A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing…

Team CymruのWill Thomas氏が、Adobe・Netflix・Coca-Cola・OpenAIなど30以上の大手ブランドを装い、マーケティング職の採用面接を口実にGoogleアカウントの認証情報を狙うフィッシングキャンペーンを公表。正規のクラウドサービスPeopleForce・Salesforce Marketing Cloud・Wise Agentを経由するリダイレクトの連鎖と、...

  A sophisticated phishing campaign is targeting marketing professionals by posing as recruiters from more than 30 globally recognized brands, including Adobe, Netflix, Coca-Cola, OpenAI, Adidas, and Marriott. The attackers aim to steal Google account credentials by luring victims into fake job interview processes. According to cybersecurity intelligence and threat hunting company Team Cymru, the operation exploits legitimate cloud-based platforms such as PeopleForce, a human resources service, and domains linked to Salesforce Marketing Cloud before redirecting users to malicious websites. To make the scam appear authentic, the threat actors are also using the names and profile pictures of actual recruiters from the companies they impersonate. Will Thomas, senior advisor at Team Cymru, investigated the campaign and found that the phishing emails present themselves as recruitment messages. As he noted, the emails appear to be from “a recruiter looking to hire people for marketing roles.” The investigation revealed that attackers have registered at least 34 domains designed to mimic prominent organizations across multiple industries. These include airlines and travel companies such as American Airlines, Booking.com, Delta Air Lines, and United Airlines; food and beverage giants Coca-Cola, PepsiCo, and Red Bull; fashion and luxury brands Adidas, Louis Vuitton, Sephora, and Levi’s; consulting and technology firms including Adobe, Aquent, ManpowerGroup, McKinsey & Company, and OpenAI; hospitality and marketing companies Marriott and Omnicom Group; as well as entertainment and sports brands like FIFA and Netflix. Researchers found that the attackers rely on a technique known as nested redirects, where users are routed through several legitimate online services before ultimately reaching a fraudulent webpage. Although the phishing emails appear to originate from PeopleForce, the embedded links resolve to the exct[.]net domain, which is operated by Salesforce following its acquisition of ExactTarget, now known as Salesforce Marketing Cloud. From there, victims are redirected through Wise Agent, a cloud-based customer relationship management (CRM) platform for real estate professionals, before arriving at the phishing website. BleepingComputer reported that the campaign has been active for at least five months. Earlier versions reportedly used Outlook email addresses carrying the names of the companies being impersonated. In one example, a phishing email claiming to be from Adidas recruiter Paulina Manzo invited recipients to schedule a discussion regarding a potential job opportunity. Clicking the scheduling link redirected users to the fraudulent domain adidas-hiring[.]com. To proceed with booking the interview, victims are instructed to sign in with their Google accounts. Selecting the “Continue with Google” option launches what appears to be a genuine Google authentication window. However, the pop-up is actually created using HTML and CSS within the phishing page itself, a deception technique known as browser-in-the-browser (BitB). By leveraging modern web development methods, attackers can closely replicate legitimate authentication prompts, making it difficult for users to distinguish fake login windows from real ones. Researchers emphasized that the misuse of legitimate platforms does not necessarily indicate those services have been compromised. Instead, threat actors may have created valid accounts specifically for the campaign or used compromised credentials to configure redirect chains and phishing pages. A complete list of the malicious domains associated with the campaign has been published in Will Thomas' GitHub analysis.

A phishing campaign is impersonating more than 30 major brands, including Adobe, Netflix, Coca-Cola, and OpenAI, to lure marketing professionals into fake job interviews and steal their Google account credentials. The operation uses legitimate services and fake recruiter identities to build trust, then sends victims through nested redirects to a malicious Google sign-in page. #Adobe #Netflix #CocaCola #OpenAI #PeopleForce #SalesforceMarketingCloud #TeamCymru

PeopleForce, el destacado proveedor europeo de soluciones de software para Recursos Humanos, ha anunciado su llegada a Colombia.

PeopleForce, el destacado proveedor europeo de soluciones de software para Recursos Humanos, ha anunciado su llegada a Colombia.

PeopleForce, a Ukrainian-Polish startup developing an all-in-one HR platform, has raised $5.38 million in a Pre-Series A funding round to accelerate its expansion in Poland. The round was co-led by Pracuj Ventures and u.ventures, which were also joined by Nick Bilogorskiy’s Dnipro VC and Sturgeon Capital. PeopleForce shared the details with AIN. About PeopleForce Founded in 2019 by Andrew Cetinic, PeopleForce is an all-in-one HR platform designed to provide the best employee experience and streamline HR processes at every stage of the employee life cycle. According to the company, PeopleForce is already recognized as one of