This multi-stage phishing operation leverages legitimate SaaS and cloud services to conduct credential theft by impersonating recruiters from well-known HR firms. Attackers use a large infrastructure of phishing domains and command-and-control servers to deliver emails through trusted platforms, increasing the likelihood of victim engagement. Victims are led to fake Calendly pages mimicking real recruiters, where an adversary-in-the-middle toolkit employing browser-in-the-box technology intercepts Google sign-in credentials. This toolkit is capable of bypassing various MFA mechanisms, enabling attackers to harvest corporate credentials effectively. The campaign specifically filters out personal email providers, focusing on corporate accounts, and exfiltrates data to cloud servers and messaging bots for further use.

The campaign enables attackers to steal corporate credentials, including those protected by MFA, through sophisticated phishing and adversary-in-the-middle techniques. This can lead to unauthorized access to corporate email accounts and potentially other corporate resources, increasing the risk of data breaches, espionage, and further compromise within targeted organizations. The use of legitimate SaaS platforms for email delivery and cloud services for data exfiltration complicates detection and mitigation efforts.

No official patch or fix is applicable as this is a phishing campaign rather than a software vulnerability. Organizations should educate employees about this specific phishing tactic, especially regarding recruitment impersonation and suspicious Calendly links. Implementing advanced email filtering to detect phishing domains and monitoring for unusual login patterns can help. Use of security solutions capable of detecting adversary-in-the-middle browser-in-the-box attacks may reduce risk. Since the campaign bypasses MFA, consider additional protective measures such as hardware security keys and continuous authentication monitoring. Review and restrict third-party SaaS integrations where possible. Refer to the vendor advisory and threat intelligence sources for ongoing updates.