Fake Netflix and Coca-Cola Job Lures Steal Marketers’ Google Credentials

A phishing campaign has targeted marketing professionals with fake job interview invitations and scheduling requests that impersonate recruiters from major brands including Netflix, Coca-Cola, Adidas, and FIFA. Researchers said the activity has been ongoing for at least five months and relies on dozens of lookalike domains—at least 34 identified so far—to make the offers appear legitimate and draw victims into the hiring workflow.

The attackers use a multi-step redirection chain to evade detection, abusing legitimate services such as the HR platform PeopleForce and a domain tied to Salesforce Marketing Cloud before landing victims on the final phishing site. That page displays a counterfeit Google sign-in prompt embedded inside the webpage, rather than a real browser authentication window, to capture credentials. Reporting also linked the operation to a similar campaign documented earlier that used Coca-Cola and Ferrari-themed job lures to steal Facebook credentials.