RecruitTrap: 3,000+ Phishing Sites Target Google & Facebook

Introduction

Every year, job seekers across the globe fall prey to increasingly sophisticated системой of phishing attacks that masquerade as legitimate recruitment platforms. A new study by CSIRT researcher group CTM360, titled RecruitTrap, exposes a massive campaign that has already compromised thousands of users. By embedding Browser‑in‑the‑Browser (BitB) windows within fake interview scheduling pages, attackers can intercept login credentials for high‑value services such as Google and Facebook, and in some cases even trick users into providing multi‑factor authentication (MFA) tokens in real time.

The sheer scale and technical complexity of this operation raise urgent questions about how recruiters, hiring managers, and job seekers can protect themselves from an evolving threat landscape that blends social engineering with cutting‑edge malware techniques.

Phishing Tactics: The Rise of Recruitment Scams

The core of the campaign revolves around a simple premise: people want jobs. By presenting itself as an authentic, high‑profile employer or a well‑known staffing agency, the phishing site lures candidates into filling out sensitive information. The attackers craft interview scheduling interfaces that look almost indistinguishable falar from genuine platforms, complete with professional branding, logos, and even live chat widgets.

• Domain spoofing: Attackers register domain names that closely mimic legitimate corporate domains, often adding subtle misspellings or extra sub‑domains.
• Social proof: Embedded testimonials, recruiter bios, and simulated interview feedback create a false sense of credibility.
• Immediate call‑to‑action: Users are prompted to schedule interviews, upload resumes, or provide personal contact details before the page even loads the main content.

Browser‑in‑the‑Browser: A New Layer of Stealth

Once a user lands on the fake interview page, the attackers launch a Browser‑in‑the‑Browser (BitB) window—a lightweight, sandboxed browser instance that runs within işlet the main page. This technique offers several advantages:

• Bypassing security tools: Traditional endpoint protection often monitors the host browser; a BitB instance remains invisible to many scanners.
• Seamless user experience: The pop‑up window feels like a normal part of the site, reducing suspicion.
• Targeted credential capture: Attackers can inject JavaScript that listens for form submissions inside the BitB window and forwards input data back to the malicious server.

Credential Harvesting: Targeting Google and Facebook Accounts

Because many recruitment platforms rely on single‑sign‑on (SSO) services, the attackers prioritize Google and Facebook login portals. By presenting the familiar login screens within the BitB window, users are almost certain to enter their credentials. The harvested data is then immediately transmitted to the attackers’ command‑and‑control infrastructure.

Beyond mere credential theft, the attackers also capture:

• LinkedIn access tokens (when used during the sign‑on process).
• Session cookies that can be replayed to log in from other devices.
• Personal data submitted in interview forms (names, addresses, phone numbers).

Advanced MFA Relay: Real‑Time Prompt Interception

In the most sophisticated_impla, attackers have implemented real‑time MFA relay. When a victim initiates an MFA challenge—such as a push notification or an OTP request—the malicious BitB window intercepts the prompt and forwards it to the attacker’s device. Within seconds, the attacker approves or completes the MFA step, effectively bypassing the intended security layer.

This strategy transforms MFA from a protective measure into a point of vulnerability. Victims may believe they have protected themselves, unaware that their authentication token has already been weaponized.

Global Footprint: Where the Attackers Operate

CTM360’s analysis shows that the phishing infrastructure spans at least 40 countries, with the highest concentration of compromised accounts originating from the United States, India kriminal and Brazil. Attackers appear to be exploiting global recruitment portals that attract multinational talent, thereby increasing the reach of their phishing pages.

Notably, the attackers frequently use cloud services to host their malicious scripts, allowing them to move quickly between hosting providers and avoid takedown attempts. This agility makes it challenging for law enforcement and security teams to mitigate the threat in real time.

Conclusion

CTM360’s RecruitTrap report paints a stark picture of how attackers are turning the job‑search process into a vector for credential theft. By fusing social engineering with sophisticated browser exploitation and real‑time MFA relay, these phishers have built a campaign that is both large in scale and difficult to stop.

As the threat landscape evolves, both employers and job seekers must stay informed and adopt layered security measures. Leveraging AI‑driven automation for threat detection and response—such as the solutions offered by Grivyonx Cloud—can help organizations identify suspicious login patterns before they lead to data loss, ensuring that the promise of a great career opportunity does not come at the cost of personal security.