Scammers fake job offers from Nvidia, Glassdoor to steal your senstive information

Ruthless scammers pretending to be from major companies, such as Nvidia and Glassdoor, are offering to hire unsuspecting job seekers – but instead, are out to steal their sensitive personal information.

Researchers at Fortra are warning job seekers about a recently discovered sophisticated phishing campaign impersonating major brands such as NVIDIA, Glassdoor, RedBull, Marriott, Salesforce, and more.

The scam involves emails offering false job opportunities that lead the victims to websites where they are asked to provide a plethora of personal information that is then confiscated by the bad actors running the campaign.

According to Forta’s Fire team, the large-scale operation “has appeared across multiple Fortra clients, with hundreds of phish abusing legitimate domains and falsely branded websites to capture user credentials.”

Trust in known and respected brands

First discovered in June, the phish uses multiple social engineering tactics, some so convincing, Forta says, that hopeful job seekers targeted in the indiscriminate phishing email sprays are almost guaranteed to fall victim to the attack.

Israel Cerda, Security Operations Lead at Fortra said the threat actors in this campaign attempt to "break down defenses by leveraging trust in recognized brands."

For example, “impersonating a well-known enterprise such as Marriott, and personalizing the email to the recipient’s name gives an impression of authenticity, “ Cerda said.

A flashy title and expressed interest in the recipient’s expertise will also make the recipient more likely to click on the embedded link, he said.

The emails, appearing to come directly from one of the company's recruiters, right off the bat, tell the victim they are being considered for a specific job and invite them to schedule a phone call.

“The victim will then be redirected to a convincing phishing site imitating a popular service for scheduling meetings, Calendly," Fortra said.

Inevitably, the victim will be asked to fill in credentials to their Facebook or Google account to complete the scheduling on Calendly, a seemingly normal part of the process.

“Unless they are already familiar with the Calendly service, there is usually no requirement to provide third-party authentication,” said Cerda.

In a similar example, the bad actors employ the well-known human resources provider and temporary staffing firm Adecco to lead the victim to schedule a call, which will take them to a Google sign-in screen.

In that Adecco set-ups, the Fire team noticed the bad actors used a recently registered domain, with an expiration set to expire after a year.

"It only takes one employee reusing their Google or Facebook password for their corporate email account to result in a significant risk of a data breach, business email compromise, or infection of systems down the line," Cerda explained in the Fortra blog.

Phishing red flags

The Fire intelligence team provides recommendations to help both employees and businesses protect themselves against this type of sophisticated campaign.

• Training employees on phishing trends, social engineering tactics, and how they may be vulnerable to them.
• Enforce strong password policies and hygiene practices, including only using unique passwords for both personal and work accounts.
• Email and endpoint protection systems should be employed for monitoring.
• Mechanisms should be in place for employees to report suspected phishing emails and for them to be analyzed by security teams.

Fotra said it is imperative that organizations "invest in personnel training against emerging social engineering tactics and have systems in place to report, analyze, and block these attacks before they reach the employee’s inbox.”