A sophisticated phishing campaign is targeting marketing professionals by impersonating over 30 major brands in fake job interview invitations, aiming to steal their Google account credentials. The operation leverages legitimate cloud services and a domain linked to Salesforce Marketing Cloud to build trust before redirecting victims to a malicious landing page.
The threat actor is employing a tactic of impersonating well-known companies, including airlines like American Airlines and Delta Air Lines, food and beverage giants such as Coca-Cola and PepsiCo, and tech companies like Adobe and OpenAI. Other impersonated brands span apparel, luxury goods, staffing, consulting, hospitality, marketing, entertainment, and sports sectors. To enhance credibility, the campaign uses the names and photographs of actual recruiters from these impersonated organizations.
The phishing emails, which appear to originate from the PeopleForce human resources platform, are designed to look like genuine recruitment outreach for marketing roles. However, the embedded links employ a technique of nested redirects. These links initially point to a domain associated with Salesforce Marketing Cloud, a service that evolved from the ExactTarget marketing automation platform. From there, the chain continues through Wise Agent, a real estate CRM software, before finally landing on the attacker-controlled phishing page.
Researchers have observed that this campaign has been active for at least five months. Early iterations of the phishing emails used Outlook addresses that included the name of the company being impersonated. For instance, an email posing as a recruiter from Adidas, named Paulina Manzo, invited recipients to schedule a meeting about a potential role.
When a potential victim clicks on a link to schedule a meeting, they are directed to a fake landing page, such as one impersonating Adidas at `adidas-hiring[.]com`. To proceed, the user is prompted to sign into their Google account.
The campaign employs a "browser-in-the-browser" (BitB) attack technique. When the user clicks a "Continue with Google" button on the phishing page, a fake Google sign-in pop-up appears. This pop-up, while appearing to be a legitimate browser window, is actually rendered within the phishing page using HTML and CSS, mimicking the appearance of a real Google authentication prompt. This allows the attacker to capture the user's Google login credentials.
It remains unclear how the threat actor gained access to the legitimate platforms used in the redirect chain. The abuse of these services does not necessarily indicate a compromise of the platforms themselves. Possible methods include creating legitimate accounts specifically for the campaign or utilizing compromised login credentials to configure the redirect sequences and the final landing page. A list of domains identified in this phishing campaign is available in the analysis by Will Thomas.
Security professionals are advised to test their defenses proactively. The campaign highlights the importance of robust security measures to detect and prevent such sophisticated phishing attacks, especially those that bypass traditional security controls by using legitimate services in their attack chain.
