CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the
CTM360's RecruitTrap report documents 3,000+ recruitment phishing URLs using BitB windows to steal credentials and relay MFA.
CTM360 identified over 3,000 phishing URLs impersonating recruiters from more than 50 organizations across 14 sectors in the RecruitTrap campaign. Attacks use Browser-in-the-Browser popups with spoofed address bars to harvest Google and Facebook credentials and relay MFA prompts in real time. About 96% of pages used a Calendly theme, with infrastructure concentrated on AWS EC2 and hidden behind Cloudflare.
- Browser-in-the-Browser popups spoof Google/Facebook login
- Backend state machine relays real-time MFA codes to attackers
- 3,000+ URLs impersonating 50+ organizations across 14 sectors
- 96% of phishing pages used Calendly-themed scheduling lures
- Targets skewed toward marketing and recruitment roles
- ATT&CK
- T1566.002 Spearphishing LinkT1656 ImpersonationT1056.004 Input Capture: Web Portal CaptureT1557.004 Adversary-in-the-Middle: LLM API Prompt Injection
- Organizations
- CTM360
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.