Hackers Posing as Google Careers Recruiter to Steal Gmail Login Details

Hackers are conducting an emerging phishing campaign that pretends to recruit for Google Careers, sending seemingly legitimate emails that lead victims to malicious sites designed to harvest Gmail credentials. Security researchers have uncovered a multi-stage attack that uses Salesforce infrastructure, Cloudflare protection and a WebSocket command-and-control channel to guide victims through the process.

The phishing emails originate from a spoofed Salesforce subdomain and carry subject lines promising exclusive Google Career opportunities, with a “View the role” button that redirects to a fake Google Careers portal at apply.grecruitingwise[.]com (and related domains).

After submitting personal details on a generic landing page, victims are redirected to a Google sign-in form where they enter their Gmail address and password, with the fraudulent site loading a defanged main.js to maintain a persistent WebSocket connection to satoshicommands[.]com.

OSINT investigations note similar campaigns dating back months, with victims posting identical emails on Reddit and URLScan[.]io analyses confirming the same infringing domains, including grecruitdigital[.]com, grecruitbridge[.]com, gtalentmatcher[.]com, gstafftalent[.]com, grecruitpro[.]com, gcandidatespath[.]com, gteamhirehub[.]com, gteamlineup[.]com, grecruitinglink[.]com and getintouchwithcareers[.]com.

The guidance from researchers suggests verifying sender domains, hovering over links to confirm destinations, avoiding credential entry on captcha-protected sites you did not request and enabling two-factor authentication on Gmail.