Fake Big-Brand Job Listings Steal Google Logins from Marketers

A sophisticated phishing campaign is weaponizing the names of well-known consumer brands to lure marketing professionals into surrendering their Google Workspace credentials. Researchers at Dark Reading have detailed how the operation begins with carefully crafted job advertisements promising high-paying remote positions, complete with fraudulent recruiter profiles on LinkedIn and polished career-portal landing pages. Targets who engage are funneled into a credential-harvesting workflow that mirrors legitimate single sign-on flows, making the fake sign-in page nearly indistinguishable from a real Google authentication prompt.

What sets this campaign apart is its use of nested HTTP redirects, cloaked JavaScript, and domain fronting to bypass both email security gateways and URL reputation filters. Investigators found that clicking the initial link bounces the victim through several compromised WordPress sites and CDN endpoints before landing on the final phishing kit, which is hosted on a recently registered domain using a free TLS certificate to display a valid padlock icon. The kit then collects the email, password, and any active session cookies, exfiltrating them via Telegram bots operated by the threat actors.

Security teams should treat any unsolicited job outreach with skepticism and verify the recruiter's identity through a separate channel before engaging. Marketing departments are particularly exposed because staff often manage high-value brand ad accounts, analytics properties, and social media credentials under the same Google identity, meaning a single compromise can cascade into brand-hijack incidents. Employees who suspect they may have entered their credentials on a suspicious portal should immediately rotate passwords, revoke active sessions, and enroll hardware-backed two-factor authentication.

Readers can audit their own exposure by running any corporate or personal addresses through a breach checker to confirm whether credentials have surfaced in known dumps, then validate account hygiene with a password strength checker before rotating to unique, randomly generated secrets stored in a password manager. Combining these hygiene steps with phishing-resistant authentication options such as passkeys or FIDO2 hardware keys remains the most effective long-term defense against credential theft campaigns of this kind.