CTM360 Uncovers 3,000+ Recruitment Phishing URLs Using Browser-in-the-Browser Credential Traps

Cybersecurity researchers at CTM360 have exposed a large-scale, global recruitment-themed phishing campaign that leverages Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and relay multi-factor authentication (MFA) prompts in real time. Dubbed ‘RecruitTrap,’ the campaign identified over 3,000 phishing URLs over two months, impersonating recruiters from more than 50 organizations across 14 sectors, with marketing professionals as primary targets.

The attack begins with unsolicited emails or meeting invitations that appear to come from legitimate recruiters. Victims are directed to counterfeit Calendly-style scheduling pages or brand-specific recruitment portals, both leading to a fake ‘Continue with Google/Facebook’ prompt. The BitB technique displays a spoofed address bar and padlock, making the phishing page appear authentic. On mobile, it may show as a full-screen counterfeit login page.

CTM360’s technical analysis revealed that the phishing kit operates as a live state machine, using a Svelte/SvelteKit front end to guide victims through CAPTCHA, username, password, and various MFA methods. A persistent Socket.IO channel allows the backend to control the flow, filtering out personal email domains to focus on corporate accounts. After credentials are entered, attackers use them to sign in to the real service, relay MFA codes, and obtain authenticated sessions.

Infrastructure analysis shows that 96% of phishing pages used a Calendly theme, with many hosted on Cloudflare and AWS EC2. The campaign uses shared infrastructure and rapid rebranding capabilities, with .cfd as the most common top-level domain. The most targeted industries include recruitment, technology, luxury goods, and travel.

To mitigate such attacks, users should verify unsolicited interview invitations through official channels, use password managers to detect fake origins, and organizations should implement phishing-resistant authentication like passkeys or hardware-backed WebAuthn. Anyone who entered credentials into a suspected page should immediately change passwords, revoke sessions, and notify their security team.