FAKE recruiter scams are increasingly targeting corporate credentials on mobile devices. Researchers from Zimperium's zLabs identified these scams using full-screen fake login pages and pre-qualification checks to weed out personal email domains, thereby focusing on enterprise accounts. The campaign, linked to RecruitTrap, impersonates major companies, making it easier for attackers to gain access to corporate resources and internal systems through OAuth tokens.
Zimperium's analysis highlighted the persistent presence of these phishing schemes across common cloud and hosting services, suggesting that traditional URL blocklists may be ineffective against newly registered domains. They recommend enhancing security at mobile access points and actively monitoring network traffic for potential credential theft.