Google Warns of Cybercriminals Using Fake Job Postings to Spread Malware and Steal Credentials

According to Google’s Threat Intelligence Group (GTIG), a sophisticated social engineering campaign is being run by financially motivated threat actors based in Vietnam, aimed at compromising corporate advertising accounts and stealing credentials for resale or direct monetization.

The threat cluster UNC6229 specifically targets remote workers in digital advertising roles who are on contract or part‑time and actively seeking employment, with the attackers seeking to gain unauthorized access to high‑value corporate advertising and social media accounts. The operation uses convincing fake company profiles on popular employment platforms and self‑built fake job sites, and victims are drawn in by applying for fabricated positions, providing personal information, contact details, and résumés.

Once breached, the actors monetize the access by selling advertisements through the accounts or transferring ownership to others, with further credential harvesting through phishing pages and payload delivery via password‑protected ZIP files or obfuscated links. GTIG notes the campaign leverages trusted tools and services like CRM platforms to bypass filters, and urges organisations to strengthen employee awareness and account security to defend against these evolving threats.