Recruitment phishing scams on the rise: What (not) to do to avoid getting conned

Why the number of job scams increases during fall

The number of job scams increases during fall months, particularly in September, since it’s one of the busiest months for job hunting. Workers who took the summer off are re-entering the market, and students are starting the academic year looking for work, making these groups a prime target for scammers.

NordVPN’s Threat Intelligence team has identified an ongoing phishing campaign that impersonates recruiters from more than 75 globally recognized brands, including Disney, Nike, Coca-Cola, Salesforce, Nvidia, Adidas, Epic Games, and Marriott. The campaign aims to steal corporate Google Workspace and Facebook Business credentials, allowing scammers to impersonate reputable brands.

The campaign deliberately targets marketing and communications professionals rather than finance or IT staff. The reason likely has to do with the fact that a compromised marketing account typically controls Google and Facebook Ads Manager profiles, often with a payment method attached. It can also open the door to corporate CMS systems, customer lists, and social media profiles with large follower counts. 

For attackers, that’s a gateway to immediate monetization. With access to corporate Google and Facebook Ads Manager profiles, they can burn advertising budgets on malvertising served from a verified business account, or simply resell the access to other criminals.

How recruitment phishing scam works, step by step

The recruitment phishing scam starts innocently. A target receives an email (or in some cases a Facebook or LinkedIn phishing message) from someone claiming to work in HR at a famous company. The message uses the real name and photo of an actual employee (most likely copied from LinkedIn), which makes it more convincing. In some cases, the first message is deliberately harmless and only asks for a reply. After the target responds, scammers may continue the conversation for a while until eventually sending phishing links. This tactic usually comes in three steps, each described below. 

1. The scammer makes contact and sends a phishing link

Most scammers aim to establish contact and familiarity first, refraining from sending malicious links from the get-go. Since most email inboxes contain filters that scan first messages for suspicious links, sending a link after establishing contact is a simple trick that helps avoid getting flagged by the system.

2. The target follows the link to a fake Calendly website

Once the target clicks on the URL, the link leads to a page that’s often a well-made replica of a Calendly website, styled with the colors and logo of the impersonated company. The site might also come with a CAPTCHA for extra credibility. Once the target “books” an interview slot, a “Sign in with Google” or “Sign in with Facebook” button appears.

3. The target submits their credentials, exposing sensitive information

When the victim clicks “Sign in with Google,” they might expect a genuine separate browser window to pop up, complete with an address bar showing accounts.google.com. However, instead of a real browser window they’ll get a fake site (built with HTML and CSS) that perfectly imitates a login window, including the security padlock and the web address (a string of text, rather than a real link). This technique is called browser-in-the-browser, or BitB, and it’s one of the most common ways scammers try to spoof login credentials.

If a person submits their Google or Facebook account credentials, their email address and password immediately end up in the scammer’s hands. Cybercriminals can then hijack the target’s account, change password, or use the stolen account to further spread the scam. The problem becomes even bigger if the target is using their work email address, since that allows scammers to gain access to the company’s internal systems.

Signs of a professional, industrial-scale operation

Based on the data gathered by NordVPN’s Threat Intelligence team, almost all of the phishing domains on this campaign share a single Google Analytics tag, proving they were built from the same template. The operation uses hundreds of domains in continuous rotation and routes phishing links through multiple legitimate SaaS (software as a service) platforms in sequence to defeat web filters. The phishing kit itself shows signs that it was built with AI assistance — the source code contained unusually descriptive inline comments and emojis. 

The campaign has been running for well over a year and keeps renewing itself, at one point even exploiting the hype around the 2026 football World Cup as a lure. That further suggests an organized operation capable of targeting multiple individuals at once.

Why does two-factor authentication not help with these scams?

While two-factor authentication (2FA) is a solid line of defense against account hijacking, it turns out it won’t help much against this particular scam. When a person tries to sign in on a malicious website, the attackers relay the credentials to the real Google or Facebook site in real time. So when the platform asks for the verification code, it appears on the victim’s phone exactly as it would during a normal login, because technically it is one, just remotely orchestrated by the attacker. The victim approves the 2FA prompt themselves, believing they’re logging in normally. Once approved, the attacker has an authenticated session — and the password too.

How to protect yourself from recruitment scams

Protecting yourself from fake job interview scams doesn’t require expert knowledge. All it takes is a bit of skepticism and a few precautions:

• Be suspicious of unsolicited interview invitations. If a “recruiter” from a famous brand contacts you out of the blue, verify them through official company channels before engaging. Check the company’s official careers page and confirm the recruiter’s identity directly.
• Test the login window. If a “Sign in with Google” popup appears on a page, try dragging it outside the browser window. A genuine standalone sign-in window can usually be dragged across your screen, but a fake one will often get clipped at the page edge. This isn’t a foolproof test, though, so when in doubt, close the tab and sign in directly from the official site.
• Check URLs carefully. Legitimate companies don’t host interviews on domains like “hiring-nike.com” or “careers-disney.com.” If the domain looks even slightly off, close the webpage.
• Use phishing-resistant 2FA where possible. Hardware security keys and passkeys are far more resistant to this type of real-time relay attack than codes or push approvals, so consider looking into these options.
• Use a link checker. Verifying a suspicious link before clicking takes less than 30 seconds and can save you (and your employer) a lot of trouble.
• Use a VPN with built-in protection. A VPN alone won’t stop a phishing scam. However, a service like NordVPN comes with a next-gen antivirus that can block known malicious links and websites before they ever load, adding an extra layer to your online security.

Job hunting is stressful enough without criminals trying to trick you. Stay skeptical, verify before you click, and remember — if a dream interview arrives out of nowhere, it might be a scam wearing a familiar logo.

Methodology

NordVPN’s Threat Intelligence team analyzed the phishing kit’s client-side code and mapped the campaign’s infrastructure, examining domain registration and hosting patterns across hundreds of linked domains. Analysts reviewed redirect chains and identified multiple live command-and-control backend servers used to relay stolen sessions in real time. Internal code components were extracted to assess the campaign’s technical capabilities.

Disclaimer: NordVPN is not endorsed by, affiliated with, or sponsored by Google, Facebook, or any other brand mentioned in this press release. These brand names are included solely to describe the impersonation tactics identified in NordVPN’s research and to help readers recognize how scammers misuse trusted names for phishing.