Extended Rapid Response: RecruitTrap Recruit Scams are Targeting Enterprise Credentials on Mobile

This campaign involves threat actors conducting recruitment-themed phishing attacks to steal enterprise credentials. On desktop, Browser-in-the-Browser techniques create convincing fake login prompts, while mobile devices show full-screen counterfeit login pages lacking URL visibility. The infrastructure filters victims to exclude personal email users, focusing on corporate accounts to maximize impact. Attackers impersonate prominent brands such as Amazon, Louis Vuitton, Apple, FIFA, Emirates, Boeing, Heineken, Deloitte, and Lego. Hosting is primarily on Amazon and SEDO networks, with domains remaining undetected by traditional feeds for periods ranging from days to years. The campaign enables attackers to harvest credentials, steal OAuth tokens, and move laterally within targeted organizations.

The campaign enables attackers to harvest enterprise user credentials and OAuth tokens, potentially allowing unauthorized access to corporate resources. This can lead to lateral movement within organizations, increasing the risk of data breaches and further compromise of enterprise systems. The targeting of corporate emails and rejection of personal accounts increases the likelihood of successful credential theft from valuable targets. Delayed detection of malicious domains prolongs exposure and risk to organizations.

No official patch or fix applies as this is a phishing campaign. Organizations should educate employees about recruitment-themed phishing and the risks of fake login pages, especially on mobile devices. Use multi-factor authentication to reduce the impact of credential theft. Monitor for suspicious OAuth token activity and implement detection for Browser-in-the-Browser phishing techniques. Employ domain monitoring to identify and block access to known malicious domains listed in threat intelligence feeds. Traditional threat feeds may have detection delays, so proactive threat intelligence integration is recommended.