by a fake recruiter claiming to represent an AI-driven company called DLMind. The recruiter, using a well-crafted persona and a polished LinkedIn profile, invites victims to access a private GitHub repository under the pretense of a coding assessment. When the victim runs the provided setup script, a multi-stage malware payload is executed. This malware is designed to scan for sensitive files, steal browser credentials and cookies, hijack clipboard data, collect system information, and establish persistent remote access using tools like AnyDesk. The attack chain is carefully engineered to blend into a developer’s normal workflow, making detection difficult. Both campaigns demonstrate a trend of attackers weaponizing trust and exploiting the job-seeking process, using a combination of social engineering and technical sophistication to achieve their objectives. The impact of these attacks includes the theft of social media credentials, exposure of sensitive personal and professional data, and the potential for long-term system compromise. Security researchers emphasize the importance of vigilance when responding to unsolicited job offers, especially those that require logging in through unfamiliar portals or running code from unverified sources. Organizations are advised to educate employees about these tactics and implement technical controls to detect and block such phishing and malware delivery attempts. The use of legitimate platforms and convincing personas by attackers underscores the need for robust verification processes and heightened awareness among job seekers and professionals alike. These incidents highlight the evolving nature of social engineering threats and the critical importance of multi-layered defense strategies. The campaigns also illustrate how attackers are leveraging automation and AI to scale their operations and increase the sophistication of their lures. As the job market remains competitive, individuals and organizations must remain alert to the risks posed by these targeted attacks. Ongoing monitoring, user education, and rapid incident response are essential to mitigating the impact of such credential theft and system compromise campaigns.
Jul 8, 2026
Threat actors are conducting a phishing campaign that impersonates Google Careers recruiters to target job seekers. The attackers send messages that appear to be outreach from Google’s recruiting team, often asking if the recipient is open to a conversation. Victims are directed to a landing page designed to mimic Google’s meeting scheduler, which then leads to a fake Google login page. The primary goal is to harvest Google account credentials, along with personal information such as names, email addresses, and phone numbers. Researchers have observed that the campaign is actively evolving, with threat actors refining their tactics to evade detection and using newly registered domains that closely resemble legitimate Google infrastructure. The phishing emails are being distributed in multiple languages, including English, Spanish, and Swedish, and employ various evasion techniques such as HTML tricks to bypass email security scanners. Notable red flags include brand impersonation, domain deception, urgent response requests, and misalignment between the claimed sender and the actual sender domain. The campaign relies heavily on social engineering and exploits the urgency and excitement associated with job offers to trick victims into divulging sensitive information. Security experts recommend heightened vigilance and security awareness training to help users recognize and avoid such scams.
Jul 12, 2026