Google Account Security Alert: A New Job Interview Scam Targets Job Seekers
In the competitive job market, job seekers are constantly on the lookout for opportunities. However, a new scam is emerging that preys on their excitement, targeting marketing professionals in particular. This sophisticated phishing campaign uses fake interview invites from well-known brands like Adidas, Netflix, Adobe, and FIFA to steal users' Google account credentials.
The scam begins with a phishing email from a seemingly legitimate "recruiter" at one of more than 34 companies. Scammers use real names and photos of recruiters, making it harder for victims to spot the deception. When a job seeker clicks the link to schedule an interview, they are redirected to a malicious website that mimics a real interview scheduling page. This page prompts the user to sign in with their Google account, using a fake login interface that closely resembles Google's authentication pop-up.
This is a classic example of a browser-in-the-browser (BitB) attack, where the phishing page creates a browser window within the main browser window, making it even harder to detect.
The threat actors behind this scam are using legitimate platforms like PeopleForce and Salesforce domains, though the source of these accounts is unclear. Whether they are creating new accounts or using stolen credentials, the goal is to gain access to users' Google accounts.
As a job seeker, it's crucial to remain vigilant and cautious when receiving unsolicited messages from recruiters. If you haven't applied for a job and the opportunity sounds too good to be true, proceed with extreme caution. Always verify the legitimacy of the company by visiting their careers page directly.
Additionally, be wary of any prompts to enter single sign-on credentials, such as Apple, Google, or Facebook. If you encounter a pop-up that asks for your credentials, try to interact with it by dragging it away from the main browser window or highlighting the URL. A password manager can also help protect against BitB attacks by preventing the automatic filling of credentials on fake websites.
In the digital age, job seekers must be aware of these sophisticated scams and take proactive measures to protect their personal information and credentials. By staying informed and cautious, they can navigate the job market more safely and successfully.
