This phishing campaign targets marketing professionals by impersonating recruiters from more than 30 major brands, including Adobe, Netflix, Coca-Cola, and OpenAI. It abuses legitimate cloud-based platforms like PeopleForce and Salesforce Marketing Cloud to create nested redirects that lead victims to malicious landing pages. The attackers use real recruiter identities and a browser-in-the-browser (BitB) technique to present fake Google sign-in pop-ups, tricking victims into submitting their Google credentials. The operation has been ongoing for at least five months and involves multiple sectors such as airlines, food and beverage, apparel, staffing, hospitality, and entertainment. The campaign does not indicate a compromise of the legitimate platforms but likely uses genuine or compromised accounts to configure redirects.

Successful phishing leads to theft of Google account credentials from targeted marketing professionals, potentially compromising their Google accounts. This can result in unauthorized access to email, personal data, and other Google services tied to the stolen credentials. The use of trusted cloud services and realistic impersonation increases the likelihood of victim success.

No official patch or fix applies as this is a phishing campaign. Organizations should educate employees, especially marketing professionals, about this specific phishing tactic involving fake job interviews and the browser-in-the-browser technique. Users should verify URLs carefully and avoid entering credentials on suspicious pages. Since the campaign abuses legitimate cloud services, monitoring for unusual redirect chains and suspicious login attempts is recommended. Vendor-managed remediation does not apply as this is a social engineering attack.