Escalating Mobile Phishing Scams Target Corporate Credentials

• •Fake recruiter scams are targeting corporate credentials on mobile devices.
• •Attackers use counterfeit login pages and pre-qualification checks to filter victims.
• •Zimperium identified 46 new IOCs linked to these phishing campaigns.

A series of fake recruiter scams have emerged, targeting corporate credentials primarily through mobile devices. Attackers impersonate HR personnel from major companies, using full-screen counterfeit login pages that bypass traditional visual cues. Zimperium's research identified 46 new indicators of compromise (IOCs) linked to these phishing domains, which often impersonate brands like Amazon, Apple, and Boeing. The phishing kits employ strict pre-qualification logic, rejecting personal email addresses to focus on enterprise accounts. This tactic allows attackers to gain access to OAuth tokens and internal communications, facilitating lateral movement within organizations. The persistence of these scams has been noted across various cloud and hosting providers, with a reliance on specific infrastructure rather than constantly shifting networks. The ongoing threat has prompted recommendations for securing corporate identities and inspecting network traffic dynamically.