It is currently a difficult period for job seekers, and scammers are aggressively preying on candidates who are hopeful of landing a role at reputable companies. A sophisticated new phishing campaign is utilizing fake interview invites to impersonate major brands, such as Adidas, Netflix, Adobe, and FIFA, with the specific intent of stealing Google account credentials. Employment-related scams are certainly not a new phenomenon, but they frequently appear in various guises, ranging from fake job offers sent through text messages to fraudulent applications distributed via Google Forms. Last year, scammers even conducted a similar recruitment email campaign while masquerading as Netflix. The primary objective of these bad actors is typically to phish for sensitive personal information or to manipulate candidates into sending money for various fabricated onboarding expenses.
How the Fake Job Interview Scam Operates
This particular job scam primarily targets marketing professionals seeking high-value positions across a diverse range of sectors, including technology, hospitality, travel, food, entertainment, and luxury goods. The fraud begins with an unsolicited phishing email from a supposed recruiter at one of more than 34 different companies, inviting the candidate to schedule a meeting to discuss the opportunity further. The scammers appear to be utilizing the actual names and professional photos of real recruiters at these organizations, which makes it significantly less likely to raise suspicion if a candidate attempts to verify their legitimacy. If a job seeker clicks the provided link to the recruiter's calendar, they are redirected multiple times and ultimately land on a malicious website specifically crafted to look like a legitimate interview scheduling page. Once on this site, they are prompted to sign in with Google, which triggers a fake login interface that mimics the look of a genuine Google authentication pop-up; however, this is actually just a component of the phishing page. This is a classic example of a browser-in-the-browser (BitB) attack. Threat actors appear to be using a legitimate HR platform known as PeopleForce and a domain operated by Salesforce to initiate this scam, although it remains unclear whether they created their own accounts or are using stolen credentials.
Signs of a Fraudulent Job Scam
Like most scams, this one preys heavily on human emotion, specifically the excitement and urgency associated with being recruited for a highly desirable position in a competitive job market. If you receive an unsolicited message from a recruiter, whether via email, LinkedIn, or any other social platform, proceed with extreme caution, especially if you never applied for the job or if the opportunity sounds too good to be true. If you are uncertain about the legitimacy of an offer, go directly to the company's official careers page to find the listing independently. Just because a calendar or application link appears to lead to a legitimate site does not mean your data is safe. Scammers have developed numerous ways to spoof URLs or redirect web traffic so that you may not immediately realize you are being phished. Carefully inspect the address bar on the final window for sneaky characters or other suspicious URL tricks. If you are being prompted to enter single sign-on credentials, such as Apple, Google, or Facebook, to schedule an interview or fill out an application, this is a major red flag. Try to interact with the pop-up, such as by dragging it away from the main browser window or highlighting the URL; if you cannot perform these actions, it is likely a fake window. Furthermore, using a password manager can protect you against BitB attacks, as these tools will only fill in your credentials on the legitimate, verified domain.
