Cyber criminals impersonate payroll, HR and benefits platforms to steal information and funds

Malwarebytes documents an active phishing campaign that places malicious Google search ads to lure users to spoofed payroll and payment login pages (e.g., Deel). The phishing kit employs obfuscated JavaScript, web workers and Pusher WebSockets to capture credentials, intercept OTPs and manipulate payment details to enable wire fraud; the report provides traffic analysis, identified phishing domains, file hashes and mitigation recommendations.