Fake recruiter emails lure marketers to give Google login

A sophisticated phishing campaign is targeting marketing professionals by impersonating recruiters from more than 30 major global brands to steal Google account credentials. The operation, which has been active for at least five months, uses fake job interview invitations to lure victims into a multi-step scam that exploits legitimate online services to appear authentic.

The fraudulent emails, which appear to be sent via the legitimate PeopleForce human resources platform, address recipients by name and reference their professional field, suggesting attackers conduct preliminary research. They impersonate recruiters from prominent companies across multiple sectors, including Adobe, Netflix, Coca-Cola, Adidas, OpenAI, Marriott, and FIFA, among others. To bolster credibility, scammers use the names and profile pictures of actual recruiters employed at these companies.

The attack employs a technique known as nested redirects to evade detection. When a target clicks a link to schedule a supposed interview, they are not sent directly to a malicious site. Instead, they are routed through legitimate domains, including one operated by Salesforce Marketing Cloud and the Wise Agent...