Fake Job Interviews and a New Twist on Phishing

Finding a new job can already be stressful enough without wondering whether the interview invitation sitting in your inbox is legitimate. Unfortunately, cybercriminals are taking advantage of that uncertainty by impersonating well-known companies in an effort to steal Google accounts through convincing phishing attacks.

According to a recent article published by BleepingComputer, attackers are posing as recruiters from recognizable brands and inviting prospective employees to what appears to be a legitimate online interview. The goal, however, is not to offer a job. Instead, the attackers want victims to surrender access to their Google accounts through a carefully crafted phishing campaign.

One of the techniques highlighted in the report is something known as Browser-in-the-Browser, or BitB. Although we have discussed phishing many times over the years, this particular technique has not been covered here before.

So what exactly is Browser-in-the-Browser?

Normally, when you click a ‘Sign in with Google’ or ‘Sign in with Microsoft’ button, your browser opens what appears to be a separate authentication window. With a Browser-in-the-Browser attack, that pop-up isn’t actually a browser window at all. Instead, it is a convincing imitation created entirely within the web page itself using HTML, CSS, and JavaScript. It can look almost identical to the real thing, complete with what appears to be a title bar, an address bar, and even familiar browser controls. Because the entire window is being rendered by the malicious web page, any credentials entered into that fake window are sent directly to the attacker rather than to Google or another legitimate service. ([BleepingComputer][1])

Fake vs. Real Sites

• Legitimate site: https://accounts.google.com
• Fake page displayed inside the browser: It appears to show https://accounts.google.com, but you’re actually still on https://careers-example.com.

No links are actually linked here, and we intend this to be the case.

The important thing is that you never actually leave the original website. The page simply draws what looks like another browser window, complete with its own address bar. Even though it appears you are signing in to Google, every keystroke is still being sent to the malicious website.

The Browser-in-the-Browser technique was first demonstrated publicly by security researcher mr.d0x in 2022. Since then, it has gradually found its way into real-world phishing campaigns targeting everything from social media accounts to corporate logins. More recently, researchers have observed attackers incorporating it into fake job interview campaigns because applicants naturally expect to sign into meeting platforms or collaboration tools during the hiring process. ([BleepingComputer][1])

This is another reminder that phishing continues to evolve. Years ago, we learned to watch for poor spelling, suspicious links, and questionable email addresses. Today’s phishing campaigns often use professionally designed websites, realistic branding, and even convincing browser windows that appear to be completely legitimate.

What should you do to defend yourself from this?

The best defense is still a healthy amount of skepticism. If you receive an unexpected interview invitation, verify that it actually came from the company in question. Whenever possible, navigate directly to the company’s careers page or sign in to your account by typing the address yourself instead of clicking links in an email. Using a password manager can also help because it typically recognizes legitimate websites and won’t automatically fill your credentials into a convincing fake.

While no security measure is perfect, understanding how these newer phishing techniques work can make it much easier to recognize when something doesn’t quite feel right.

The original BleepingComputer article can be found here:

Phishing poses as big-brand job interview to steal Google accounts