CTM360 Warns of Global Recruitment Phishing Campaign Using Browser-in-the-Browser Traps

CTM360 researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials. According to the report titled RecruitTrap, the operation has identified over 3,000 phishing URLs as part of the campaign.

The attack chain begins with victims being lured to fake interview scheduling pages. These pages display a Browser-in-the-Browser (BitB) window that mimics a legitimate login interface, prompting users to enter their Google or Facebook credentials. In advanced cases, the campaign relays MFA prompts in real time, allowing attackers to bypass secondary authentication and gain full account access.

The campaign targets individuals across multiple regions, leveraging the trust associated with recruitment and interview processes to lower victim suspicion. The use of BitB windows makes the phishing pages appear more authentic, as the pop-up windows resemble native browser login dialogs.

CTM360 notes that while the exact scope of the campaign is as reported, the figures and details are based on the RecruitTrap report and have not been independently verified. No software patches are applicable, as the attack exploits user interaction and browser behavior rather than a specific software vulnerability.