A sophisticated phishing operation impersonating recruiters from more than 50 organizations has stolen login credentials from job seekers by using fake interview scheduling pages and counterfeit browser windows that relay multi-factor authentication codes in real time. CTM360 discovered more than 3,000 phishing URLs over two months, according to a new report titled RecruitTrap published by the cybersecurity firm. Marketing professionals were the most frequently observed targets, and the campaign spanned 14 industries worldwide.

The phishing sites, about 96% of which used a Calendly theme, guided victims through either a fake scheduling page or a brand-specific recruitment portal. Both paths led to a "Continue with Google/Facebook" button that triggered a Browser-in-the-Browser window—a fake authentication popup with a spoofed address bar and padlock icon. The counterfeit brand portals ran on 116 unique hosts, with 93.1% using dedicated or registered infrastructure and 50.9% hosted on AWS EC2 addresses. Across 813 distinct registered domains, .cfd was the most common top-level domain at 40%, followed by .com at 25.1%, .info at 15.1%, .works at 10.5%, and .work at 6.3%. Recruitment, technology, luxury goods, and travel made up roughly 58% of the impersonated brands.

Technical analysis of one phishing URL revealed that the page operated as a state machine rather than a static form, advancing victims through staged screens for CAPTCHA, username, password, and multiple two-factor authentication methods including one-time passcodes, phone number matching, and suffix verification. A Svelte/SvelteKit front end managed the flow, while a persistent Socket.IO channel allowed the backend to control which screen appeared next. The page filtered out personal email domains and accepted only corporate accounts, narrowing the campaign's focus to enterprise identities. After victims entered credentials and MFA codes, attackers used them to log in to the real service, obtaining an authenticated session while the victim was redirected to a legitimate Calendly page.

Marketing accounts are especially valuable to attackers because compromised marketing accounts can provide access to advertising platforms, corporate social media profiles, customer data, email, and other business-critical services, the report explains. The campaign was designed for rapid rebranding—the same template could be adapted by changing the employer name, recruiter identity, background, slogan, and authentication provider while keeping the same 30-minute meeting and login flow intact. Users should verify unsolicited interview invitations through an independently sourced company channel and navigate to the organization's official careers site instead of clicking links in messages, according to CTM360. A genuine Google sign-in runs on accounts.google.com or another verified Google origin; in a BitB attack, the visible address bar and padlock are part of the web page, and the fake window can't be moved outside the current browser tab. Organizations can reduce exposure by using phishing-resistant authentication such as passkeys or hardware-backed WebAuthn, monitoring for lookalike recruitment domains, and correlating suspicious recruitment emails with unusual sign-in attempts. Anyone who entered credentials into a suspected recruitment page should immediately change the affected password, revoke active sessions and tokens, review sign-in activity and mailbox rules, and notify their security team. The scalability of recruitment-themed identity attacks will likely force enterprises to reconsider whether traditional MFA alone remains sufficient protection for high-value employee accounts. Attackers have shown they can replicate not just the visual interface but the entire interactive state flow of legitimate authentication, turning trusted workflow patterns into vectors for session hijacking.