Recruiter impersonation phishing: what it means for IAM teams

TL;DR: Attackers are abusing recruiter impersonation, SaaS delivery tools and adversary-in-the-middle phishing pages to steal Google Workspace credentials and live session tokens while bypassing MFA, according to Intel 471 research. The campaign shows that identity assurance now has to extend beyond login prompts into recruiter verification, phishing-resistant authentication and session handling.

Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials”.

By the numbers:

• Intel 471 identified 232 dedicated phishing domains and 80 command-and-control servers in the campaign.
• The most targeted industry was human resources consulting at about 54% of all observed phishing infrastructure.
• The campaign impersonated 52 unique organizations across 15 different industries.

Key questions

Q: What should organisations do first when recruiter phishing targets corporate accounts?

A: Start by prioritising the accounts and workflows that can reach the most downstream systems, then apply phishing-resistant MFA and tighter verification around hiring-related links.

Q: Why do AiTM phishing kits still succeed against MFA?

A: AiTM kits succeed because they capture the authenticated session, not just the password.

Q: What are the warning signs that phishing is targeting a specific industry workflow?

A: Messages that imitate the collaboration tools, document services or branded platforms common in a sector are a strong clue.

Practitioner guidance

• Deploy phishing-resistant MFA for high-value workforce accounts Prioritise passkeys or hardware-backed security keys for accounts that can reach email, cloud admin consoles and collaboration platforms, because this campaign is designed to bypass token-based MFA and capture session state.
• Harden recruiter and interview workflow verification Add explicit verification steps for hiring-related portals, interview scheduling links and recruiter communications, especially where public profiles can be copied and used to create plausible lures.
• Monitor trusted SaaS delivery and redirect chains Correlate email-delivery, marketing and cloud-hosting providers with suspicious redirects, newly registered domains and replayed login flows, then feed those indicators into detection and takedown workflows.

Bottom line: The campaign turns recruiter impersonation into an identity attack path that bypasses ordinary user suspicion and pushes victims into attacker-controlled authentication flows.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →