# Massive Phishing Campaign Weaponizes Fake Job Interviews to Harvest Google Credentials from Marketing Professionals
A sprawling phishing operation has been systematically impersonating over 30 global brands—including Adobe, Netflix, OpenAI, and FIFA—to trick marketing professionals into surrendering their Google account credentials. The campaign, active for at least five months, leverages sophisticated social engineering, nested redirects through legitimate cloud services, and browser-in-the-browser (BitB) technology to create nearly undetectable authentication hijacking attempts.
## The Threat
The phishing campaign casts a wide net across multiple industries, targeting marketing professionals with convincing fake job interview solicitations. According to research by Will Thomas, senior advisor at Team Cymru, the operation maintains at least 34 domains impersonating prestigious companies:
| Sector | Targeted Brands |
|---|---|
| Airlines & Travel | American Airlines, Booking.com, Delta Air Lines, United Airlines |
| Food & Beverage | Coca-Cola, PepsiCo, Red Bull |
| Apparel & Luxury | Adidas, Louis Vuitton, Sephora, Levi's |
| Tech & Consulting | Adobe, Aquent, ManpowerGroup, McKinsey & Company, OpenAI |
| Hospitality | Marriott, Omnicom Group |
| Entertainment | FIFA, Netflix |
Victims receive emails purporting to be from recruiters at these companies, offering marketing positions and requesting calendar scheduling for interviews. When recipients click the calendar link, they are directed to a phishing landing page requesting Google account authentication. The attacker then captures credentials through a sophisticated browser-in-the-browser (BitB) attack that renders a fake Google login popup indistinguishable from a legitimate authentication window.
## Background and Context
The success of this campaign rests on a multi-layered deception strategy. Rather than hosting phishing pages on obvious malicious domains, the threat actor has exploited the trust placed in legitimate enterprise software platforms.
The Abuse Chain:
The phishing emails appear to originate from PeopleForce, a legitimate cloud-based HR platform. However, the underlying links resolve to exct[.]net, which is operated by Salesforce following its acquisition of ExactTarget (now rebranded as Salesforce Marketing Cloud). The Salesforce domain then redirects to Wise Agent (wiseagent[.]com), a legitimate real estate CRM platform, which finally forwards victims to the attacker's phishing landing page.
This nested redirect approach serves multiple purposes:
The operation initially relied on Outlook email addresses spoofed with company names but has evolved its social engineering tactics. Threat actors now use the names and profile pictures of real recruiters at impersonated companies, dramatically increasing credibility and click-through rates.
## Technical Details
### Browser-in-the-Browser (BitB) Attack
The most sophisticated element of this campaign is the browser-in-the-browser technique. Rather than redirecting users to a completely separate phishing domain, the attacker renders a fake Google authentication popup using HTML and CSS within the phishing landing page itself.
The BitB technique creates several critical problems for defenders:
When a user enters their Google credentials into this fake popup, the attacker captures the username and password in plain text before it can reach Google's servers.
### Platform Abuse vs. Platform Compromise
Security researchers have emphasized an important distinction: abusing these platforms does not necessarily indicate a compromise of the services themselves. The threat actor likely gained access through one of two mechanisms:
1. Legitimate account creation: Creating genuine accounts on PeopleForce, ExactTarget, and Wise Agent specifically to configure the redirect chains
2. Compromised credentials: Using stolen or purchased login credentials to legitimate accounts on these platforms
Either approach allows the attacker to configure the necessary redirects without exploiting vulnerabilities in the platforms themselves—a reminder that insider abuse and credential compromise remain among the most effective attack vectors.
## Implications
### Who Is at Risk
Marketing professionals are the primary target, but the implications extend further:
### Broader Attack Surface
The campaign also highlights how legitimate services become force multipliers for attackers. By chaining redirects through PeopleForce, Salesforce Marketing Cloud, and Wise Agent, the attacker leverages the reputation of these platforms to bypass initial skepticism.
Organizations using these platforms should recognize that legitimate services can be weaponized, even without being compromised. The attacker is simply exploiting normal platform functionality—creating accounts, configuring redirects—to build an attack chain that appears trustworthy.
---
## HackWire Analysis
This campaign represents a maturation in phishing tactics that should concern security leaders across industries. The sophistication isn't in novel exploits or zero-day vulnerabilities—it's in patient social engineering combined with legitimate platform abuse.
The five-month operational window suggests the campaign has been profitable for the attacker. That longevity matters. It indicates that despite decades of anti-phishing awareness, the human factor remains fundamentally difficult to defend against. The attacker isn't breaking into anything; they're convincing people to hand over credentials through channels that appear legitimate.
The use of real recruiter names and images is particularly telling. This suggests the threat actor has conducted reconnaissance—likely scraping LinkedIn, company websites, or internal directories—to build believable personas. The targeting of marketing professionals specifically is logical: they manage brand accounts, advertising budgets, and customer communications, making them high-value targets.
What's missing from most coverage of this incident is systemic accountability. PeopleForce, Salesforce Marketing Cloud, and Wise Agent were all abused, yet none of these platforms required much more than standard account credentials to set up the redirect chain. None apparently implemented anomaly detection for unusual redirect patterns or geographic inconsistencies. The platforms did what they were designed to do—but design without security-forward thinking becomes a liability at scale.
For defenders, this underscores three critical lessons:
First, browser-in-the-browser attacks are nearly indistinguishable from genuine authentication windows to untrained eyes. User training alone won't solve this. Organizations need to implement conditional access policies that block authentication from unexpected locations, devices, or networks.
Second, the abuse of legitimate platforms means threat intelligence feeds and URL blocklists lag far behind reality. By the time a phishing domain is flagged, the attacker has moved on to the next redirect in the chain. Consider adopting browser isolation technology that sandboxes external links in read-only containers, preventing credential theft even if a user clicks a malicious link.
Third, the marketing function is increasingly targeted because it controls communication channels and brand presence. Marketing teams need visibility into their own security posture equivalent to what IT departments monitor—including authentication logs, API access, and unusual data exfiltration patterns.
This campaign will likely persist and evolve. The attack surface is too broad, the human factor too reliable, and the ROI too strong for the threat actor to stop. Organizations should expect variants of this campaign for months to come.
— HackWire Editorial
---
## Recommendations
### For Marketing Organizations
### For Security Teams
### For Platform Operators
---
## Related Coverage