Full Report
Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time. CTM360, which detailed the activity in a new report titled RecruitTrap, said it
Analysis Summary
# Incident Report: RecruitTrap Browser-in-the-Browser Campaign
## Executive Summary
Cybersecurity firm CTM360 uncovered "RecruitTrap," a large-scale phishing campaign utilizing over 3,000 malicious URLs to target professionals with fake recruitment lures. The attack employs sophisticated Browser-in-the-Browser (BitB) techniques to bypass Multi-Factor Authentication (MFA) and steal Google and Facebook credentials. The campaign primarily targeted marketing professionals across 50+ organizations to gain access to corporate social media and advertising platforms.
## Incident Details
- **Discovery Date:** August 2026 (Reported)
- **Incident Date:** Ongoing (Identified over a two-month period)
- **Affected Organization:** 50+ organizations impersonated; primary targets are marketing professionals.
- **Sector:** Multi-sector (14 sectors including Recruitment, Tech, Luxury Goods, and Travel)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Over a 60-day period leading up to August 2026.
- **Vector:** Phishing via unsolicited emails or meeting invitations.
- **Details:** Attackers impersonated real recruiters, using legitimate names and photos to invite targets to fake interviews.
### Lateral Movement
- **Details:** While the article focuses on credential theft, the objective was to use compromised marketing accounts to access corporate advertising platforms, social media profiles, and internal customer data.
### Data Exfiltration/Impact
- **Details:** Theft of Google and Facebook credentials. In advanced cases, real-time MFA tokens were intercepted, allowing attackers to hijack active authenticated sessions.
### Detection & Response
- **How it was discovered:** Threat research by CTM360 identifying a massive surge in recruitment-themed phishing infrastructure.
- **Response actions taken:** CTM360 mapped the infrastructure, identifying over 813 deduplicated domains and documenting the "state machine" logic of the phishing kits.
## Attack Methodology
- **Initial Access:** Social Engineering (Recruitment lures) and Phishing.
- **Persistence:** Not explicitly detailed, but focused on session hijacking.
- **Defense Evasion:** Use of BitB (Browser-in-the-Browser) to spoof legitimate URLs; use of CAPTCHAs to filter out automated scanners/security bots; Cloudflare usage to mask origin servers.
- **Credential Access:** BitB fake login windows; real-time MFA relay (Adversary-in-the-Middle).
- **Discovery:** Use of publicly available recruiter profiles and professional background data of targets.
- **Collection:** Automated collection of credentials and MFA codes via a Svelte-based "state machine" backend.
- **Exfiltration:** Credential and session token relay to attacker-controlled Socket.IO channels.
- **Impact:** Potential for unauthorized access to business-critical marketing and advertising services.
## Impact Assessment
- **Financial:** High potential for loss via unauthorized access to corporate ad-spend accounts.
- **Data Breach:** Compromise of personal and corporate identities (Google/Facebook).
- **Operational:** Potential takeover of corporate social media and communication channels.
- **Reputational:** Damage to impersonated brands and recruiters used as lures.
## Indicators of Compromise
- **Network indicators:**
- Multiple domains using TLDs: `.cfd` (40%), `.com`, `.info`, `.works`, `.work`.
- Hosting on AWS EC2 IP ranges (50.9% of observed hosts).
- Use of fake Calendly-themed subdomains.
- **Behavioral indicators:**
- Login popups appearing within the webpage window rather than as separate OS-level windows.
- Unsolicited interview requests requiring social media login to "schedule."
## Response Actions
- **Containment:** Identifying and flagging the 3,000+ malicious URLs.
- **Eradication:** Reporting of malicious hosting to providers (AWS, Cloudflare).
- **Recovery:** Users advised to rotate credentials and terminate active sessions if they interacted with the lures.
## Lessons Learned
- **MFA is not a silver bullet:** Sophisticated real-time relay attacks can bypass traditional OTP and push-based MFA.
- **Infrastructure reuse:** Attackers are heavily utilizing cheap/disposable TLDs (like `.cfd`) and reputable cloud providers (AWS) to blend in.
- **Targeting is specific:** The shift toward marketing roles highlights an interest in "soft" corporate targets that control high-value assets like ad budgets.
## Recommendations
- **Technical:** Implement FIDO2/WebAuthn-based hardware security keys which are resistant to BitB and relay attacks.
- **Verification:** Employees should be trained to verify interview requests through official company career portals rather than clicking links in emails.
- **UI Vigilance:** Users should attempt to "drag" login popups past the edge of the main browser window; if the popup stays contained within the page, it is a BitB trap.