GmailPhishingAlert.md

Fake Interviews Offered at Top Brands to harvest Gmail creds

• Phishing email sent posing as a recruiter looking to hire people for marketing roles
• The email addresses the individual by their name and the individual works in the relevant field, therefore the attackers likely did some relevant research and collection
• The target is then directed to click a link to book a meeting and is asked to provide their Gmail credentials

Phishing Workflow Summary

The attacker is using nested redirects across different legitimate platforms:

1. ⁠The email was sent via PeopleForce (peopleforce[.]io)⁠ a genuine, cloud-based Human Resource Management (HRM) and Applicant Tracking System (ATS) platform.
2. The original email points to Salesforce Marketing Cloud/ExactTarget (⁠exct[.]net⁠).
3. ExactTarget redirects to Wise Agent (⁠wiseagent[.]com⁠).
4. Wise Agent redirects to the final Netlify phishing site (⁠mckinsey-careers[.]com⁠).
5. The phishing landing page also uses what appears to be a Browser-in-the-Browser (BitB) pop-up for the Gmail Login Page

Identified Targets

Airlines & Travel

• American Airlines (aa-careers[.]com)
• Booking[.]com (booking-careers[.]com)
• Delta Air Lines (jobs-delta[.]com and delta-careers[.]com)
• United Airlines (unitedairlines-careers[.]com)

Food & Beverage

• Coca-Cola (cocacola-meetings[.]com, cocacola-hr[.]com, thecocacola-company[.]com, and cocacola-careerhub[.]com)
• PepsiCo (pepsico-jobs[.]com)
• Red Bull (redbull-hiring[.]com)

Apparel & Luxury Goods

• Adidas (adidas-hiring[.]com)
• Louis Vuitton (hiring-louisvuitton[.]com)
• Sephora (sephora-careers[.]com)
• Levis (levis-careers[.]com)

Staffing, Consulting & Tech

• Adobe (jobs-adobe[.]com)
• Aquent (aquent-careers[.]netlify[.]app)
• ManpowerGroup (manpowergroupjobs[.]com)
• McKinsey & Company (mckinsey-careers[.]com)
• OpenAI (careers-openai[.]com)

Hospitality & Marketing

• Marriott (marriott-globalcareers[.]com, marriott-hiring[.]com, and marriott-opportunities[.]com)
• Omnicom Group (omnicom-hiring[.]com and omnicom-jobs[.]com)

Entertainment, Sports & Regional

• FIFA (fifahr-careers[.]com, fifaworldcup-jobs[.]com, fifa-careerportal[.]com, fifa-careerhub[.]com, fifa-talenthub[.]com, and jobs-fifa[.]com)
• Netflix (jobsatnetflix[.]com)

Example Phishing Email:

Example Landing Page

Relevant URLs

• Phishing Landing Page https://urlscan.io/result/019f2485-084f-739a-bf50-3a311fd848a4/
• URLscan query: https://urlscan.io/search/#task.url%3Aexct.net%20server%3A%22Netlify%22
• AnyRun query: https://app.any.run/submissions#tag:30-min-phish

IOCs

aa-careers[.]com
booking-careers[.]com
jobs-delta[.]com
delta-careers[.]com
unitedairlines-careers[.]com
cocacola-meetings[.]com
cocacola-hr[.]com
thecocacola-company[.]com
cocacola-careerhub[.]com
pepsico-jobs[.]com
redbull-hiring[.]com
adidas-hiring[.]com
hiring-louisvuitton[.]com
sephora-careers[.]com
jobs-adobe[.]com
aquent-careers[.]netlify[.]app
manpowergroupjobs[.]com
mckinsey-careers[.]com
marriott-globalcareers[.]com
marriott-hiring[.]com
marriott-opportunities[.]com
omnicom-hiring[.]com
omnicom-jobs[.]com
fifaworldcup-jobs[.]com
fifa-careerportal[.]com
fifa-careerhub[.]com
fifa-talenthub[.]com
jobs-fifa[.]com
fifahr-careers[.]com
jobsatnetflix[.]com
levis-careers[.]com
careers-openai[.]com