Unit 42 Tracks Phishing Scam Impersonating Palo Alto Networks Recruiters
Summary
Unit 42 says it has tracked recruiter-impersonation phishing since August 2025, targeting senior professionals with personalized lures and fake ATS-compliance problems that pressure candidates to buy resume services. It advises verifying recruiters and never paying fees
Key points
- Unit 42 reports tracking the campaigns since August 2025, with reported examples from August 2025 and February 2026.
- The emails impersonate Palo Alto Networks recruiters and use scraped LinkedIn details, flattering language, logos and look-alike sender information.
- The scammers invent an applicant-tracking-system compliance problem and an urgent review window to steer candidates toward resume services priced from $400 to $800.
- The article advises checking recruiter identities and sender addresses through official channels, treating hiring-related payment requests as a red flag, and avoiding unverified attachments.
- People who believe they were targeted are advised to stop contact, report the message, and change passwords and enable multifactor authentication if they clicked links.
Article Details
- Event Type
- Spear-phishing and recruitment-fee scam impersonating Palo Alto Networks talent acquisition staff
- Impact
- The campaigns target senior professionals with personalized hiring lures and pressure them to pay for resume services. The article warns that unverified resume-related attachments may contain malware, but does not report confirmed device compromises or quantify financial losses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | paloaltonetworks-careers[.]com | Look-alike domain identified as being used to mimic Palo Alto Networks corporate email addresses. |
paloaltonetworks@gmail[.]com | Phishing sender address used to impersonate Palo Alto Networks recruiters. | |
phillipwalters006@gmail[.]com | Phishing sender address associated with the recruitment scam. | |
posunrayi994@gmail[.]com | Phishing sender address associated with the recruitment scam. | |
recruiter[.]paloalnetworks@gmail[.]com | Phishing sender address used to impersonate Palo Alto Networks recruiters. |
MITRE ATT&CK
T1036 · MasqueradingThe article describes use of legitimate company logos and look-alike sender information to impersonate Palo Alto Networks representatives.T1204 · User ExecutionThe article warns recipients not to open or download unverified resume-related files, which it says may contain malware; it does not confirm a resulting compromise.T1566 · PhishingThe article identifies targeted spear-phishing emails impersonating recruiters as the campaigns’ initial contact.T1589 · Gather Victim Identity InformationThe campaigns used details scraped from victims’ LinkedIn profiles to personalize lures.