Executive Summary
Intel 471 investigated an ongoing, multi-stage phishing operation that systematically abuses legitimate software-as-a-service (SaaS) sales and marketing, and cloud platforms to orchestrate corporate credential theft. The campaign lures victims using deceptive, corporate-themed interview-scheduling interfaces, leveraging the identity of real recruiters linked to impersonated organizations to deploy an adversary-in-the-middle (AitM) toolkit designed to harvest corporate Google Workspace credentials, live session tokens in real time and bypass standard multi-factor authentication (MFA) mechanisms.
Key Findings
- Extensive infrastructure pool: We identified 232 dedicated phishing domains, 80 command-and-control (C2) servers.
- Impersonation of human resources hiring firms: The campaign impersonated premier global brands across 15 distinct industry verticals. The most targeted industry was human resources consulting at about 54% of all observed phishing infrastructure, while two prominent global agencies, Robert Half Inc. and Aquent LLC, continuously were impersonated and accounted for about 50% of all observed domains, based on adversaries’ assessed intentions.
- Opportunistic campaign waves: The initial campaigns started in April 2025 and have continuously adapted. Most recently, the adversaries rotated their infrastructure to capitalize on the public visibility of the FIFA World Cup 2026 to lure targets, with insights of this campaign wave being recently reported in open source. The operation continues to successfully deploy live phishing pages and harvest corporate access at the time of this report.
- Delivery mechanisms: The adversaries weaponized legitimate marketing and email-delivery platforms such as Salesforce, SendGrid, and Zoho to distribute email lures leading victims to the phishing landing pages.
- Social engineering: Victims were forwarded to landing pages tailored to mimic a standard Calendly interview interface, using the identity of real recruiters associated with impersonated organizations.
- AitM toolkit: Adversaries deployed an AitM toolkit possibly developed with support of AI. A dedicated script applies the browser-in-the-box (BitB) technique to create a visually identical Google sign-in replica page. The toolkit also had four scripts dedicated to harvest MFA authentication codes delivered via email, short message service (SMS), the Google Authenticator app and Google prompt notification.
- Corporate emails only: Victims’ emails were verified with a hardcoded list that blocked standard providers. The assessed intention is that only corporate emails were targeted.
- Data exfiltration: Stolen credentials were forwarded to C2 servers on Render cloud hosting infrastructure and then to Telegram bots.
Intelligence cutoff date (ICOD): July 7, 2026
FIFA-themed phishing page reveals operation to harvest corporate account credentials
Our investigation began with the analysis of the fifahr-careers.com phishing domain. Visitors to the site were met with a deceptive Calendly interview-scheduling interface that prompted them to log into a fake Google Calendar using a business account. When victims clicked "Continue with Google," instead of launching a secure Open Authorization (OAuth) pop-up window, the page redirected the user to a fabricated Google login screen within the current tab. To maximize credibility, adversaries leveraged the actual names and profile pictures of real recruiters from FIFA’s talent acquisition team. While not confirmed, adversaries possibly obtained this information from public accessible profiles on the Linkedin social media platform.
Our investigation of Operation Fake KickOff revealed that the campaign did not solely impersonate FIFA, but instead expanded to target dozens of other organizations in an operation that has been active since April 2025.
Figure 1: The image depicts the fifahr-careers.com phishing page illustrating a schedule call designed to harvest corporate account credentials. Screenshot obtained June 24, 2026.
Campaign delivery mechanisms
To maximize the reach of their campaigns, adversaries systematically abused various software-as-a-service (SaaS) platforms to deliver phishing landing pages. This operational methodology was corroborated by the discovery of distinct URL redirect schemas and native click-tracking infrastructure unique to each service. The specific abused platforms and their associated redirect domains observed during this campaign include:
On July 6, 2026, the BleepingComputer cybersecurity news outlet reported on a phishing campaign that directly overlaps with the findings in this report. The article highlighted a public warning that Adidas recruiter Paulina Manzo posted to Linkedin regarding threat actors impersonating her identity. Another Linkedin user posted a screenshot of a phishing email received that impersonated Manzo's communications and redirected victims to the adidas-hiring.com website, which is one of the tracked phishing pages in this campaign (see: Figure 2).[1]
Figure 2: The image depicts the email phishing a Linkedin user shared to illustrate the campaign impersonating Paulina. The screenshot was posted to Linkedin in June 2026.
