Phishing Campaign Targets Marketing Professionals with Fake Job Offers

• •Phishing campaign impersonates over 30 brands to steal Google credentials.
• •Attackers use fake job offers and real recruiter identities for authenticity.
• •Nested redirects through legitimate platforms evade detection by filters.

A phishing campaign has emerged, impersonating over 30 well-known brands, including Adidas, Netflix, and Coca-Cola, to steal Google account credentials from marketing professionals. The attackers use fake job offers and impersonate real recruiters, employing a sophisticated redirect chain through legitimate platforms like PeopleForce and Salesforce Marketing Cloud. Victims receive emails that appear authentic, complete with real names and photos of recruiters, luring them to click links that lead to a fake Google sign-in page. This campaign has been active for at least five months and is notable for its use of browser-in-the-browser techniques to mask malicious intent. Security researchers from Team Cymru have documented the operation, highlighting the effectiveness of nested redirects in avoiding detection. The phishing emails often include personalized targeting, increasing the likelihood of success. The scale of this operation is broader than typical phishing campaigns, affecting a significant number of job seekers.