Phishing poses as big-brand job interview to steal Google accounts

A phishing campaign impersonating over 30 major brands — including Adobe, Netflix, Coca-Cola, and OpenAI — is targeting marketing professionals with fake job interview emails. The operation abuses legitimate platforms like PeopleForce and Salesforce Marketing Cloud (via exct.net) to create a nested redirect chain that routes victims to a malicious landing page. There, a browser-in-the-browser (BitB) technique renders a fake Google sign-in popup using HTML/CSS to steal Google account credentials. The campaign has been active for at least five months and uses real recruiter names and photos to increase credibility. A full list of impersonated domains is available in the researcher's GitHub analysis.