A phishing campaign has been uncovered involving fake job interview invitations from well-known companies such as Disney, Coca-Cola and Nike. Cybersecurity researchers at NordVPN identified 813 scam domains impersonating recruiters from over 75 prominent firms, including Nvidia, Adidas, Adobe and Booking.com.
The con typically begins with an email, LinkedIn message or Facebook approach, where scammers pose as recruiters. They sometimes mimic real employees by copying names and photos from LinkedIn profiles to appear credible.
Candidates are directed to a page designed to look like Calendly for scheduling interviews, where they are then prompted to log in using Google or Facebook credentials. NordVPN warns that the login window and even the site’s address bar and security padlock can be convincingly faked, allowing attackers to intercept passwords and verification codes in real time. Access to such information could compromise workplace email, advertising accounts and corporate social media profiles.
READ MORE: Flood Prevention Plans May Transform Taunton Meadow into Seasonal Water Storage
READ MORE: Somerset man honours late wife by raising ovarian cancer awareness
Marketing and communications staff seem particularly targeted. A compromised account in these departments can grant criminals entry to valuable company systems and advertising budgets.
Adrianus Warmenhoven, cybersecurity adviser at NordVPN, explained that the guise of a job interview makes the scam especially believable, as applicants are accustomed to interacting with unfamiliar contacts and sharing personal information. He highlighted the risk of counterfeit login windows embedded within the scam pages.
Daniel Mohacek, CEO of Truth Engine, noted the fraud exploits the trust users place in recognised brands and real people. Fake endorsements and legitimate-looking profiles on LinkedIn may further disarm jobseekers.
Experts advise verifying unexpected recruitment approaches by checking the company’s official website for listed vacancies and contacting companies directly using independently sourced information. Kate Underwood, founder of Kate Underwood HR and Training, warned that these scams are increasingly sophisticated and can lead to attackers gaining access not just to CVs but to applicants’ entire digital identities.
She recommended avoiding using third-party login prompts embedded in unfamiliar sites, instead visiting employers’ career pages directly.
Francis West, CEO at Security Everywhere, remarked on the prevalence of recruitment scams affecting both major brands and recruitment agencies. He cautioned that the mental state of jobseekers-hopeful and anxious-makes them vulnerable to these well-crafted cons. West suggested that genuine interview scheduling seldom requires login credentials, and urged contacting employers to confirm invitations.
Career coach Amelia Brooke has reported such scams on LinkedIn, citing typo-squatting tactics-altering company names slightly to dupe candidates into clicking on fraudulent links. She encourages users to report suspicious posts to LinkedIn to help prevent others from falling victim.
Harvey Dhillon, CEO at Zmartly, highlighted the potential financial risks if compromised accounts with advertising access are used to place orders. He advised companies to limit ad account spending and advised jobseekers not to use work accounts with ads access for interview pages.
Kelly Smallcombe from Meliorem HR Consultancy recommended assessing whether recruitment approaches align with typical company practices. Large organisations usually advertise vacancies and conduct applications through official channels rather than social media messages or unusual booking links. Verifying these details can help jobseekers avoid scams that exploit desperation and brand recognition.
The rise in sophisticated recruitment scams underlines the need for vigilance by applicants and employers alike, emphasizing thorough verification of recruitment communications and processes.