Zimperium Reports Mobile-Adapted Recruitment Phishing Targeting Enterprise Credentials

Summary

Zimperium describes recruitment-themed phishing that impersonates company HR staff, adapts to mobile with full-screen login spoofs, and filters for corporate email. Its telemetry found persistent infrastructure and 46 previously unpublished IOCs.

Key points

The campaign impersonates HR staff and uses public profile data to create convincing interview and scheduling lures.
On desktop, the phishing page simulates a browser popup; on mobile, it switches to a full-screen counterfeit login page with fewer visible URL cues.
The phishing kit reportedly rejects personal email addresses, focusing its credential-harvesting on corporate accounts.
Zimperium says compromised corporate accounts could expose OAuth tokens, internal communications, and cloud applications.
A year of Zimperium telemetry showed long-lived lookalike recruitment domains using recurring cloud, hosting, and domain-parking infrastructure.
Zimperium identified 46 previously unpublished IOCs and reported that public feeds sometimes flagged impersonation domains long after registration.

Article Details

Event Type: Mobile-adaptive, interview-themed recruitment phishing campaign impersonating company HR staff to target enterprise credentials.
Impact: Compromised corporate accounts can expose OAuth tokens, internal communications, and cloud applications, enabling rapid lateral movement.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aa-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`andmore-global[.]com`	Lookalike domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`expedia-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`fifahr-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`hbc-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`insulet-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`levis-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`mckinsey-careers[.]com`	Lookalike recruitment domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`mondial-relay-global[.]com`	Lookalike domain listed among impersonation domains associated with the phishing campaign.
DOMAIN	`xmtrading-global[.]com`	Lookalike domain listed among impersonation domains associated with the phishing campaign.