Phishing poses as big-brand job interview to steal Google accounts
Phishing campaign impersonates big brands in fake job interviews to steal Google account credentials.
A sophisticated phishing campaign is targeting marketing professionals by impersonating over 30 well-known brands like Adobe, Netflix, and OpenAI. The attackers use fake job interview lures, leveraging legitimate platforms like PeopleForce and Salesforce Marketing Cloud, to trick victims into revealing their Google account credentials through a browser-in-the-browser attack.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are exploiting the trust professionals place in well-known brands by crafting convincing fake job interview scenarios that impersonate over 30 major companies. By abusing legitimate SaaS platforms like Salesforce Marketing Cloud and PeopleForce for delivery, the malicious emails bypass standard reputation-based email filters. The browser-in-the-browser technique renders a fake login popup that appears visually identical to a real Google authentication page, making it extremely difficult for untrained users to detect. This attack highlights that even cautious users can be deceived when attackers weaponize brand credibility and trusted infrastructure simultaneously. Credential theft of this nature can cascade into full account takeovers, data breaches, and lateral movement across connected services.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — exct[.]net
- domain — wiseagent[.]com
- domain — adidas-hiring[.]com