Operation Fake KickOff: Fake Recruiters, Real Credential Theft

Since April 2025, Intel 471 has tracked an active phishing operation built on one of the oldest social engineering hooks there is: the promise of a job at a brand people actually want to work for. Operation Fake KickOff has impersonated 52 organizations across 15 industries, with HR consulting firms like Robert Half and Aquent making up roughly half of all observed infrastructure. Most recently, the operators rotated their lures to ride the visibility of the FIFA World Cup 2026, a sign of how quickly this group adapts to whatever event offers the most credible cover.

Victims are routed through fake Calendly-style interview scheduling pages using the real names and photos of actual recruiters pulled from LinkedIn. From there, a browser-in-the-box (BitB) toolkit renders a pixel-perfect Google sign-in window and hijacks the session in real time, bypassing MFA entirely. The kit filters out personal email addresses on purpose; it's built to steal a working corporate session, not just a password. Across 232 phishing domains and 80 C2 servers hosted on legitimate platforms like Salesforce, SendGrid, and Render, this campaign is a case study in how far attackers will go to make malicious infrastructure look completely unremarkable.

Join Carlos Borges, Team Lead of Cybercrime Analysis at Intel 471, as he breaks down:

• How the recruiter-impersonation lure and BitB toolkit work end to end, from first click to session hijack
• Why this campaign is able to defeat standard MFA protections
• The legitimate SaaS and cloud platforms being abused to host it, and why that makes detection harder
• Practical mitigations your team can apply now to catch this kind of AiTM-based credential theft

Carlos will bring firsthand analysis from Intel 471's investigation, including infrastructure patterns and indicators your team can use to detect this campaign before it reaches a live session.