# Operation Fake KickOff: Recruiter-Impersonation AitM/BitB Toolkit Abuses Salesforce, SendGrid, Zoho and Render to Harvest Google Workspace Credentials and Bypass MFA

> A multi-stage phishing operation, tracked by Intel 471 as overlapping Okta's O-UNC-038 cluster, impersonates recruiters from 52+ global brands to lure marketing and HR professionals to fake Calendly/Google Calendar interview-scheduling portals. A React-based adversary-in-the-middle (AitM) toolkit using the Browser-in-the-Browser (BitB) technique renders a fake Google sign-in popup, intercepts credentials and live session data, and defeats email, SMS, TOTP (Google Authenticator) and Google Prompt MFA in real time before exfiltrating stolen data to Telegram bots.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1388
- **ID:** TL-2026-1388
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Fake KickOff is an ongoing, financially-motivated credential-harvesting campaign first tracked by Intel 471 and active since at least April 2025 (cluster registration activity from June 5, 2025), with a FIFA World Cup 2026-themed pivot detected June 24, 2026 and public disclosure via BleepingComputer on July 6, 2026. The operation systematically abuses legitimate SaaS sales, marketing and cloud infrastructure -- Salesforce Marketing Cloud/ExactTarget (exct.net), SendGrid, Zoho, the PeopleForce HR platform, and the real-estate CRM wiseagent.com -- as redirect chains to distribute recruiter-impersonation phishing emails while evading email security controls that trust these reputable domains. Emails spoof real recruiter names and photographs lifted from LinkedIn and direct marketing/HR-adjacent job seekers to typosquatted domains (e.g., fifahr-careers.com, adidas-hiring.com) hosting a Calendly-style interview-scheduling interface. Victims are prompted to authenticate via 'Continue with Google' using a corporate account, which loads a browser-in-the-browser (BitB) fake Google sign-in window -- HTML/CSS rendered inside the page rather than a real OS-level browser window, making it visually indistinguishable from a legitimate popup. The phishing kit is built on the React framework and, per Intel 471's analysis of inline code comments, emojis and structural neatness, was very likely generated with the assistance of generative-AI coding tools. Once credentials are submitted to /api/login, the phishing frontend opens a persistent 3-second polling loop against /check_response?session_id= to maintain live, bidirectional communication with an adversary-controlled backend, letting the operator view captured credentials in real time and interactively push follow-on MFA-bypass prompts to the victim's browser. Four dedicated components handle MFA interception: an /email endpoint spoofing Google's two-step email verification prompt, a /2fa endpoint requesting a Google Authenticator TOTP code, an /sms endpoint requesting an SMS confirmation code, and a /tap endpoint that simulates a high-fidelity Google Prompt push notification, polling every 500ms for an attacker-supplied verification_number and instructing the victim to approve it in the real Gmail mobile app. A hardcoded credential filter discards personal webmail domains (Google, Yahoo, MSN, iCloud, Outlook, Hotmail, ProtonMail, AOL) so only corporate Google Workspace accounts are retained. The kit also queries the third-party ipwho.is geolocation service to enrich victim telemetry (IP address, geolocation) before POSTing the full capture to /api/login. Infrastructure comprises 232 dedicated phishing domains (predominantly .com, using brand+keyword naming patterns such as -careers, -jobs, -hiring, -recruiting, -hr, -talent, -calendly, -schedulecall) registered through Hosting Concepts BV, Trustname.com, Name.com, Nicenic International Group Co. Ltd. and Key-Systems GmbH, and hosted on Amazon CloudFront/EC2 with domains also generated via the Netlify AI platform. Exfiltration and C2 rely on 80 backend instances hosted on Render's onrender.com PaaS, with stolen credentials and session data forwarded to Telegram bots for