The Job Offer Came From a Learning Site Nobody Joined

A targeted phishing campaign used a malicious MoodleCloud site ([email protected] / recruiting-talents.moodlecloud.com, site name “talent-hub”) to deliver Red Bull-branded job-pitch messages to four employees; the messages contained a shortlink to a lookalike landing page (work-redbull.com) and relied on MoodleCloud/Amazon SES delivery (DKIM/SPF/DMARC passing). The report includes IoCs (sender, domains, URLs, image host, SES IP), maps the chain to MITRE ATT&CK (account establishment, domain infrastructure, spearphishing link), and notes that human reporting enabled quarantine of all copies.