Phishing kit capabilities
The phishing pages were designed with the React framework and had AiTM capabilities to orchestrate persistent, real-time communication with an adversary-controlled backend to dynamically manipulate the session and orchestrate MFA bypasses. The primary purpose of the campaign likely is to harvest Google Workspace login credentials and session details but we also identified some pages designed to steal Facebook credentials.
Analysis of the phishing page revealed a set of instructions to perform the Browser-in-the-Box (BitB) technique and create a visually identical Google sign-in replica page of a browser window inside a malicious webpage.[2]
Figure 3: The image depicts the phishing page running the BitB technique to generate a Google sign-in replica page.
Phishing operators filtered out standard email providers with a hardcoded list that include Google, Yahoo, MSN, iCloud, Outlook, Hotmail, ProtonMail and AOL email providers.
If a target attempts to authenticate using a personal address, the application halts progression and displays an artificial validation error, forcing the submission of a corporate domain. Once a valid corporate email address and password are submitted, the component captures additional victim telemetry such as the client's IP address and localized geographic data via the third-party ipwho.is service before transmitting the payload via an HTTP POST request to the /api/login endpoint.
Upon receiving the primary credentials, the frontend initializes a persistent polling routine via a 3-second setInterval loop targeting the endpoint /check_response?session_id=. This creates a live feedback loop with the attacker's control panel, allowing the adversary to inspect the captured credentials in real time and interactively push subsequent commands back to the victim's browser.
Depending on the specific MFA defense encountered by the attacker during their live authentication attempt, the backend instructs the frontend to dynamically route the victim through a series of dedicated verification components, seamlessly updating the UI to match the requested second-factor challenge:
- /email : Displays a spoofed Google two-step verification prompt requiring the entry of a verification code sent to the victim's email.
- /2fa : Presents a specialized prompt requesting a time-based six-digit one-time password (TOTP) from the Google Authenticator app.
- /sms: Adjusts the interface to request an SMS-delivered mobile confirmation code.
- /tap: Simulates a high-fidelity Google prompt notification. The page polls at a rapid 500ms interval to retrieve a dynamic verification_number supplied by the attacker, explicitly instructing the victim to open their mobile Gmail application, select Yes, and tap the corresponding number displayed on the screen.
If the session is successfully intercepted or manipulated to completion by the operator, the backend transmits a final redirect instruction, routing the victim either to a confirmed scheduling state containing realistic Google Calendar workspace entries or out to a legitimate external URL to lower suspicion.
AI-assisted development
The presence of unusually descriptive, verbose inline comments, the inclusion of emojis and overall programmatic neatness indicate that the adversaries leveraged generative AI tools to develop the phishing kit. The code snippet below, extracted from the Login.js script, illustrates this assessment.
Victimology
We identified a cluster of 141 unique phishing domains, which revealed the campaigns started June 5, 2025, and continue active at the time of this report.
Figure 4 - The image depicts a timeline highlighting the domain registration dates of all 232 phishing pages.
Analysis of the phishing pages and domains revealed that adversaries impersonated 52 unique organizations across 15 different industries. The most targeted industry on the impersonation campaign was human resources consulting at about 54%.
Figure 5 - The image depicts the distribution of impersonated organizations and the main industries each company operates.
Infrastructure
The operators created about 232 domains for these campaigns, with the majority registered with the .com top-level domain (TLD), utilizing registrar services such as the Hosting Concepts BV, Trustname.com, Name.com, Nicenic International Group Co. Ltd. and Key-Systems GmbH. Whois metadata artifacts indicated that adversaries also leveraged the Netlify AI and cloud hosting platform to create domains and possibly host phishing pages. Passive domain name system (DNS) analysis revealed most of the infrastructure was hosted on Amazon behind CloudFront but also directly exposed via elastic compute cloud (EC2) hosts.
Figure 6 - The image depicts the distribution of hosting infrastructure linked to the phishing landing pages.
The campaign operators relied on systematic typosquatted naming conventions to mimic legitimate corporate recruitment pipelines, primarily alternating combinations of targeted brand names, HR-centric keywords and third-party scheduling tools. The most common domain naming patterns observed were [brand]-[keyword].[TLD] and [keyword]-[brand].[TLD]. The most common keywords observed included:
- -careers, -jobs, -hiring, -recruiting, -hr, jobsat-, -talent, -careerpath, -workwithus, -jobupdates, -talenthub, -jobapply, -recruitment, -meetings, -calendar, -calendly and -schedulecall.
