A phishing campaign is posing as recruiters from more than 30 well-known companies to steal Google account credentials from marketing professionals and job seekers. The operation abuses legitimate services including PeopleForce, Salesforce Marketing Cloud infrastructure on exct.net, and Wise Agent in a redirect chain before sending victims to attacker-controlled domains, where a browser-in-the-browser fake Google sign-in window captures passwords. Researchers say the activity has run for at least five months.
Why it matters: Anyone contacted about a job interview from a major brand could be targeted, especially people in marketing roles. Treat interview scheduling links with caution, verify recruiters through official company channels, and use phishing-resistant multifactor authentication where possible because the campaign is designed to look unusually legitimate.
Ionut Ilascu
2026.07.06
100% relevant
This article establishes a distinct, multi-brand phishing campaign centered on fake job interviews, abuse of legitimate SaaS platforms, and credential theft via fake Google login prompts.
← Back to all stories