Forest Global Training Partners

Cyber Risks · The Hacker News

CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps

Summary: CTM360 identified more than 3,000 recruitment-themed phishing URLs over two months, impersonating recruiters and hiring processes tied to over 50 organizations across 14 sectors, with marketing professionals as the majority of targets. The pages use Browser-in-the-Browser popups with spoofed address bars and padlocks, and a technical analysis of one Calendly-style URL found a Svelte/SvelteKit front end driven by a Socket.IO channel that staged CAPTCHA, username, password, and multiple two-factor screens, relaying the victim's MFA code to the attackers in real time.

Key Takeaway: About 96% of the pages used a Calendly theme and 50.9% of the brand-specific portal hosts sat on AWS EC2 addresses, so the infrastructure is cheap and repeatable enough to rebrand by changing the employer name and recruiter identity. The page filtered out personal email domains and advanced only corporate accounts, meaning the campaign was built to harvest enterprise identities rather than consumer logins.

Read the original at The Hacker News ↗

Topics
Identity & Access Management
Related