To receive stolen data, primarily relied and abused the Render cloud platform at onrender.com to host backend servers. We successfully identified 80 unique servers, which were reused and sometimes assigned to more than one phishing domain. We leveraged the Gephi tool to cluster the relationship of phishing pages in red and the command-and-control (C2) servers in black to illustrate the behavior (see: Figure 7). Stolen victim data was then exfiltrated downstream to Telegram.
Figure 7: The image depicts a Gephi-based network graph illustrating the phishing pages in red and the C2 servers in black.
Attribution
The findings of Operation Fake KickOff strongly overlapped with Okta’s tracked cluster O-UNC-038 covered in a report from December 2025.[3] Overlapping evidence included:
- Phishing operations designed to steal Google Workspace account credentials.
- Use of the BitB technique to mimic a Facebook page.
- Data exfiltration to Telegram.
- Abuse of Salesforce ExactTarget.
- Very similar list of impersonated organizations.
- Similar list of keywords used to register domains.
We did not observe exfiltration to socket.io during our analysis.
Assessment
Operation Fake KickOff represents a sustained, adaptive corporate credential-theft campaign that has actively expanded its infrastructure footprint since April 2025. Spanning over 232 dedicated phishing domains across 15 distinct industries, the campaign has demonstrated a calculated focus on the human resources and talent acquisition verticals. Most recently, the operation pivoted to capitalize on the public visibility of the FIFA World Cup 2026, demonstrating the adversaries' agility in aligning their social engineering lures with prominent corporate and global event cycles.
A defining operational characteristic of this campaign is the systematic abuse of legitimate, enterprise-grade cloud, SaaS, and marketing platforms, which presents an immediate detection challenge for security teams. While the most visible indicators of compromise (IoCs) reside within the phishing domains themselves, the adversaries have also successfully weaponized cloud hosting services — particularly Render — to maintain active C2 servers that have remained operational since the campaign's inception in April 2025.
The primary risk this campaign imposes stems from the psychological angle exploited by the adversaries: targeting an individual's inherent desire to secure a role at a premier global brand. This lure effectively entices candidates to log into fake interview portals using the corporate accounts of their current employers or other affiliated organizations. Consequently, the impersonated brands are highly unlikely to be the ultimate targets; instead, they serve as a highly effective mechanism to harvest active corporate access from secondary target organizations, suppliers or industry competitors.
Looking ahead, we assess with high confidence that the operation will continue to aggressively cycle its thematic definitions and infrastructure to exploit highly anticipated global events and corporate hiring trends.
Mitigation recommendations
Phishing is one of the most common attack vectors cybercriminals use. Common mitigation strategies organizations can implement according to the MITRE Detection, Denial and Disruption Framework Empowering Network Defense (D3FEND) knowledge graph of cybersecurity measures include:
Harden
- Enforce a strict policy of least privilege for corporate accounts to mitigate the risk of privilege escalation.
- Enable phishing-resistant MFA solution for Google Workspace accounts such as Titan Security Key or passkeys-based solutions.
Detect
- Recommend employees to scrutinize URLs to ensure they are legitimate and, if uncertain, pass them to the security team for further analysis.
- Use the list of indicators present on the “Indicators of compromise, impersonated organizations” to detect ongoing campaigns.
- Monitor and triage any communications to *.onrender.com.
Prevent
- Block newly registered domains utilizing the domain naming conventions explained in the “Infrastructure” section of this report.
- Alert employees on malicious recruitment email campaigns.
- Train users to identify phishing pages and confirm they are accessing a legitimate website operated by the organization. For BitB techniques, a legitimate authentication window can be dragged completely outside the parent browser window or onto another monitor. If a sign-in window is trapped within the borders of the webpage or disappears when dragging it past the browser's edge, it is an indicator of a BitB replica page.
- Advice HR personnel about possible impersonation attempts and reconnaissance being conducted on public profiles via Linkedin.
MITRE ATT&CK techniques
This report uses the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework.
Sources
[1] https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/
[2] https://mrd0x.com/browser-in-the-browser-phishing-attack/