Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time.
CTM360, which detailed the activity in a new report titled RecruitTrap, said it identified more than 3,000+ phishing URLs over two months. The campaign impersonated real recruiters and recruitment processes associated with more than 50 organizations across 14 sectors. Marketing professionals accounted for the majority of observed targets.
The focus on marketing roles appears deliberate. Compromised marketing accounts can provide access to advertising platforms, corporate social media profiles, customer data, email, and other business-critical services.
Read the full report here: https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams
Two Recruitment Lures Lead to the Same Login Trap
The attack starts with an unsolicited email or meeting invitation that appears to come from a recruiter at a recognizable organization. The message references the recipient's professional background and invites them to schedule an interview or informal discussion.
Victims are directed into one of two flows: a counterfeit Calendly-style scheduling page or a brand-specific recruitment portal. The first copies an employer's branding and may reuse the names, photographs, job titles, and other publicly available details of real recruiters. The second asks the target to select a date and time and submit basic contact information.
Both flows lead to “Continue with Google/Facebook,” where a Browser-in-the-Browser (BitB) technique displays a fake authentication popup with a spoofed address bar and padlock. On mobile, this may appear as a full-screen counterfeit login page.
The Phishing Kit Operates as a Live State Machine
CTM360's technical analysis of one Calendly-style phishing URL found that the page behaved as a state machine rather than a static credential form. A Svelte/SvelteKit front end moved victims through staged scenes for CAPTCHA, username, password, and several two-factor authentication methods, including OTP, phone number matching, and suffix verification.
A browser-specific session identifier was stored in sessionStorage, while a persistent Socket.IO channel allowed the backend to control which screen appeared next. CAPTCHA and browser-reload checks were used to filter traffic before credentials were collected.
The page filtered out personal email domains and only advanced corporate accounts, focusing the campaign on valuable enterprise identities.
After the victim entered their login details, the attackers used them to sign in to the real service. The fake page then showed the same MFA request and sent the victim’s code back to the attackers.
If authentication succeeded, the attacker obtained an authenticated session, while the victim could be redirected to a legitimate Calendly page to reduce suspicion.
More Than 3,000 URLs Across Shared Infrastructure
Most of the phishing pages CTM360 found, about 96%, used a Calendly theme. Many used Cloudflare to hide the attackers’ real servers.
The counterfeit brand-specific recruitment portal used 116 unique observed hosts. CTM360 found that 93.1% used dedicated or registered hosts, with 50.9% hosted on AWS EC2 IP addresses and ranges. Repeated hostnames and reused infrastructure indicate that multiple phishing sites were deployed through a shared setup.
Across 813 deduplicated registered domains, .cfd was the most common top-level domain at 40%, followed by .com at 25.1%, .info at 15.1%, .works at 10.5%, and .work at 6.3%.
The campaign is also designed for rapid rebranding. The same template can be adapted by changing the employer name, recruiter identity, background, slogan, and authentication provider while preserving the same 30-minute meeting and login flow.
The most targeted industries were recruitment, technology, luxury goods, and travel, making up about 58% of the brands used.
How to Identify and Respond to the Attack
Users should verify unsolicited interview invitations through an independently sourced company channel and navigate to the organization's official careers site instead of using links in the message.
A genuine Google sign-in should run on accounts.google.com, or another verified Google origin. In a BitB attack, the visible address bar and padlock are part of the web page, the fake window cannot be moved outside the current browser tab, and browser controls or privacy links may be decorative. A password manager failing to recognize or autofill the expected origin is another warning sign.
Organizations can reduce exposure by using phishing-resistant authentication such as passkeys or hardware-backed WebAuthn, monitoring for lookalike recruitment domains, and correlating suspicious recruitment emails with unusual sign-in attempts or new sessions.
Anyone who entered credentials or an MFA code into a suspected recruitment page should immediately change the affected password, revoke active sessions and tokens, review sign-in activity, mailbox rules, and OAuth grants, and notify their security team.
RecruitTrap shows how a familiar job opportunity can be converted into a scalable identity attack. The fake browser window establishes trust; the live backend turns that trust into credential theft, MFA relay, and account takeover.
Download the full report here: https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams
