Fake recruiter phishing turns SaaS trust into credential theft

At a glance

What this is: This is a report on Operation Fake KickOff, a recruiter-impersonation phishing campaign that uses SaaS platforms and AitM tooling to steal corporate credentials and session tokens.

Why it matters: It matters because the operation bypasses conventional MFA and targets identity trust at the point of user engagement, which is relevant to human IAM, workforce access and downstream NHI risk when stolen corporate access is reused.

By the numbers:

• Intel 471 identified 232 dedicated phishing domains and 80 command-and-control servers in the campaign.
• The most targeted industry was human resources consulting at about 54% of all observed phishing infrastructure.
• The campaign impersonated 52 unique organizations across 15 different industries.
• Intel 471 says the initial campaigns started in April 2025 and continued active at the time of the report.

Context

Phishing campaigns now succeed by hijacking trust in ordinary business workflows, not just by spoofing a login page. In this case, the workflow was recruiter outreach and interview scheduling, which gave the attacker a believable pretext to capture corporate credentials from victims who thought they were dealing with a legitimate hiring process.

That matters for identity governance because workforce authentication is only one part of the control problem. Once an attacker can harvest a live session and route around MFA, the exposure can extend into cloud collaboration tools, email, and any downstream non-human identity or API access that those accounts already control.

Key questions

Q: What should organisations do first when recruiter phishing targets corporate accounts?

A: Start by prioritising the accounts and workflows that can reach the most downstream systems, then apply phishing-resistant MFA and tighter verification around hiring-related links. The first objective is not to stop every lure. It is to remove the easiest path from a spoofed interview portal into a session that can reach email, cloud consoles or delegated access.

Q: Why do AiTM phishing kits still succeed against MFA?

A: AiTM kits succeed because they capture the authenticated session, not just the password. If the attacker can intercept the one-time code and the session cookie during login, MFA has already done its job and the cookie becomes the reusable credential. Defenders therefore need controls that watch for session replay and token abuse after sign-in.

Q: What are the warning signs that phishing is targeting a specific industry workflow?

A: Messages that imitate the collaboration tools, document services or branded platforms common in a sector are a strong clue. Financial services, construction and hospitality are especially exposed because document exchange and brand notifications are routine enough that attackers can hide inside expected behaviour.

Q: How should IAM teams limit damage after corporate credentials are stolen?

A: Reduce the blast radius by tightening what those identities can reach, then review delegated access, app passwords, API keys and cloud dashboards tied to the compromised account. IAM teams should assume that one stolen workforce credential can expose multiple downstream systems, including non-human access paths that were never meant to be reachable from a single login.

Technical breakdown

How adversary-in-the-middle phishing captures both passwords and sessions

An adversary-in-the-middle, or AitM, phishing kit sits between the victim and the legitimate service so the attacker can collect credentials and relay authentication in real time. That design is more dangerous than static credential theft because it can intercept session cookies or tokens after a successful login, which lets the attacker persist even when a password is changed. In this campaign, the fake Google sign-in flow and live backend polling created a feedback loop that supported interactive abuse of the session. The control failure is not just weak password hygiene. It is the absence of phishing-resistant authentication and session binding strong enough to resist relay attacks. Read Guide to NHI Rotation Challenges.

Practical implication: Treat session theft as a distinct control problem and prioritise phishing-resistant MFA for high-value workforce accounts.

Why browser-in-the-browser lures defeat user suspicion

Browser-in-the-browser, or BitB, is a presentation-layer deception technique that renders a fake authentication window inside the webpage itself. It works because many users are trained to trust a familiar browser frame and a familiar brand mark, not to inspect the underlying page structure. The attack described here used a visually identical Google sign-in replica inside a corporate-themed interview page, then shifted the challenge flow to match whatever second factor the operator encountered. The technical point is that the page does not need to break the browser. It only needs to reproduce the expected visual cues closely enough to get the user to enter data into an attacker-controlled frame.

Practical implication: Train users to verify the origin of authentication windows and to suspect sign-in prompts embedded inside other web pages.

How SaaS delivery platforms become phishing infrastructure

The campaign abused legitimate sales, marketing and cloud platforms to host redirects, distribute messages and stage backend infrastructure. That matters because reputation-based filtering often gives these services more trust than attacker-owned hosting, even when the payload is malicious. The operators also reused cloud hosting and command servers to keep the infrastructure live across multiple domains. For defenders, the architectural issue is not that SaaS is inherently unsafe. It is that trust in legitimate delivery infrastructure can be exploited to hide the first hop, while the real objective remains credential capture and downstream account abuse. See the Secrets Management Buyer's Guide.

