Google Exposes UNC6229 “Fake Career” Campaign Hacking Advertising Accounts with Fake Job Lures

27 October 2025. Google’s Threat Intelligence Group (GTIG) has exposed an ongoing social engineering campaign operated by a financially motivated threat cluster known as UNC6229, based in Vietnam. According to GTIG, the attackers post fake career opportunities on legitimate platforms to lure remote digital advertising workers, often freelancers or contractors who manage multiple client accounts.

Once a victim is compromised, they hijack the company’s advertising accounts or sell access to other cybercriminals, monetising stolen credentials on underground markets. The operation uses highly polished job listings on platforms such as LinkedIn and Indeed, impersonating digital media agencies with fabricated websites and profiles. GTIG notes that the campaign relies on social engineering, with fake company profiles and appealing, often remote, openings to build trust before delivering the payload.

In some cases, UNC6229 abuses legitimate SaaS platforms, including Salesforce and Google AppSheet, to manage communications and distribute malware-laden attachments or phishing links.