Google Careers impersonation credential phishing scam with endless variation · Blog · Sublime Security

This report details an active credential-phishing campaign impersonating Google Careers: attackers send recruitment-style outreach in multiple languages and from varied sender domains, direct victims to faux scheduling pages that pass Cloudflare Turnstile checks, then present fake Google login pages to harvest credentials. The analysis highlights evasion techniques (HTML word-padding, recently-registered deceptive domains), evidence of C2-backed backend interactions, personal/business email filtering, and supplies a long list of malicious domains and websocket servers as IOCs.