real-time operator access. The campaign spans 15 industry verticals and impersonates at least 52 organizations -- roughly 54% of infrastructure targets HR consulting, with Robert Half Inc. and Aquent LLC accounting for ~50% of observed domains alone. Broader brand impersonation documented by Team Cymru/BushidoUK and Malwarebytes includes Netflix, Coca-Cola, PepsiCo, Red Bull, Adidas, Louis Vuitton, Sephora, Levi's, Adobe, ManpowerGroup, McKinsey & Company, OpenAI, Marriott, Omnicom Group, American Airlines, Booking.com, Delta Air Lines, United Airlines and FIFA, primarily targeting marketing professionals and entry-level job seekers. Intel 471 assesses strong overlap with Okta's previously reported O-UNC-038 cluster (December 2025 advisory): both target Google Workspace corporate credentials, use BitB (including a separate Facebook-themed BitB variant tracked by Okta across 143 domains via Vercel and registrar.eu/AWS infrastructure), exfiltrate to Telegram bots, abuse Salesforce ExactTarget, and share overlapping impersonated-brand and domain-keyword lists. A key technical distinction: Okta's Google Workspace-focused O-UNC-038 sub-cluster used Socket.IO and Cloudflare-fronted static landing pages for exfiltration, whereas Intel 471 did not observe Socket.IO usage in Operation Fake KickOff, indicating either a distinct toolkit branch or an evolution of the shared actor's tradecraft. No CVE or software vulnerability is involved; this is a pure social-engineering and AitM/session-hijacking technique. Recommended defenses include enforcing least-privilege on corporate accounts, deploying phishing-resistant MFA (FIDO2 security keys such as Titan Security Key, or passkeys) for Google Workspace, monitoring egress to *.onrender.com, training users to drag suspected authentication popups outside the browser window to unmask BitB replicas, and alerting HR/recruiting staff to LinkedIn-based reconnaissance and impersonation of their identities.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1606 Forge Web Credentials
- T1036 Masquerading
- T1684.001 Impersonation
- T1550 Use Alternate Authentication Material
- T1590 Gather Victim Network Information
- T1005 Data from Local System
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials](https://www.intel471.com/blog/operation-fake-kickoff-attackers-abuse-recruiters-and-saas-to-harvest-work-credentials)
- [Jobseekers Exploited in Phishing Campaigns | Threat Advisory | Okta Threat Intelligence](https://www.okta.com/blog/threat-intelligence/jobseekers-exploited-in-fake-recruiter-phishing-campaigns/)
- [Phishing poses as big-brand job interview to steal Google accounts](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/)
- [Fake Netflix, Coca-Cola, and FIFA job scams target marketers](https://www.malwarebytes.com/blog/scams/2026/07/fake-netflix-coca-cola-and-fifa-job-scams-target-marketers)
- [Fake Netflix, Coca-Cola, and FIFA job scams target marketers](https://securityboulevard.com/2026/07/fake-netflix-coca-cola-and-fifa-job-scams-target-marketers/)
- [Fake recruiters from Adidas, Netflix, Adobe are stealing passwords](https://www.techlicious.com/blog/fake-google-login-popup-recruiter-phishing-scam/)
- [Hackers Use Recruiter Phishing Emails and Fake Career Pages to Harvest Gmail Logins](https://cybersecuritynews.com/hackers-use-recruiter-phishing-emails-and-fake-career-pages/)
- [Hackers Using Prominent Company Brands for Fake Job Interviews to Steal Google Accounts](https://www.theepochtimes.com/us/hackers-using-prominent-company-brands-for-fake-job-interviews-to-steal-google-accounts-6058880)
- [Fake Interview Phishing Campaign Impersonates Top Brands to Steal Gmail Credentials](https://gbhackers.com/fake-interview-phishing-campaign/)
- [GmailPhishingAlert.md (technical IOC gist)](https://gist.github.com/BushidoUK/57c38d5ee75481fb237e968a537de778)
- [Fake hiring pages abuse FIFA and other major brands to steal work credentials](https://www.gendigital.com/blog/insights/research/fake-hiring-pages-abuse-fifa)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1388