Loading story…
Zimperium reported that a phishing operation dubbed RecruitTrap is using fake recruiter lures to steal corporate credentials, with a particular focus on mobile users. The campaign uses recruitment-themed domains, full-screen counterfeit login pages on smartphones, and browser-in-the-browser simulations on desktops to impersonate major brands including Amazon, Apple, Boeing, Deloitte, Emirates Group, Heineken, Lego, and Louis Vuitton. Researchers said they identified 46 previously unpublished indicators of compromise tied to the activity.
The phishing kit appears designed to capture business accounts rather than consumer logins, rejecting personal email addresses and requiring corporate addresses during credential submission. Zimperium said a year-long telemetry review showed the infrastructure repeatedly resurfacing through cloud, hosting, and domain-parking providers, helping newly registered phishing domains evade static URL blocklists before threat feeds catch up. The company warned that stolen enterprise credentials could expose OAuth tokens, internal communications, and cloud applications, creating opportunities for broader access inside targeted organizations.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
In its August 24 research, Zimperium disclosed 46 previously unpublished indicators of compromise tied to recruitment-themed phishing domains impersonating brands including Amazon, Apple, Boeing, Deloitte, Emirates Group, Heineken, Lego, and Louis Vuitton. The researchers said the infrastructure persisted across recurring cloud, hosting, and domain-parking providers.
Zimperium's zLabs reported that a fake recruiter phishing campaign targeting enterprise credentials on mobile devices was linked to RecruitTrap activity. The campaign used recruitment-themed domains, full-screen counterfeit mobile login pages, and browser-in-the-browser simulations on desktops while filtering out personal email addresses to prioritize corporate accounts.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourceinfosecurity-magazine.com
Open sourcezimperium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are running a large-scale phishing campaign that impersonates recruiters from more than 30 major brands to steal **Google account credentials**, primarily from job seekers and marketing professionals. The emails use real recruiters’ names and photos and direct victims to fake interview scheduling or career pages, including a confirmed fake **McKinsey & Company** careers site hosted on Netlify, before presenting a browser-in-the-browser **Google sign-in** prompt designed to capture Gmail logins. The operation relies on a nested redirect chain through legitimate business services including **PeopleForce**, **Salesforce Marketing Cloud** infrastructure on `exct.net`, and **Wise Agent** to make the phishing flow appear trustworthy and evade detection. Researchers said the campaign has been active for at least five months and spans brands across consulting, technology, retail, travel, hospitality, entertainment, and consumer goods, while noting that abuse of those platforms does not necessarily indicate the services themselves were compromised.
Jul 9, 2026
SOCRadar reported a long-running phishing operation dubbed **Operation DoppelBrand**, attributed to a financially motivated actor tracked as **GS7**, that uses high-fidelity replicas of Fortune 500 and major consumer brands to harvest credentials and enable follow-on access. The activity observed most recently (Dec 2025–Jan 2026) impersonated major financial and technology organizations (including **Wells Fargo, USAA, Navy Federal Credit Union, Fidelity, Microsoft, and Citibank**) and relied on a highly automated domain and infrastructure pipeline, with researchers identifying **hundreds of malicious domains** and **150+ newly identified domains** following consistent patterns. The operation is assessed as monetization-focused, with GS7 linked to trading stolen credentials and access in underground markets and using **Telegram bots** for credential handling/exfiltration; reporting also notes abuse of legitimate remote management tooling to help establish persistence after credential capture. Dark Reading’s coverage of the SOCRadar findings emphasized the campaign’s effectiveness stemming from near-perfect portal impersonation and rapid infrastructure rotation, increasing the likelihood of successful credential theft against both enterprises and their customers. For defenders, the reporting highlights the need to treat this as an ongoing, scalable credential-harvesting and initial-access operation: prioritize monitoring for lookalike domains and brand-abuse infrastructure, strengthen anti-phishing controls around customer/employee authentication flows, and review remote management tool governance to reduce the impact of stolen credentials being converted into durable access.
Jun 29, 2026
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026