Phishing Campaign Impersonates 34 Brands to Steal Google Account Credentials

Summary

Team Cymru analysis describes a phishing campaign impersonating 34+ brands to target marketing professionals with fake interviews. Nested redirects lead to a browser-in-the-browser Google sign-in form designed to steal credentials.

Key points

The campaign impersonates at least 34 brands and targets marketing professionals with fake job interview invitations.
The emails use real recruiter names and photos to appear trustworthy.
The redirect chain abuses PeopleForce and Salesforce Marketing Cloud before passing through Wise Agent (wiseagent[.]com) to a phishing page.
The campaign has reportedly been active for at least five months; BleepingComputer observed Outlook addresses using impersonated company names.
The final page uses a browser-in-the-browser trick: a Google sign-in popup rendered in HTML and CSS within the phishing page.
Researchers say abuse of the legitimate services does not itself indicate those services were compromised; how the attacker accessed them is unclear.

Article Details

Event Type: Phishing campaign impersonating major brands with fake job interviews to steal Google account credentials.
Impact: The campaign targets marketing professionals and uses a browser-in-the-browser fake sign-in page to capture credentials. The article reports at least 34 impersonation domains and says the operation had run for at least five months; it does not confirm successful credential theft or a compromise of the legitimate services used in the redirect chain.