Back www.ctm360.com

Recruittrap Browser In The Browser Bitb Recruitment Scams

www.ctm360.com • August 24, 2026

CTM360’s RecruitTrap report exposes a global recruitment-themed phishing campaign using fake interview invitations, counterfeit scheduling portals, and Browser-in-the-Browser (BitB) login windows to steal corporate credentials and relay MFA challenges. Over two months, CTM360 identified more than 3,000 phishing URLs impersonating recruiters and hiring processes from over 50 organizations. The campaign primarily targets marketing professionals and filters for corporate email accounts, enabling credential theft and potential account takeover. Read the full report and explore CTM360’s latest insights and threat intelligence.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Escalating Mobile Phishing Scams Target Corporate Credentials A series of fake recruiter scams have emerged, targeting corporate credentials primarily through mobile devices. Attackers impersonate HR personnel from major companies, using full-screen counterfeit login pages that bypass traditional visual cues. Zimperium's research identified 46 new indicators of compromise (IOCs) linked to these phishing domains, which often impersonate brands like Amazon, Apple, and Boeing. The phishing kits employ strict pre-qualification logic, rejecting personal email addresses to focus on enterprise accounts. This tactic allows attackers to gain access to OAuth tokens and internal communications, facilitating lateral movement within organizations. The persistence of these scams has been noted across various cloud and hosting providers, with a reliance on specific infrastructure rather than constantly shifting networks. The ongoing threat has prompted recommendations for securing corporate identities and inspecting network traffic dynamically. 7 sources 68

Extracted Entities

Recruittrap Browser In The Browser Bitb Recruitment Scams

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (2)