Threat reportPhishingTL-2026-4994
Operation Fake KickOff: Recruiter-Impersonation AitM Phishing Abusing SaaS to Harvest Work Credentials
Operation Fake KickOff (TL-2026-4994), also tracked as Operation Fake KickOff, is a high-severity phishing campaign, first published 2026-11-01. It is attributed to O-UNC-038 with medium confidence, affects Google Google Workspace (corporate accounts; credentials and session, maps to 12 MITRE ATT&CK techniques (T1071.001, T1102.002, T1111), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1O-UNC-038
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-4994
- Threat ID
- TL-2026-4994
- Also known as
- Operation Fake KickOff, Fake KickOff
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- O-UNC-038
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- human-resources-consulting, staffing, marketing, technology, consumer-brands, travel, finance, professional-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Operation Fake KickOff
Malware and tooling: Browser-in-the-Browser (BitB)
How Operation Fake KickOff works
Intel 471 reports Operation Fake KickOff, a multi-stage phishing campaign active since April 2025 that uses fake recruitment and interview-scheduling pages and an adversary-in-the-middle toolkit with Browser-in-the-Browser and real-time MFA relay to harvest Google Workspace credentials and live session tokens. It used 232 phishing domains and 80 C2 servers on Render, impersonated 52 organizations across 15 industries, and forwarded stolen data to Telegram bots.
Operation Fake KickOff is an ongoing, multi-stage credential-phishing campaign documented by Intel 471 on 2026-07-15 (intelligence cutoff 2026-07-07) and attributed to the cluster Okta tracks as O-UNC-038. Activity dates to at least April 2025, with a domain-registration cluster beginning 2025-06-05 and a FIFA World Cup 2026-themed wave in June 2026. Lure emails impersonate real recruiters (real names and photos are used) from well-known brands. Emails are sent through legitimate marketing and email-delivery SaaS (Salesforce/ExactTarget, SendGrid, Zoho), whose native click-tracking and redirect schemas hide the final destination. Victims land on fake recruitment or interview-scheduling pages (Calendly-style) on look-alike domains named [brand]-[keyword] or [keyword]-[brand] (keywords such as careers, jobs, hiring, recruiting, hr, talent, meetings, calendar, schedulecall), for example adidas-hiring.com and fifahr-careers.com. BleepingComputer/Team Cymru (2026-07-06) described a redirect chain exct.net (Salesforce Marketing Cloud) to wiseagent.com to the phishing page, a PeopleForce HR platform abuse vector, and recruiter-impersonating Outlook sender addresses.
The core is a custom AitM toolkit that keeps persistent, real-time communication with an adversary-controlled backend to manipulate the victim session and orchestrate MFA bypass. A dedicated script applies the Browser-in-the-Browser (BitB) technique (mrd0x) to render a visually identical Google sign-in popup inside the page, defeating window-drag checks. The kit primarily targets Google Workspace credentials and live session tokens (some pages target Facebook). A hardcoded blocklist rejects personal mail providers (Gmail, Yahoo, MSN, iCloud, Outlook, Hotmail, ProtonMail, AOL), so only corporate accounts are collected. The frontend polls the backend every 3 seconds at /check_response?session_id= for attacker instructions. Four scripts relay MFA: /email (spoofed two-step verification), /2fa (TOTP codes), /sms (SMS codes) and /tap (Google Prompt, polled every 500 ms; the victim is told to tap an attacker-supplied number in the mobile Gmail app). After a successful bypass the victim is redirected to a calendar entry or an external URL. Intel 471 notes verbose, emoji-laden inline comments in Login.js that suggest generative-AI-assisted development.
