That dream job offer from Coca-Cola or Ferrari? It’s a trap for your passwords

This report details two polished phishing campaigns targeting job seekers: one impersonating Coca‑Cola uses a fake in‑page Chrome window and a backend MFA‑relay kit to capture Google Workspace credentials (including second‑factor codes), and another impersonating Ferrari harvests Facebook logins via fake OAuth‑style prompts; the writeup includes defensive guidance and lists hrguxhellito281.onrender.com as an observed backend IOC.