Cybersecurity researchers have unveiled a pervasive, global recruitment-themed phishing campaign. This operation leverages convincing fake interview scheduling pages and **Browser-in-the-Browser (BitB)** windows to compromise user credentials and, in advanced scenarios, relay multi-factor authentication (MFA) prompts in real time. **CTM360**, the firm detailing this activity in their *RecruitTrap* report, identified over **3,000 phishing URLs** within just two months. The campaign meticulously impersonates real recruiters and recruitment processes from more than **50 organizations** across **14 diverse sectors**. Marketing professionals emerged as the primary target group.  The focus on marketing roles is strategic. Compromised marketing accounts can grant access to critical assets such as advertising platforms, corporate social media profiles, customer data, and email services. ## Two Recruitment Lures Lead to the Same Login Trap The attack typically commences with an unsolicited email or meeting invitation, seemingly from a recruiter at a reputable organization. These messages are often tailored to the recipient's professional background, inviting them to schedule an interview or an informal discussion.  Victims are then directed into one of two distinct flows: a counterfeit **Calendly**-style scheduling page or a brand-specific recruitment portal. The first meticulously copies an employer's branding, often reusing names, photographs, job titles, and other publicly available details of real recruiters. The second prompts the target to select a date and time and submit basic contact information.  Both paths ultimately lead to a 'Continue with **Google**/Facebook' option, where a **Browser-in-the-Browser (BitB)** technique displays a fake authentication popup. This popup features a spoofed address bar and padlock icon, aiming to mimic legitimate login windows. On mobile devices, this may appear as a full-screen counterfeit login page. ## The Phishing Kit Operates as a Live State Machine **CTM360**'s technical analysis of a **Calendly**-themed phishing URL revealed that the page functions as a sophisticated state machine, rather than a static credential form. A **Svelte/SvelteKit** frontend guides victims through staged scenes for CAPTCHA verification, username entry, password submission, and various two-factor authentication methods, including OTP, phone number matching, and suffix verification. A browser-specific session identifier is stored in `sessionStorage`, while a persistent **Socket.IO** channel enables the backend to control the progression of screens. CAPTCHA and browser-reload checks are employed to filter traffic, ensuring only targeted users proceed to credential collection. Crucially, the page filters out personal email domains, focusing the campaign exclusively on valuable enterprise identities.  After a victim enters their login details, the attackers immediately use these to sign in to the real service. The fake page then displays the corresponding MFA request, relaying the victim’s entered code back to the attackers.  Successful authentication grants the attacker an authenticated session, while the victim might be redirected to a legitimate **Calendly** page to minimize suspicion. ## More Than 3,000 URLs Across Shared Infrastructure **CTM360**'s findings indicate that approximately 96% of the phishing pages utilized a **Calendly** theme. Many of these leveraged **Cloudflare** to conceal the attackers’ true server locations.  The counterfeit brand-specific recruitment portals were observed across 116 unique hosts. Notably, 93.1% of these used dedicated or registered hosts, with 50.9% residing on **AWS EC2** IP addresses and ranges. The prevalence of repeated hostnames and reused infrastructure points to a shared setup for deploying multiple phishing sites. Among 813 deduplicated registered domains, '.cfd' was the most common top-level domain at 40%, followed by '.com' (25.1%), '.info' (15.1%), '.works' (10.5%), and '.work' (6.3%). The campaign's design also facilitates rapid rebranding. The underlying template can be quickly adapted by altering the employer name, recruiter identity, background, slogan, and authentication provider, all while maintaining the consistent 30-minute meeting and login flow. The most frequently targeted industries were recruitment, technology, luxury goods, and travel, collectively accounting for approximately 58% of the impersonated brands. ## How to Identify and Respond to the Attack **For Users:** * Always verify unsolicited interview invitations through an independently sourced company channel. Navigate directly to the organization's official careers site instead of clicking links within the suspicious message. * A genuine **Google** sign-in process will operate on `accounts.google.com` or another verified **Google** origin. In a **BitB** attack, the visible address bar and padlock are merely part of the webpage, the fake window cannot be moved outside the current browser tab, and browser controls or privacy links may be non-functional. A password manager failing to recognize or autofill the expected origin is a strong warning sign. **For Organizations:** * Reduce exposure by implementing phishing-resistant authentication methods such as passkeys or hardware-backed **WebAuthn**. * Proactively monitor for lookalike recruitment domains that could be used in such campaigns. * Correlate suspicious recruitment emails with unusual sign-in attempts or new session creations within your identity and access management systems. **If Compromised:** * Anyone who entered credentials or an MFA code into a suspected recruitment page should immediately change the affected password. * Revoke all active sessions and tokens for the compromised account. * Thoroughly review sign-in activity, mailbox rules, and **OAuth** grants for any unauthorized changes. * Promptly notify your security team of the incident. **RecruitTrap** exemplifies how a seemingly benign job opportunity can be weaponized into a scalable identity attack. The fake browser window artfully establishes trust, while the live backend meticulously converts that trust into credential theft, MFA relay, and ultimately, account takeover. For a deeper dive, download the full **CTM360** report: [https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams](https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams)