Recruitment-Themed Phishing Campaign Targets Enterprise Users

Zimperium reports a widespread phishing campaign (RecruitTrap) using Browser-in-the-Browser attacks to impersonate HR/recruiters and harvest enterprise credentials—particularly targeting job seekers at major companies. The phishing kit filters out personal email domains to focus on corporate accounts, adapts to mobile by showing full-screen fake OAuth login pages, and can capture OAuth tokens and access internal cloud applications, enabling rapid lateral movement within breached organizations.