Bogus recruiters go after high-value corporate credentials on mobile
Scammers posing as HR staff at well-known companies are running interview scheduling scams that end with a stolen corporate password, according to Zimperium.
Attackers are using a technique called browser-in-the-browser, or BitB, which CTM360 documented in earlier research on recruitment phishing. They scrape public profile data and use it to craft convincing scheduling flows designed to get past a target’s skepticism.
Only corporate accounts get through
BitB works on a desktop because it can mimic an entire browser window, address bar included, to make a fake login page look genuine. On a phone, that doesn’t hold up, so the kit switches to a fake login page that covers the whole screen instead. There’s no window or address bar there to begin with, so a victim has nothing to check against.
The phishing kit runs on what Zimperium called “the attacker’s strict pre-qualification logic.” The kit screens what a victim types in and turns away personal email addresses.
“By enforcing the use of corporate credentials, threat actors specifically target high-value enterprise access. Once inside a single corporate account, attackers gain immediate access to OAuth tokens, internal communications, and cloud applications, enabling rapid lateral movement across the organization,” researchers noted.
The hosting behind the domains
Zimperium spent a year tracking domains that impersonate company brands, following patterns such as [company]-careers.com or [company]-global.com. The infrastructure behind them shifts less than expected. Instead of hopping between obscure providers, the same hosting and cloud providers keep showing up, with Amazon Web Services and SEDO GmbH the most common names at the Autonomous System Number (ASN) level.
Top 10 ASN distribution (Source: Zimperium)
Domain blocklists struggle to keep up with newly registered lookalike domains on these shared networks, leaving a window of exposure before a fake site gets flagged. Zimperium published 46 indicators of compromise tied to this activity that had not been made public before.
The domains Zimperium tracked impersonated a broad list of brands, spanning e-commerce, luxury goods, aviation and retail. Names caught up in the scheme include Amazon, Louis Vuitton, Apple, FIFA, Emirates Group, Boeing, Heineken, Deloitte, Central Network Retail Group and Lego, among others.
“Ultimately, defending against these targeted campaigns requires looking beyond desktop-centric web gateways and securing corporate identities at the mobile touchpoint,” Zimperium concluded.