Threat Actors Exploit Job Seekers with Three New Distinct Adversaries

Netcraft investigators uncovered three distinct recruitment scam operations targeting job seekers globally: (1) advance-fee fraud impersonating tech recruiters that lure victims to professionally designed bogus domains and demand cryptocurrency “activation” fees; (2) a hyperlocal campaign impersonating logistics recruiters via dozens of localized sites across 18 countries to extract upfront payments; and (3) identity-theft phishing that impersonates the Government of Singapore on Telegram to harvest national ID numbers and take over accounts. The report highlights technical sophistication (centralized hosting, multilingual sites, access-controlled pages), scale (tens of thousands targeted), key IOCs (fraudulent domains and Telegram groups), and recommends vigilance and reporting to disrupt these operations.