CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps

Cybersecurity researchers have discovered a large-scale phishing campaign that targets users with fake interview scheduling pages. The campaign uses a technique called Browser-in-the-Browser to steal credentials from Google and Facebook accounts. In some cases, the phishing attack can also relay multi-factor authentication prompts in real time. The campaign was uncovered by CTM360, which has detailed its findings in a report called RecruitTrap. The report reveals that over 3,000 recruitment phishing URLs were found to be using this technique. The phishing campaign is global in scope, using recruitment themes to trick victims.