Infrastructure: 232 phishing domains (mostly .com) registered through registrars including Hosting Concepts BV, Trustname.com, Name.com, Nicenic International Group and Key-Systems GmbH, with Netlify also used for domain creation and possibly page hosting. Front ends are mostly behind Amazon CloudFront, with some direct Amazon EC2 exposure. 80 unique C2 servers run on the Render platform (onrender.com), some reused across multiple phishing domains. Stolen credentials flow from the Render C2 servers to Telegram bots. Targeting covers 52 organizations across 15 industries; HR consulting is about 54% of observed infrastructure, and Robert Half and Aquent together account for about 50% of tracked domains. Employees of non-HR organizations who use corporate accounts to apply at impersonated brands are a secondary target. Intel 471 observed no socket.io exfiltration, unlike some O-UNC-038 activity described by Okta, which reported two campaigns (143 domains with Facebook harvesting and Telegram bots; 84 domains with Google Workspace targeting and Socket.IO exfiltration). No CVE is involved. Defensive guidance: phishing-resistant MFA (FIDO2/WebAuthn/passkeys), monitor DNS and network connections to onrender.com, block newly registered brand-impersonating domains, and train users to spot BitB windows. Note: the full IOC list in the Intel 471 report was not available in the retrievable text; only the indicators below are sourced.
MITRE ATT&CK techniques used in TL-2026-4994
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Execution
Initial Access
T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.001 Domains; T1583.006 Web Services
Defense Evasion
Affected products and versions in Operation Fake KickOff
- Google — Google Workspace (corporate accounts; credentials and session tokens)
Vulnerable versions: All accounts without phishing-resistant MFA
Fixed in: Accounts enrolled in FIDO2/WebAuthn phishing-resistant MFA - Meta — Facebook (credentials on some phishing pages)
Vulnerable versions: Accounts without phishing-resistant MFA
Remediation for Operation Fake KickOff
Immediate actions
- Block or alert on DNS queries and connections to *.onrender.com where not business-required
- Block newly registered domains impersonating brands with careers/jobs/hiring/recruiting/hr/talent/calendar keywords
- Reset credentials and revoke sessions and tokens for users who entered credentials on suspected pages; review Google Workspace and SSO sign-in logs
- Hunt for outbound api.telegram.org calls from non-standard clients
Workarounds
- Require hardware security keys for high-risk users such as HR, recruiting and marketing staff
- Verify unsolicited recruiter outreach through an independent channel before clicking
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn/passkeys) for Google Workspace and SSO
- Enforce DMARC/DKIM/SPF and filter recruiter-themed email arriving via marketing SaaS click-tracking redirectors
- Train staff to detect Browser-in-the-Browser windows (fake popups confined to the page frame)
- Restrict corporate-account use on external job-application sites
Timeline of Operation Fake KickOff
- Initial Operation Fake KickOff campaigns begin (Intel 471 reports activity since April 2025; day is approximate)
- Cluster of phishing-domain registrations begins, following [brand]-[keyword] naming patterns
- Okta Threat Intelligence publishes O-UNC-038 report on fake-recruiter BitB phishing (143-domain Facebook/Telegram campaign and 84-domain Google Workspace/Socket.IO campaign)
- FIFA World Cup 2026-themed wave observed, using domains such as fifahr-careers.com (June 2026; day is approximate)
- BleepingComputer, citing Team Cymru, reports Adidas recruiter impersonation via adidas-hiring.com and a Salesforce exct.net redirect chain
- Intel 471 intelligence cutoff for its Operation Fake KickOff analysis
- Intel 471 publishes the Operation Fake KickOff report: 232 phishing domains, 80 Render C2 servers, 52 impersonated organizations across 15 industries
Sources cited for Operation Fake KickOff
- Operation Fake KickOff: Attackers abuse recruiters and SaaS to harvest work credentials (Intel 471)
- Jobseekers exploited in fake recruiter phishing campaigns (Okta Threat Intelligence, O-UNC-038)
- Phishing poses as big brand job interview to steal Google accounts (BleepingComputer)
- Operation Fake KickOff detection brief (CraftedSignal)
- Browser-in-the-Browser (BitB) phishing attack (mrd0x)
- Operation Fake KickOff: Fake Recruiters, Real Credential Theft (Intel 471 webinar)
Detection coverage for TL-2026-4994
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4994 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.