Key Takeaways
- A global recruitment‑themed phishing campaign, dubbed RecruitTrap, used fake interview scheduling pages and Browser‑in‑the‑Browser (BitB) windows to harvest Google and Facebook credentials and relay MFA prompts in real time.
- Over 3,000 phishing URLs were identified in two months, impersonating recruiters from more than 50 organizations across 14 sectors; marketing professionals were the primary targets.
- Victims were funneled through either a counterfeit Calendly‑style scheduler or a brand‑specific recruitment portal, both leading to a spoofed login popup that mimicked legitimate authentication flows.
- The phishing kit operated as a live state machine, guiding users through staged CAPTCHA, username, password, and multiple MFA steps while filtering out personal email domains to focus on corporate accounts.
- Attackers harvested credentials, forwarded MFA codes to the real service, and obtained authenticated sessions, often redirecting victims to a genuine Calendly page to reduce suspicion.
- Infrastructure relied heavily on Cloudflare for obfuscation, with many hosts on AWS EC2; the most common TLDs were .cfd, .com, .info, .works, and .work, indicating a reusable, rapidly rebrandable template.
- Detection cues include mismatched address bars, immobile fake windows, password‑manager autofill failures, and unsolicited interview invites that deviate from official channels.
- Mitigation strategies involve phishing‑resistant authentication (passkeys, hardware‑backed WebAuthn), monitoring lookalike recruitment domains, correlating suspicious emails with anomalous sign‑ins, and immediate credential revocation and session cleanup for any compromised accounts.
Campaign Overview and Scale
CTM360 uncovered a large‑scale, globally distributed phishing operation that masquerades as legitimate recruitment outreach. Over a two‑month window, researchers catalogued more than 3,000 distinct phishing URLs, each designed to lure professionals into fake interview scheduling processes. The campaign impersonated recruiters from over 50 organizations spanning 14 industry sectors, with a pronounced focus on marketing roles. By targeting individuals responsible for advertising platforms, corporate social media, customer data, and email, the attackers sought high‑value enterprise identities that could yield extensive downstream access once compromised.
Why Marketing Professionals Were Prioritized
Marketing accounts frequently provide privileged access to a suite of business‑critical tools: ad‑spend platforms, brand‑managed social media profiles, customer relationship databases, and internal communication channels. Compromise of such accounts enables threat actors to launch fraudulent campaigns, exfiltrate sensitive customer information, manipulate brand messaging, or pivot laterally within the victim’s organization. The deliberate selection of marketing professionals reflects a calculated effort to maximize the impact of credential theft while minimizing the noise that might arise from targeting less privileged user groups.
Two Recruitment Lures Leading to a Common Trap
The attack initiates with an unsolicited email or meeting invitation that appears to originate from a recruiter at a recognizable company. The message references the recipient’s professional background and proposes scheduling an interview or informal discussion. Victims are then directed into one of two parallel flows: a counterfeit Calendly‑style scheduling page that replicates the target organization’s branding, or a bespoke recruitment portal that requests date, time, and basic contact details. Both pathways ultimately present a “Continue with Google/Facebook” button, which triggers a Browser‑in‑the‑Browser (BitB) window displaying a spoofed authentication popup complete with a falsified address bar and padlock icon. On mobile devices, this counterfeit login page often occupies the full screen, further obscuring the fraudulent nature of the request.
The Phishing Kit as a Live State Machine
Technical dissection of a representative Calendly‑style URL revealed that the page functions as a dynamic state machine rather than a static credential form. Built with a Svelte/SvelteKit front end, the interface guides victims through a sequence of stages: CAPTCHA verification, username entry, password input, and several MFA challenges (OTP, phone‑number matching, suffix verification). A browser‑specific session identifier is stored in sessionStorage, while a persistent Socket.IO channel enables the backend to dictate which screen appears next. CAPTCHA challenges and browser‑reload checks serve as traffic‑filtering mechanisms, ensuring that only viable targets progress to credential harvesting. Importantly, the kit filters out personal email domains, advancing only those associated with corporate addresses to concentrate on high‑value enterprise accounts.
Credential Theft and MFA Relay Mechanism
Once the victim submits their username and password, the phishing kit immediately attempts to log in to the legitimate Google or Facebook service using those credentials. The genuine service responds with an MFA prompt, which the attacker mirrors back to the victim through the fake BitB window. The victim, believing they are completing a legitimate authentication step, enters the MFA code, which the attacker then forwards to the real service in real time. Successful authentication grants the attacker an active session; to lower suspicion, the victim is often redirected to a genuine Calendly page after the process concludes, leaving them unaware that their account has been compromised.
Infrastructure, Hosting Patterns, and Rebranding Flexibility
Approximately 96% of the identified phishing pages adopted a Calendly theme, with many leveraging Cloudflare services to conceal the attackers’ true origin servers. The brand‑specific recruitment portals utilized 116 unique observed hosts, of which 93.1% were dedicated or registered domains, and 50.9% resided on AWS EC2 IP ranges. Analysis of 813 deduplicated registered domains showed .cfd as the predominant TLD (40%), followed by .com (25.1%), .info (15.1%), .works (10.5%), and .work (6.3%). This distribution underscores a reusable template that can be rapidly rebranded—altering employer names, recruiter photos, slogans, and authentication providers while preserving the underlying 30‑minute meeting flow and login sequence. The most frequently impersonated industries were recruitment, technology, luxury goods, and travel, collectively accounting for about 58% of the observed brand usage.
Detecting the Attack: Warning Signs for Users
Individuals should treat unsolicited interview invitations with skepticism, verifying them through independent channels such as the company’s official website or a known phone number rather than clicking embedded links. Legitimate Google sign‑in pages always reside under accounts.google.com or another verified Google origin; in a BitB attack, the visible address bar and padlock are merely graphics embedded within the page, the fake window cannot be dragged outside the browser tab, and browser controls or privacy links may be non‑functional. A password manager that fails to recognize or autofill the expected origin is another strong indicator of a fraudulent login prompt. When any of these anomalies appear, users should abstain from entering credentials and report the message to their security team.
Organizational Mitigation and Response Strategies
To reduce exposure, organizations should adopt phishing‑resistant authentication mechanisms such as passkeys or hardware‑backed WebAuthn, which are immune to credential relay attacks. Continuous monitoring for lookalike domains that mimic corporate recruitment sites can enable early detection of malicious infrastructure. Security teams should correlate suspicious recruitment emails with anomalous sign‑in events, new session creations, or unusual OAuth grants. In cases where credentials or MFA codes have been entered into a suspected phishing page, immediate action is required: reset the affected password, revoke all active sessions and tokens, review recent sign‑in activity, mailbox rules, and application permissions, and notify the internal security operations center for further investigation and potential containment.
Conclusion: The Deceptive Power of Familiarity
The RecruitTrap campaign illustrates how a seemingly benign opportunity—a job interview—can be weaponized into a scalable identity‑theft operation. By constructing a convincing façade through branded scheduling pages and exploiting the trust users place in familiar browser UI elements, attackers harvest credentials and MFA tokens in real time, converting trust into account takeover. The operation’s modular design, reliance on shared infrastructure, and rapid rebranding capacity enable it to persist across sectors and geographies. Vigilance, user education, and the adoption of modern, phishing‑resistant authentication remain the most effective defenses against such sophisticated social‑engineering threats.