Jobseekers exploited in fake recruiter phishing campaigns

### Executive summary: The report outlines an active phishing campaign that abuses email marketing platforms to distribute Browser-in-the-Browser (BitB) pages impersonating Facebook login dialogs to harvest credentials; analysts tracked 143 domains, observed hosting on Vercel and AWS and registrar patterns, and noted use of a Telegram bot for exfiltration and site updates, with Okta and Salesforce involved in takedown actions.