Dissecting RecruitTrap: Browser-in-the-Browser Phishing Adapts to Enterprise Mobile Endpoints

A sophisticated credential harvesting operation dubbed RecruitTrap is actively targeting enterprise personnel across global retail, aviation, technology, consulting, and manufacturing sectors. The campaign blends authentic human resources impersonation with Browser-in-the-Browser (BitB) techniques and responsive mobile design.

Unlike indiscriminate phishing operations that collect any valid set of credentials, RecruitTrap enforces strict pre-qualification logic. The underlying kit actively screens user input, rejects personal email addresses, and mandates the use of corporate accounts. The objective is direct: secure high-privilege footholds within enterprise identity providers, capture session tokens, and bypass legacy multi-factor authentication (MFA).

Attack Lifecycle and Initial Access

The adversary initiates contact through spear-phishing emails or tailored recruitment invitations distributed across professional networks. Attackers profile specific corporate departments, with documented campaigns heavily targeting marketing, communications, and technical roles. Compromising these accounts provides direct reach into corporate social media profiles, internal messaging platforms, and advertising portals.

The lures impersonate legitimate talent acquisition personnel from multinational corporations, citing interviews or informal role discussions. The communication provides links directing targets to two distinct phishing flows:

1. Counterfeit Scheduling Interfaces: Landing pages replicating scheduling platforms such as Calendly, customized with target corporate branding, real employee names, and authentic executive headshots.
2. Branded Career Portals: Cloned enterprise recruitment pages prompting the candidate to confirm interview availability or submit resume data.

When the target attempts to proceed, the application requires authentication using single sign-on (SSO) options, typically styled as corporate Google Workspace or Microsoft authentication prompts.

Dynamic Execution: Desktop BitB vs. Mobile Viewport Hijacking

The RecruitTrap kit is built around a responsive architecture that changes its rendering mechanism based on client viewport dimensions and User-Agent headers.

Desktop Environment: Browser-in-the-Browser (BitB)

When accessed via a desktop browser, the phishing kit generates a simulated popup window using HTML, CSS, and JavaScript. Rather than triggering a genuine secondary browser window via window.open(), the page draws a DOM-based floating iframe or div overlay that mimics the operating system and browser chrome.

• Visual Spoofing: The fake window renders an interactive title bar, window control buttons (minimize, maximize, close), an address bar displaying a legitimate authentication URL (e.g., accounts.google.com), and an SSL padlock graphic.
• Defeating User Inspection: Because the address bar is drawn inside the page DOM rather than controlled by the browser engine, URL inspection training fails. The user views what appears to be a legitimate origin while interacting directly with the attacker-controlled container.

Mobile Adaptation: Full-Screen Viewport Rendering

Desktop BitB indicators can break on small viewports due to layout constraints. The RecruitTrap kit detects mobile clients and automatically alters its delivery:

• The BitB frame is suppressed entirely.
• The kit launches a full-screen counterfeit login page directly in the primary mobile viewport.
• Modern mobile operating systems dynamically hide the native browser address bar upon user scroll or content engagement. The counterfeit interface fills the entire screen, stripping away browser chrome and URL verification cues.
• Victims on mobile devices have zero visual indicators to distinguish the prompt from a genuine OAuth consent screen or identity provider redirect.

Automated Filtering and Token Compromise

The phishing framework embeds client-side and server-side validation to maximize the utility of harvested credentials.

Target Clicks Phishing URL
          │
          ▼
Device / Viewport Detection
    ├── Desktop ──► Render BitB Window (Spoofed Address Bar)
    └── Mobile  ──► Render Full-Screen Counterfeit SSO Interface
          │
          ▼
User Enters Email Address
          │
          ▼
Pre-Qualification Check
    ├── Personal Email (e.g., @gmail, @yahoo) ──► Validation Error / Rejection
    └── Corporate Domain ───────────────────────► Proceed to Credential & MFA Capture
          │
          ▼
Adversary-in-the-Middle (AitM) Relay Engine
    ├── Harvests Plaintext Passwords
    ├── Relays TOTP / Push Prompts to Identity Provider
    └── Captures Session Cookies & Enterprise OAuth Tokens

Input Pre-Qualification

The phishing engine evaluates entered email addresses against a domain blacklist containing public webmail services (e.g., @gmail.com, @yahoo.com, @outlook.com). If a victim attempts to proceed with a personal email address, the interface returns an input error requiring an enterprise or work address.

