Recruitment Emails Hide BitB Google/Facebook Traps

Researchers found a large recruitment-themed phishing campaign where victims receive unsolicited interview invites and are sent to fake scheduling or recruitment pages. The pages use “Browser-in-the-Browser” fake login popups to steal Google/Facebook passwords and, in some cases, capture MFA codes in real time to take over accounts.

Key findings

• CTM360 reported identifying “more than 3,000+ phishing URLs over two months” tied to the campaign it calls “RecruitTrap.”
• The campaign used recruitment pretexts (interview scheduling / recruitment portals) and impersonated “real recruiters” tied to “more than 50 organizations across 14 sectors.”
• Victims were pushed into one of two flows: a “counterfeit Calendly-style scheduling page” or a “brand-specific recruitment portal,” both leading to “Continue with Google/Facebook.”
• Attackers used Browser-in-the-Browser (BitB) to show “a fake authentication popup with a spoofed address bar and padlock.”
• In advanced cases, the kit relayed MFA: “the fake page then showed the same MFA request and sent the victim’s code back to the attackers.”
• The phishing kit filtered targets: “The page filtered out personal email domains and only advanced corporate accounts.”

Who’s being targeted

• Commonly targeted roles: Marketing, HR/Recruiting, All employees (especially active job seekers), IT/Security Service Desk.
• Affected industries: Recruitment, Technology, Luxury goods, Travel, Marketing/Advertising.
• Attack channels: email, website.
• Impersonated: A recruiter at a recognizable organization (using a real recruiter’s identity), Company-branded recruitment portal.

Awareness takeaways

• Treat unsolicited interview invites as suspicious; verify via official channels and don’t click invite links to ‘schedule’ interviews.
• Train employees to recognize BitB fake login windows, especially Google sign-in lookalikes, and to check the real website address.
• Warn that attackers can steal MFA codes in real time; entering an MFA code on an untrusted page can still lead to account takeover.
• If someone entered credentials/MFA into a suspected recruitment page, respond immediately: change password, revoke sessions, review sign-ins, and alert security.

Red flags to watch for

• Unsolicited interview invite or meeting request
• Login prompt appears in a webpage-made popup (BitB) rather than a real Google/Facebook login page
• You are asked to sign in just to schedule a meeting
• A recruitment portal that unexpectedly forces Google/Facebook authentication
• A fake address bar/padlock inside the page (BitB)
• MFA code requested immediately after entering credentials on an unfamiliar site