Practical implication: Monitor trusted SaaS providers for abuse patterns and correlate delivery services with suspicious redirect chains and newly registered domains.

Threat narrative

Attacker objective: The objective is to harvest usable corporate access that can be reused, sold or pivoted into broader account compromise.

1. Entry occurs through corporate-themed recruiter and interview-scheduling lures that send victims to a counterfeit Google login flow.
2. Credential capture happens when the phishing kit collects usernames, passwords, MFA codes and live session state through an adversary-controlled backend.
3. Escalation follows when the attacker uses the intercepted session to bypass MFA and maintain interactive control over the victim's authentication flow.
4. Impact is the theft of working corporate access, with stolen credentials forwarded to C2 servers and then exfiltrated to Telegram.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• Solana web3.js npm compromise 2024: A phished maintainer's npm access let attackers publish two @solana/web3.js versions that stole private keys from bots and apps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Recruitment-themed phishing has become an identity trust attack, not just a user-awareness problem. The lure works because it places credential capture inside a believable business interaction and then uses a real recruiter persona to validate the pretext. That shifts the governance problem from email hygiene to trust in external identity signals, including brand impersonation, public profile exposure and scheduling workflows. Practitioners should treat hiring journeys as a hostile surface.

Session theft is the real control failure here, not password weakness alone. The campaign is built to capture credentials, MFA responses and live session tokens in one interaction, which means a successful login can still produce compromise. This is the classic gap in many access programmes: the control authenticates the user, but it does not adequately bind the session to a trusted device, origin or phishing-resistant factor.

Corporate credential theft increasingly feeds downstream non-human identity abuse. Once a workforce account is compromised, attackers often inherit access to collaboration platforms, cloud consoles and application workflows that depend on that human identity. That is where API key management and related secret governance become relevant, because the human account can become the bridge into service credentials, tokens or delegated access.

Trust in legitimate delivery infrastructure is being weaponised at scale. The use of recognised SaaS and cloud platforms makes this campaign harder to filter and easier to operationalise across many brands and verticals. Security teams need to stop treating trusted delivery services as safe by default and instead evaluate the identity, origin and redirect chain behind the message.

Read next: Secrets Management Guide

What this signals

Identity verification has moved upstream into recruitment workflows. Security teams should expect phishing to piggyback on job applications, scheduling and talent acquisition because those processes naturally lower suspicion. The practical shift is to verify the origin of the interaction before the user ever reaches an authentication prompt.

Session protection is now as important as credential protection. A stolen password that cannot be replayed is less useful than a captured live session, which is why access programmes need stronger binding between authentication, device trust and session issuance.

Credential theft is increasingly a gateway problem for non-human identity governance. Once a human account is compromised, attackers often inherit the same trust relationships that expose API keys, service tokens and cloud control planes, so identity governance must account for the full downstream blast radius.

For practitioners

• Deploy phishing-resistant MFA for high-value workforce accounts Prioritise passkeys or hardware-backed security keys for accounts that can reach email, cloud admin consoles and collaboration platforms, because this campaign is designed to bypass token-based MFA and capture session state. Read Guide to NHI Rotation Challenges.
• Harden recruiter and interview workflow verification Add explicit verification steps for hiring-related portals, interview scheduling links and recruiter communications, especially where public profiles can be copied and used to create plausible lures.
• Monitor trusted SaaS delivery and redirect chains Correlate email-delivery, marketing and cloud-hosting providers with suspicious redirects, newly registered domains and replayed login flows, then feed those indicators into detection and takedown workflows.
• Review downstream access reachable from compromised workforce accounts Inventory what a compromised Google Workspace or similar identity can reach, including API keys, app passwords, delegated admin paths and cloud dashboards, then reduce that blast radius.

Key takeaways

• The campaign turns recruiter impersonation into an identity attack path that bypasses ordinary user suspicion and pushes victims into attacker-controlled authentication flows.
• Its scale is visible in the 232 phishing domains, 80 command-and-control servers and 52 impersonated organisations identified by Intel 471.
• Phishing-resistant MFA, session binding and tighter verification of hiring workflows are the controls most likely to reduce the impact of this pattern.

Related NHI Mgmt Group resources: Guide to NHI Rotation Challenges · API Key Management Guide · Secrets Management Guide · Mailchimp breach 2022

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Browser-in-the-Browser: A phishing technique that renders a fake authentication window inside a webpage so it looks like a normal browser pop-up. The goal is to trick users into entering credentials or completing sign-in in a context that appears trustworthy while the attacker controls the underlying content.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.