Bogus recruiters go after high-value corporate credentials on mobile
Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.
Zimperium reports scammers posing as HR staff use browser-in-the-browser (BitB) phishing via fake interview scheduling flows to steal corporate credentials. The kit pre-qualifies victims by rejecting personal email addresses, then captures credentials that grant OAuth tokens, internal communications, and cloud access enabling lateral movement. Domains impersonating Amazon, Louis Vuitton, Apple, FIFA, Boeing, Deloitte and others were tracked for a year, mostly hosted on AWS and SEDO, with 46 previously unpublished IOCs released.
- BitB kit mimics full browser windows on desktop; uses fullscreen pages on mobile.
- Pre-qualification logic rejects personal emails, targeting high-value corporate accounts.
- Compromised accounts expose OAuth tokens, internal communications, and cloud applications.
- Impersonated brands include Amazon, Louis Vuitton, Apple, FIFA, Boeing, and Deloitte.
- Vendors
- Zimperium
From the original article
2 min read at helpnetsecurity.com
Scammers posing as HR staff at well-known companies are running interview scheduling scams that end with a stolen corporate password , according to Zimperium. Attackers are using a technique called browser-in-the-browser , or BitB, which CTM360 documented in earlier research on recruitment phishing.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.