Cybercriminals are impersonating well-known corporations like Netflix, Coca-Cola, Adidas, and FIFA in a sophisticated job-scam campaign targeting marketing professionals. The attackers are leveraging legitimate services and browser manipulation techniques to create a veneer of authenticity for their phishing operations.
The scam begins with a fake job interview or scheduling request purportedly from a recruiter at one of these major companies. Instead of directing victims to a direct phishing link, the attackers route them through a series of trusted services. This multi-stage redirection aims to make the final malicious landing page appear less suspicious by obscuring its true nature.
A key element of the deception involves a fake Google sign-in pop-up. This pop-up is not a genuine browser window but is instead embedded within the phishing website itself, a tactic designed to trick victims into entering their credentials. The campaign has been active for at least five months and specifically targets individuals in marketing roles.
The attackers are reportedly abusing the legitimate cloud-based PeopleForce human resources platform and a domain associated with Salesforce Marketing Cloud. These legitimate services are used as stepping stones before redirecting the victim to the final malicious landing page.
This campaign underscores the persistent threat of job-themed phishing scams, which are particularly effective in competitive job markets and during periods of significant industry change, such as those influenced by artificial intelligence.
Security researchers advise individuals to exercise extreme caution with unsolicited job offers. They recommend never clicking on links or opening attachments in such communications. A crucial defense is understanding that legitimate hiring processes will not require authentication through unfamiliar pages, regardless of how they are presented.
To protect against such schemes, it is advised to close suspicious tabs and navigate directly to the company's official website to verify any job offers or application processes. Utilizing a password manager can also prevent the autofill of credentials on fake websites.
Maintaining up-to-date anti-malware software with real-time web protection is another essential security measure. Researchers note that tools like Malwarebytes Scam Guard can help identify and block such attacks by analyzing suspicious links and content.
