Fake recruiter scams have been targeting corporate credentials on mobile devices, using full-screen login pages and pre-qualification checks to reject personal email addresses and focus on enterprise accounts.
Researchers at Zimperium’s zLabs analyzed the activity and identified 46 previously unpublished indicators of compromise (IOCs) linked to recruitment-themed domains impersonating major companies.
The August 24 research found that the campaigns had persisted across a range of cloud, hosting and domain-parking providers.
Recruitment Pages Screen For Corporate Targets
The campaign, tracked by Zimperium in connection with RecruitTrap activity, impersonated employers and recruiters through domains using names associated with careers and global recruitment. The researchers found examples impersonating brands including Amazon, Apple, Boeing, Deloitte, Emirates Group, Heineken, Lego and Louis Vuitton, among others.
On desktop devices, victims may encounter a simulated browser-in-the-browser (BitB) login. On mobile devices, the phishing flow instead presents a full-screen counterfeit login page, removing browser elements such as the address bar that could help users identify the deception.
The phishing kit also screened submitted information. Zimperium found that it rejected personal email domains and required corporate credentials, indicating that the campaign was designed to prioritize accounts that could provide access to enterprise resources.
An attacker gaining access to a corporate account could obtain OAuth tokens and reach internal communications and cloud applications, according to Zimperium. The researchers said this could support further movement through an organization.
Read more on mobile phishing: Mobile Phishing Attacks Surge with 16% of Incidents in US
Infrastructure Persists Across Hosting Providers
Zimperium's one-year telemetry analysis found that the recruitment domains frequently remained on recurring cloud, hosting and parking infrastructure rather than continuously moving between obscure networks.
Amazon and SEDO were among the most frequently observed providers at the autonomous system number (ASN) level.
Zimperium said the persistence of lookalike recruitment domains can leave gaps in conventional URL blocklists, as newly registered sites may remain operational before they are added to public threat feeds.
To defend against this and similar threats, the company recommended securing corporate identities at the mobile touchpoint and dynamically inspecting network traffic to detect credential-harvesting attempts, rather than relying solely on desktop-focused web gateways and static URL blocklists.