RecruitTrap Mobile Phishing Campaign Targets Enterprise Credentials

Zimperium reported that a phishing operation dubbed RecruitTrap is using fake recruiter lures to steal corporate credentials, with a particular focus on mobile users. The campaign uses recruitment-themed domains, full-screen counterfeit login pages on smartphones, and browser-in-the-browser simulations on desktops to impersonate major brands including Amazon, Apple, Boeing, Deloitte, Emirates Group, Heineken, Lego, and Louis Vuitton. Researchers said they identified 46 previously unpublished indicators of compromise tied to the activity.

The phishing kit appears designed to capture business accounts rather than consumer logins, rejecting personal email addresses and requiring corporate addresses during credential submission. Zimperium said a year-long telemetry review showed the infrastructure repeatedly resurfacing through cloud, hosting, and domain-parking providers, helping newly registered phishing domains evade static URL blocklists before threat feeds catch up. The company warned that stolen enterprise credentials could expose OAuth tokens, internal communications, and cloud applications, creating opportunities for broader access inside targeted organizations.