Cybercriminals Impersonate HR Departments to Harvest Your Gmail Login Details

Cybercriminals are impersonating HR departments to harvest Gmail login details by exploiting trusted Zoom document sharing. A recent incident saw an email titled “HR application” arriving from a valid Zoom Docs address, which led victims through a gate that redirected to a Gmail credential harvesting page.

The phishing page uses a WebSocket connection to exfiltrate usernames and passwords in real time, with credentials then being validated against Google authentication API on the backend, accelerating follow-up exploitation or account takeover. The campaign relies on Zoom’s trusted branding to boost click-through and conceal the malicious intent, and analysts note that a “Press & Hold to confirm” widget appeared on the offsite page.

To prevent harm, observers are advised to treat any Zoom share link pointing to non-zoom[.]us domains as suspicious, monitor for outbound WebSocket connections, and enforce password resets and two-factor authentication if credentials are submitted. The piece also emphasises the importance of checking full email headers and reporting suspected phishing to Zoom’s abuse portal and Google’s phishing report form.