Fake Recruiter Scams Target Corporate Credentials on Mobile

Zimperium researchers tracked a persistent recruitment-themed phishing campaign (RecruitTrap) that impersonates employers and recruiters to harvest corporate credentials, using mobile full-screen fake login pages and screening out personal email domains to focus on enterprise accounts. The analysis identified 46 IOCs and found the lookalike recruitment domains remained on recurring cloud, hosting, and domain-parking providers, reducing visibility to static URL blocklists and raising risk of OAuth token compromise and lateral movement within organizations.