This mechanism serves three primary attacker objectives:

1. Filtering Low-Value Targets: It eliminates irrelevant personal accounts from the credential stream.
2. Targeted Access: It ensures every captured record maps to a corporate identity directory.
3. Operational Discretion: It reduces anomalous traffic signatures on consumer identity providers, keeping the phishing infrastructure active longer across hosting services.

Real-Time MFA Relay and OAuth Exploitation

Behind the interface, the framework operates an Adversary-in-the-Middle (AitM) engine. When the victim inputs enterprise credentials, the server forwards them instantly to the real identity provider.

If the account requires multi-factor authentication (such as SMS OTP, TOTP codes, or standard mobile push), the phishing kit mirrors the prompt to the victim in real time. Once the victim submits it, the attacker intercepts the response, completes authentication against the target service, and extracts valid session tokens and OAuth access grants. Those tokens let attackers bypass the primary authentication perimeter without cracking enterprise passwords or maintaining persistence on the physical device.

MITRE ATT&CK Mapping

Threat Mitigation and Engineering Defenses

Traditional visual verification training is ineffective against Browser-in-the-Browser techniques because the target sees a convincing graphical representation of a trusted domain. Security leaders and engineers must implement mechanical controls that operate independently of human visual validation.

1. Mandate FIDO2 / WebAuthn Authentication

Standard MFA implementations (SMS OTP, voice codes, authenticator TOTP apps, and standard push notifications) are vulnerable to AitM relay.

Organizations must deploy FIDO2 / WebAuthn-based passkeys or hardware security keys. FIDO2 binds authentication directly to the cryptographic origin (the true domain registered in the browser) via the Web Authentication API. When a user authenticates inside a BitB frame or counterfeit mobile page, the authenticator assesses the real domain hosting the page, identifies the origin mismatch, and refuses to sign the cryptographic assertion.

2. Device Compliance and Conditional Access

Enforce strict Conditional Access policies within your Identity and Access Management (IAM) platform (such as Microsoft Entra ID or Okta):

• Require managed, compliant devices (verified via Mobile Device Management or Intune) for any sign-in to corporate resources.
• Restrict OAuth token issuance to compliant endpoints, preventing extracted tokens from being used on external, untrusted infrastructure.
• Block browser-based enterprise authentication from personal, unmanaged mobile devices.

3. Continuous OAuth App and Token Auditing

Threat actors leverage harvested OAuth grants to establish persistent API-level access that survives user password resets.

• Implement real-time monitoring on new OAuth app registrations and consent grants.
• Enable automatic anomaly detection for session tokens used outside typical IP ranges, autonomous system numbers (ASNs), or device footprints.
• Enforce token revocation policies that invalidate active refresh tokens upon detected anomalous access.

4. Domain and Perimeter Telemetry

Security operations teams should monitor proxy, DNS, and endpoint logs for communication with newly registered domains (NRDs) containing recruiter-themed terms alongside company trademarks. Threat intelligence platforms should continuously ingest IOCs related to known BitB hosting infrastructures to block malicious domains before phishing lures reach employee mailboxes.

Sources

The intelligence provided in this report is derived from the following authoritative threat intelligence analysis:

• KnowBe4 Blog: Recruitment-Themed Phishing Campaign Targets Enterprise Users

Gain continuous, structured threat intelligence with the Threat Landscape Platform. Start free — no credit card required — or upgrade to Professional for just $49/month.