# Browser-in-the-Browser Phishing Campaign Impersonates 34+ Brands' Job Postings to Steal Google Account Credentials

> A phishing operation active for at least five months impersonates recruiters from 34+ well-known brands (including American Airlines, Delta, Adidas, Adobe, Netflix, McKinsey, and OpenAI) to lure marketing professionals into fake job-interview scheduling pages. Victims are routed through a nested redirect chain abusing legitimate PeopleForce, Salesforce Marketing Cloud (exct.net), and Wise Agent CRM infrastructure before landing on a page that renders a fake 'Continue with Google' browser-in-the-browser (BitB) popup to steal Google account credentials.

- **Published:** 2026-07-06T00:00:00Z
- **Last reviewed:** 2026-07-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1139
- **ID:** TL-2026-1139
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a large-scale, brand-impersonation credential-phishing operation first publicly documented by Will Thomas (Senior Threat Intelligence Advisor, Team Cymru) and reported by BleepingComputer on 2026-07-06. The operation has been active for at least five months and targets marketing professionals by impersonating recruiters at 34+ recognizable global brands spanning airlines/travel (American Airlines, Delta Air Lines, United Airlines, Booking.com), food & beverage (Coca-Cola, PepsiCo, Red Bull), apparel/luxury (Adidas, Louis Vuitton, Sephora, Levi's), technology/staffing/consulting (Adobe, Aquent, ManpowerGroup, McKinsey & Company, OpenAI), hospitality/marketing (Marriott, Omnicom Group), and entertainment/sports (FIFA, Netflix).

Exploit-chain analysis: the lure begins with an email or calendar-style invitation posing as a job-interview scheduling request from a named, real employee at the impersonated brand (using genuine names and photos to build credibility). The initial link routes through PeopleForce, a legitimate HR/recruiting SaaS platform, whose links are abused to add an air of legitimacy and to launder the URL's reputation past link-reputation and secure-email-gateway scanners. From PeopleForce the victim is redirected a second time through exct.net, the tracking-link domain of Salesforce Marketing Cloud (formerly ExactTarget) — a widely-trusted, high-reputation SaaS domain frequently allow-listed by corporate mail filters, making it an attractive redirect hop for phishing-link laundering (a pattern independently documented by Okta Threat Intelligence and Sublime Security in adjacent recruiter-phishing campaigns using the same cl.sNN.exct.net tracking-link format). A third hop passes through wiseagent.com, a real-estate CRM platform, before finally landing on the attacker-controlled page (e.g. adidas-hiring[.]com for the Adidas lure, with equivalent '<brand>-hiring'-style domains for other impersonated brands).

The landing page itself does not use a real pop-up browser window. Instead it renders a Browser-in-the-Browser (BitB) fake authentication window entirely with HTML and CSS embedded in the phishing page — recreating a convincing fake browser chrome (address bar, padlock icon, and a 'Continue with Google' OAuth-style consent screen) that never actually opens a second browser process. This nested-iframe/CSS technique traces back to the BitB concept popularized publicly by security researcher mr.d0x in 2022 and has since been adopted broadly across the recruiter-phishing ecosystem (e.g. Push Security's Calendly-brand impersonation cluster and Okta's Meta-recruiter BitB cluster use the same fundamental rendering trick against Google/Facebook login flows). Because the fake window is rendered client-side, it defeats casual visual inspection and works even though the address bar shown to the victim is entirely fabricated. Victims who submit credentials into the fake Google form have their Google account credentials harvested directly by the attacker's backend.

No CVE or software vulnerability underlies this operation — it is a pure social-engineering and legitimate-infrastructure-abuse campaign ('living off trusted SaaS services') rather than an exploit against a coded flaw. The abused platforms (PeopleForce, Salesforce Marketing Cloud, Wise Agent) are not themselves compromised or vulnerable; their legitimate link/redirect and tracking functionality is being repurposed by the threat actor to build a chain of trust that defeats URL-reputation-based defenses. The operation remains unattributed to a named threat-actor group at time of reporting and is best classified as opportunistic/financially-motivated cybercriminal activity targeting Google Workspace/Gmail accounts held by marketing and advertising staff, whose accounts are valuable for downstream business email compromise, ad-account takeover, or resale.

This specific PeopleForce/exct.net/wiseagent.com chain sits within a much longer-running, well-documented lineage of recruiter-themed brand-impersonation phishing that CTI vendors have tracked since at least September 2025. Cyberpress reported a 'Fake Google Careers Recruiters' Gmail credential-theft wave (hosted at apply.grecruitingwise.com) active since September 2025; Sublime Security's Brandon Murphy published an Attack Spotlight on an actively-evolving Google Careers impersonation scam on 2025-10-14 (amplified by CSOonline on 2025-10-22); Push Security then documented a 75+-brand Calendly-themed cluster on 2025-12-02 (covered by BleepingComputer on 2025-12-04) using the same Browser-in-the-Browser technique against Google and Facebook logins, alongside a concurrent malvertising campaign hijacking Google Ads Manager accounts. Sublime Security published an expanded follow-up on the endless lure variation on 2026-03-30, and Okta Threat Intelligence catalogued multiple concurrent recruiter-phishing campaigns sharing this infrastructure-abuse pattern in an advisory on 2026-04-30 -- shortly before Team Cymru's Will Thomas documented the specific PeopleForce/exct.net/wiseagent.com chain analyzed here. This chronology indicates a persistent, multi-vendor-tracked recruiter-phishing ecosystem rather than an isolated incident, with this campaign representing the latest and most infrastructure-diverse iteration.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1591.004 Identify Roles
- T1583.001 Domains
- T1584.006 Web Services
- T1585.002 Email Accounts
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1078.004 Cloud Accounts
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1090.002 External Proxy
- T1102 Web Service
- T1056.003 Web Portal Capture
- T1114.002 Remote Email Collection

## Sources

- [Phishing poses as big brand job interview to steal Google accounts](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/)
- [Jobseekers exploited in fake recruiter phishing campaigns](https://www.okta.com/blog/threat-intelligence/jobseekers-exploited-in-fake-recruiter-phishing-campaigns/)
- [Google Careers impersonation credential phishing scam with endless variation](https://sublime.security/blog/google-careers-impersonation-credential-phishing-scam-with-endless-variation/)
- [Uncovering a Calendly-themed phishing campaign](https://pushsecurity.com/blog/uncovering-a-calendly-themed-phishing-campaign)
- [Fake Google Careers Recruiters Target Users in Gmail Credential Theft](https://cyberpress.org/google-careers-phishing/)
- [Google 'Careers' scam lands job seekers in credential traps](https://www.csoonline.com/article/4077041/google-careers-scam-lands-job-seekers-in-credential-traps.html)
- [Browser In The Browser (BITB) Attack](https://mrd0x.com/browser-in-the-browser-phishing-attack/)
- [Fake Calendly invites spoof top brands to hijack ad manager accounts](https://www.bleepingcomputer.com/news/security/fake-calendly-invites-spoof-top-brands-to-hijack-ad-manager-accounts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1139