Phishing Campaign Impersonates Major Brands to Steal Google Credentials

Campaign Overview

The phishing campaign targets marketing professionals by impersonating more than 30 well-known brands, including Adobe, Netflix, and Coca-Cola. It uses the PeopleForce HR platform alongside Salesforce Marketing Cloud to create the illusion of legitimacy in the job interview process.

Techniques Employed

Threat actors employ nested redirects, leading victims through multiple legitimate services before they reach a malicious landing page. This technique increases the chance of tricking the recipient into providing sensitive information.

Scope of Impersonation

The phishing emails originate from addresses that appear to be associated with PeopleForce and contain links that resolve to the exct[.]net domain, linked to Salesforce Marketing Cloud. The attackers utilize real recruiters' names and identities to further establish trust among targets.

Continued Threat

This operation has been active for at least five months, initially using Outlook accounts linked to the impersonated companies. An example phishing email hosted on adidas-hiring[.]com tries to lure individuals into scheduling interviews, highlighting the ongoing risk of these attacks.

Implications for Security

This campaign represents a significant security threat, particularly as it leverages trust in major brands and legitimate platforms. Organizations must be vigilant about unusual job offers and phishing tactics to safeguard sensitive credentials.