Fake Recruiter Phishing Now Targets Corporate Logins

A job offer used to be a consumer scam. The recruiter was fake, the target was a job seeker, and the prize was usually money or personal data. Three separate research teams have now documented recruitment-themed phishing campaigns that work differently: the phishing page refuses Gmail, Yahoo and Outlook addresses and only continues when the victim enters a corporate email. The attackers are not after the job seeker's savings. They want the work account.

Okta described the pattern in December 2025, Intel 471 published a long-running operation in July 2026, and Zimperium reported a mobile-focused variant in August 2026. This article explains what the researchers found, how a fake interview invitation turns into a stolen company login, and what security teams can do about it.

What the researchers found

Okta, December 2025. Okta Threat Intelligence tracked multiple phishing clusters, grouped as O-UNC-038, that used more than 400 domains to impersonate the recruitment teams of large brands, including Meta, Puma, Sony PlayStation, Adidas, Cisco, Google, Starbucks and Zara, as well as staffing firms such as Adecco, Hays, Robert Half and Randstad. The emails were sent through compromised or fraudulent Salesforce ExactTarget accounts. In one campaign, the fake Google login page rejected personal email address formats, so only Google Workspace accounts were collected.

Intel 471, July 2026. Intel 471 named its finding Operation Fake KickOff and traced it back to April 2025. By its July 7, 2026 cutoff, the researchers had counted 232 dedicated phishing domains and 80 command-and-control servers across 15 industries. Human resources consulting brands accounted for about 54% of the phishing infrastructure, and two staffing firms, Robert Half and Aquent, were impersonated in about half of all observed domains. Victims' email addresses were checked against a hardcoded list that blocked Google, Yahoo, MSN, iCloud, Outlook, Hotmail, ProtonMail and AOL, so that only corporate emails got through.

Zimperium, August 2026. Zimperium's zLabs team reported a campaign it calls RecruitTrap, impersonating HR staff at companies such as Amazon, Louis Vuitton, Apple, FIFA, Emirates Group, Boeing, Heineken, Deloitte and Lego. The attackers used public profile data to pose as real HR employees and ran what the researchers describe as hyper-realistic scheduling flows. The kit screened what victims typed and rejected personal email domains. Zimperium published 46 previously unreported indicators of compromise and noted that one impersonation domain had gone unlisted by threat feeds for 2,297 days.

The three reports describe different infrastructure, but the design choice is the same: a job lure, a realistic hiring step such as an application form or an interview booking, and a login page that only accepts a work account.

How a fake interview invitation steals a work account

Intel 471 laid out the full flow of Operation Fake KickOff. Condensed, it runs like this:

1. The invitation arrives through a real marketing platform. The emails were sent through the marketing platforms Salesforce, SendGrid and Zoho, so they arrive from well-known sending services rather than an unknown server.

2. The recruiter looks real. The attackers used the actual names and profile pictures of real recruiters, so a quick search of the sender's name returns a genuine person.

3. The victim books an interview. The link opens a fake Calendly-style scheduling page. Picking a time feels like a normal step in a hiring process, which is exactly why it works.

4. A "Continue with Google" button appears. It leads to a fabricated login screen. On desktop, several of these campaigns draw the login box as a fake pop-up window inside the page, a technique known as browser-in-the-browser (BitB).

5. The password is captured and the MFA code is relayed. Intel 471 found four scripts built to harvest verification codes sent by email, SMS, the Google Authenticator app and Google prompt notifications.

6. The victim lands somewhere believable. After a successful capture, the page redirects to a legitimate calendar or another real website, so nothing looks wrong.

Not every campaign is this advanced. Okta noted that the clusters in its advisory collected passwords without capturing session cookies. Intel 471's kit shows where the technique has gone since: live interception of the second factor, so that a code-based MFA prompt no longer stops the attacker. For a deeper look at relayed logins, see our explainer on adversary-in-the-middle phishing.

Why the kit asks for a work email

Turning away personal addresses means losing victims, so the filter shows what these kits are built for. A Google Workspace or Microsoft 365 account opens company email, shared drives, calendars and every application that signs in with that identity. The reports do not describe what happened after the logins were stolen, but a working corporate account is a standard starting point for invoice fraud, internal phishing and data theft.

This is also what separates this wave from the job scams most organizations already warn about. A fake recruiter asking a candidate for an upfront fee is a problem for that person. A fake recruiter harvesting a Workspace login is a problem for the employer.

Why mobile makes the lure harder to spot

Zimperium's report focuses on what happens when the same link is opened on a phone. On a desktop, the victim sees a simulated browser window. On a small screen, the kit swaps that window for a full-screen counterfeit login page. With no visible address bar and none of the browser frame that normally surrounds a real sign-in prompt, a mobile user has almost nothing to check.

