Cybersecurity firm CTM360 has uncovered a pervasive phishing campaign targeting job seekers by impersonating recruitment processes. This operation, detailed in their report titled RecruitTrap, utilized over 3,000 phishing URLs within just two months. By mimicking recruiters from over 50 organizations across 14 different industries, the campaign primarily targeted marketing professionals.
Phishing Scheme Targets Marketing Professionals
The choice to focus on marketing roles appears strategic, as access to these accounts can lead to control over advertising platforms, corporate social media profiles, and critical customer data. The attackers used fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to capture Google and Facebook credentials, even relaying multi-factor authentication (MFA) prompts in some cases.
Mechanics of the Phishing Attack
The phishing attempt begins with an unexpected email or meeting invitation from a supposed recruiter. This message, referencing the recipient’s professional background, leads to a counterfeit scheduling page or a brand-specific recruitment portal. Victims are then directed to log in using Google or Facebook credentials via a BitB technique, which presents a deceptive authentication popup.
CTM360’s analysis of one such phishing URL revealed that the page operated as a state machine, guiding users through CAPTCHA, username, password, and several two-factor authentication steps. The attackers leveraged a persistent Socket.IO channel to manipulate the authentication process in real time, focusing on capturing corporate account credentials.
Infrastructure and Targeted Industries
CTM360 discovered that 96% of the phishing pages utilized a Calendly theme, often hiding behind Cloudflare infrastructure. Of the counterfeit recruitment portals, a significant portion was hosted on AWS EC2 IP addresses, showcasing shared setup deployment for these phishing campaigns. The most targeted sectors included recruitment, technology, luxury goods, and travel, accounting for 58% of the brands impersonated.
CTM360’s findings highlight the adaptability of these phishing schemes, which can quickly rebrand by altering employer names and recruiter identities. The phishing kit’s design allows for rapid deployment across various domains, making it a scalable threat.
Protecting Against Recruitment Phishing Attacks
To safeguard against such attacks, individuals should verify unsolicited job offers through independent channels and visit official career sites directly. Recognizing BitB attacks involves noting inconsistencies like immovable address bars and unresponsive browser controls. Organizations can mitigate risks by implementing phishing-resistant authentication methods and monitoring for suspicious recruitment-related activities.
Those who suspect their credentials have been compromised should promptly change passwords, revoke active sessions, and report the incident to their security teams. CTM360’s RecruitTrap report underscores how seemingly benign job opportunities can be exploited for identity theft, emphasizing the need for heightened awareness and robust security practices.
