A phishing campaign is actively impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews designed to steal Google account credentials. The attacks specifically target marketing professionals, leveraging the lure of employment opportunities at prestigious companies.
This campaign is currently active, with BleepingComputer reporting that the threat actors are using realistic brand impersonation to lower victims' guard. The exact number of victims or total campaigns launched remains undisclosed, but the breadth of brands targeted suggests a wide-reaching operation.
Technical details indicate the attack vector relies on phishing emails that appear to be legitimate job interview invitations. Victims who engage are directed to fake interview platforms or forms that prompt them to log in with their Google credentials, which are then captured by the attackers.
No specific malware or exploit is described beyond social engineering. Users are advised to verify any unsolicited job interview requests directly with the company's official careers page and to avoid entering credentials on third-party sites.
The attribution of this campaign is currently unknown; however, the use of multiple big-brand impersonations points to a sophisticated or well-resourced threat actor. This tactic reflects a broader trend of attackers exploiting trust in recruitment processes.