Why employees may not report it

This part is our assessment rather than a finding in the reports. Most phishing lures are awkward to report only because people feel foolish for clicking. A recruitment lure adds a second reason to stay quiet: reporting it to the security team can reveal that the employee was open to leaving. Someone who entered their work password on a fake interview page may decide to change the password quietly and say nothing.

Security teams should expect that silence and design around it. The fastest way to shorten a compromise is a reporting channel that asks what happened, not why the employee was reading job offers.

Red flags employees can check in a recruiter message

• The login step does not belong. Scheduling an interview never requires signing in with a company account. A "Continue with Google" or "Sign in with Microsoft" prompt on a booking page is the clearest warning sign in these campaigns.
• Only a work email is accepted. If a careers page refuses a personal address, stop. Legitimate recruiters contact candidates on whatever address they applied with.
• The pop-up cannot leave the page. Intel 471 and Okta both point to the same test: a real sign-in window can be dragged outside the browser window, while a browser-in-the-browser fake stays trapped inside the page.
• The recruiter is real, but the channel is not. Attackers borrow real recruiters' names and photos. Check the role on the company's own careers site, or contact the recruiter through the company's official website rather than the link in the message.
• The role is flattering and urgent. A senior title, a well-known brand and a short deadline to book a slot are the same pressure tactics used in any phishing email.

How to defend against fake recruiter phishing

1. Move work accounts to phishing-resistant MFA. Intel 471 recommends phishing-resistant MFA for Google Workspace, such as Titan Security Keys or passkeys. Okta recommends the same class of protection, FastPass, WebAuthn or passkeys, and disabling SMS and voice factors. A relayed one-time code is the core of the attack; a factor that cannot be relayed removes it. Our overview of real-life MFA phishing attacks covers the browser-in-the-browser variant in more detail.

2. Block and watch newly registered look-alike domains. Intel 471 advises blocking newly registered domains that follow the naming conventions of the campaign. Zimperium's finding that some impersonation domains stay unlisted for years is a reminder that threat feeds alone will be late.

3. Tell employees that a login on a booking page is never normal. This single rule covers every campaign in the three reports, and it is short enough to remember when the message is opened on a phone.

4. Make reporting safe for this specific lure. State plainly that reporting a suspicious job offer will not be shared with anyone's manager. If employees fear the report more than the attack, the security team loses its early warning.

5. Treat a reported recruiter email as a possible account compromise. If someone entered credentials, reset the password, revoke active sessions and check for new MFA methods, forwarding rules and unfamiliar OAuth app grants. An incident response workflow that pulls the same message from every other mailbox limits how many colleagues receive it.

6. Include recruitment lures in training, carefully. Recruitment is a legitimate theme for simulation because attackers use it. It is also personal. A simulation that impersonates a named local employer, or that is used to find out who is job hunting, damages the trust the program depends on. On Reddit's r/sysadmin, an August 2026 thread with more than 460 comments came from an employee who, two interviews into a recruitment process with a well-known local company, came to believe the approach had been staged by their own employer. One of the most upvoted replies called it a toxic workplace. Keep recruitment simulations generic, focus the lesson on the login step, and never report individual results as a sign of intent to leave.

Where this fits in the bigger picture

The Verizon 2026 Data Breach Investigations Report found phishing to be the initial access vector in 16% of breaches (p. 12). The campaigns above show how targeted one part of that picture has become: they reach employees through the professional side of their lives, borrow the identities of real recruiters, and are built to collect exactly the accounts organizations spend the most to protect.

If your awareness program warns about job scams only as a personal finance risk, it is missing the version that targets the company. Our guide to LinkedIn scams covers the social media side, and our analysis of the Lazarus Group's fake job campaigns shows how state-backed attackers use the same lure to deliver malware.

Training people for a recruiter who does not exist

Recognizing a fake recruiter comes down to a few habits: questioning a login request that does not belong, checking a role on the company's own site, and reporting quickly without fear. Those habits are built through practice, not a single warning email.

With Keepnet Phishing Simulator, security teams can build recruitment-themed scenarios from custom email and landing page templates, such as an interview invitation that leads to a booking page, and run them alongside the other lures employees face. Our guide to customizing simulations for different departments explains how to match scenarios to each team, and Security Awareness Training covers the habits behind them.

Sources

• Okta Threat Intelligence, "Jobseekers exploited in fake recruiter phishing campaigns," December 19, 2025.
• Intel 471, "Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials," July 15, 2026.
• Zimperium zLabs, "Extended Rapid Response: Zimperium Identifies RecruitTrap Recruit Scams are Targeting Enterprise Credentials on Mobile," August 24, 2026.
• Verizon, 2026 Data Breach Investigations Report, 2026, p. 12.