# Operation Fake KickOff: Recruiter-Impersonation AitM Phishing Abusing SaaS to Harvest Work Credentials

> Intel 471 reports Operation Fake KickOff, a multi-stage phishing campaign active since April 2025 that uses fake recruitment and interview-scheduling pages and an adversary-in-the-middle toolkit with Browser-in-the-Browser and real-time MFA relay to harvest Google Workspace credentials and live session tokens. It used 232 phishing domains and 80 C2 servers on Render, impersonated 52 organizations across 15 industries, and forwarded stolen data to Telegram bots.

- **Published:** 2026-11-01T12:15:03Z
- **Last reviewed:** 2026-11-01T12:15:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4994
- **ID:** TL-2026-4994
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** O-UNC-038
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Fake KickOff is an ongoing, multi-stage credential-phishing campaign documented by Intel 471 on 2026-07-15 (intelligence cutoff 2026-07-07) and attributed to the cluster Okta tracks as O-UNC-038. Activity dates to at least April 2025, with a domain-registration cluster beginning 2025-06-05 and a FIFA World Cup 2026-themed wave in June 2026. Lure emails impersonate real recruiters (real names and photos are used) from well-known brands. Emails are sent through legitimate marketing and email-delivery SaaS (Salesforce/ExactTarget, SendGrid, Zoho), whose native click-tracking and redirect schemas hide the final destination. Victims land on fake recruitment or interview-scheduling pages (Calendly-style) on look-alike domains named [brand]-[keyword] or [keyword]-[brand] (keywords such as careers, jobs, hiring, recruiting, hr, talent, meetings, calendar, schedulecall), for example adidas-hiring.com and fifahr-careers.com. BleepingComputer/Team Cymru (2026-07-06) described a redirect chain exct.net (Salesforce Marketing Cloud) to wiseagent.com to the phishing page, a PeopleForce HR platform abuse vector, and recruiter-impersonating Outlook sender addresses.

The core is a custom AitM toolkit that keeps persistent, real-time communication with an adversary-controlled backend to manipulate the victim session and orchestrate MFA bypass. A dedicated script applies the Browser-in-the-Browser (BitB) technique (mrd0x) to render a visually identical Google sign-in popup inside the page, defeating window-drag checks. The kit primarily targets Google Workspace credentials and live session tokens (some pages target Facebook). A hardcoded blocklist rejects personal mail providers (Gmail, Yahoo, MSN, iCloud, Outlook, Hotmail, ProtonMail, AOL), so only corporate accounts are collected. The frontend polls the backend every 3 seconds at /check_response?session_id= for attacker instructions. Four scripts relay MFA: /email (spoofed two-step verification), /2fa (TOTP codes), /sms (SMS codes) and /tap (Google Prompt, polled every 500 ms; the victim is told to tap an attacker-supplied number in the mobile Gmail app). After a successful bypass the victim is redirected to a calendar entry or an external URL. Intel 471 notes verbose, emoji-laden inline comments in Login.js that suggest generative-AI-assisted development.

Infrastructure: 232 phishing domains (mostly .com) registered through registrars including Hosting Concepts BV, Trustname.com, Name.com, Nicenic International Group and Key-Systems GmbH, with Netlify also used for domain creation and possibly page hosting. Front ends are mostly behind Amazon CloudFront, with some direct Amazon EC2 exposure. 80 unique C2 servers run on the Render platform (onrender.com), some reused across multiple phishing domains. Stolen credentials flow from the Render C2 servers to Telegram bots. Targeting covers 52 organizations across 15 industries; HR consulting is about 54% of observed infrastructure, and Robert Half and Aquent together account for about 50% of tracked domains. Employees of non-HR organizations who use corporate accounts to apply at impersonated brands are a secondary target. Intel 471 observed no socket.io exfiltration, unlike some O-UNC-038 activity described by Okta, which reported two campaigns (143 domains with Facebook harvesting and Telegram bots; 84 domains with Google Workspace targeting and Socket.IO exfiltration). No CVE is involved. Defensive guidance: phishing-resistant MFA (FIDO2/WebAuthn/passkeys), monitor DNS and network connections to onrender.com, block newly registered brand-impersonating domains, and train users to spot BitB windows. Note: the full IOC list in the Intel 471 report was not available in the retrievable text; only the indicators below are sourced.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1567 Exfiltration Over Web Service

## Sources

- [Operation Fake KickOff: Attackers abuse recruiters and SaaS to harvest work credentials (Intel 471)](https://www.intel471.com/blog/operation-fake-kickoff-attackers-abuse-recruiters-and-saas-to-harvest-work-credentials)
- [Jobseekers exploited in fake recruiter phishing campaigns (Okta Threat Intelligence, O-UNC-038)](https://www.okta.com/blog/threat-intelligence/jobseekers-exploited-in-fake-recruiter-phishing-campaigns/)
- [Phishing poses as big brand job interview to steal Google accounts (BleepingComputer)](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/)
- [Operation Fake KickOff detection brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-07-operation-fake-kickoff/)
- [Browser-in-the-Browser (BitB) phishing attack (mrd0x)](https://mrd0x.com/browser-in-the-browser-phishing-attack/)
- [Operation Fake KickOff: Fake Recruiters, Real Credential Theft (Intel 471 webinar)](https://www.intel471.com/resources/webinars/operation-fake-kickoff-fake-recruiters-real-credential-theft)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4994