RecruitTrap Fake Interview Pop-Up Scam: How Corporate Logins Are Stolen

An interview invitation arrives while you are open to hearing about new work. It mentions your background and offers a calendar with convenient times.

The scheduling page looks polished. A sign-in window appears just as you try to reserve a slot, and the address inside that window seems reassuringly familiar.

Overview

A job approach built around a routine calendar task

RecruitTrap is a recruitment-themed phishing campaign. The approach uses invented interview invitations and counterfeit scheduling pages to push applicants toward a false work-account login.

CTM360 reported finding more than 3,000 phishing URLs over two months, impersonating hiring processes at more than 50 organizations. Its research highlighted marketing professionals.

Zimperium later described the same kind of lure on mobile devices. The pages adapt their presentation to the screen, but the objective remains corporate credentials.

This does not mean the real companies named in the invitations are running the campaign. Their brands, staff identities, and job interest are being impersonated.

The pop-up is not a separate browser window

On desktop, the page can draw what looks like a Google sign-in window inside the recruitment site. The fake window includes its own painted address bar.

The displayed account address is just page content. The actual browser still belongs to the scheduling site, which can collect what is entered into the form.

That distinction is easy to miss when the smaller window floats over a convincing calendar. The familiar logo and lock icon inside the artwork are not security guarantees.

On a phone, the same deception may fill the screen. Without a visible outer browser bar, separating the page’s artwork from browser controls can be harder.

Why the campaign asks for a work email

Researchers found that some pages reject personal email addresses and require a corporate domain. That is not a normal courtesy to applicants.

It selects accounts that may open workplace mail, files, contacts, advertising tools, or cloud applications. The attacker wants access with business value.

Before responding to an unsolicited interview request, look for these boundaries:

• A role you can find on the employer’s real careers site.
• A recruiter whose identity can be confirmed through established channels.
• A scheduling domain listed by that employer, not merely branded with its name.
• A genuine provider sign-in window controlled by the browser.
• A login request that makes sense for the job process.

The opening image is a safe reconstruction, not a recovered victim email. Names and links in it are illustrative.

The Hiring Detail That Makes the Trap Feel Personal

Generic phishing emails say your password will expire. RecruitTrap approaches people with a possibility they may actually want to explore.

A recruiter can mention a portfolio, a recent role, or a public profile. Those details are easily gathered without having spoken to the person.

When the invitation resembles a real opportunity, the recipient may spend time considering the position. That investment makes the next click feel ordinary.

Calendars are especially effective because they turn a big decision into a tiny task. You are not asked to accept a job, only to pick a time.

The false login appears after the candidate has begun that task. It looks like a routine identity step rather than the point of the attack.

Some campaigns impersonate major employers. Zimperium identified recruitment-themed domains associated with names across retail, aviation, technology, consulting, and other sectors.

A recognizable employer may have many genuine vacancies. That fact makes a copied careers page believable, but it does not validate the particular invitation.

The fake window uses another layer of borrowed trust. Its small painted bar may say a familiar identity-provider address while the actual page remains elsewhere.

Move the supposed window and watch the browser frame if you are unsure. A drawn element cannot escape its parent tab the way a real browser window can.

The second illustration shows the visual mismatch. The outer browser is on an example scheduling site, while the inner address is only part of the page’s design.

How the RecruitTrap Interview Pop-Up Scam Works

Step 1: The attacker builds a credible recruiting identity

The approach may come by email or professional networking message. It can use a plausible recruiter name, company styling, and details copied from the target’s public work history.

The claimed organization may genuinely be hiring. The attacker relies on that background reality to make an unrelated scheduling link feel safer.

Look closely at who is sending the message and whether the role appears through the employer’s independently reached careers portal.

A real interview can still begin unexpectedly. The problem is not surprise alone, but a demand to authenticate through an unverified route.

If you are employed, be especially wary when the message insists on using your current company’s login for an outside interview.

Step 2: A counterfeit scheduling page offers open slots

The candidate follows the invitation to a page that may resemble a careers or appointment tool. Time slots and job details create the impression of a live workflow.

Buttons, calendars, and privacy language are cheap to reproduce. None proves that the employer owns the domain or receives the booking.

A lookalike address can add words such as careers, hiring, or interview around a company name. The registered domain may still belong to an unrelated operator.

CTM360’s count of thousands of URLs shows why memorizing one bad address is not enough. The page structure matters more than any single hostname.

Independent confirmation takes minutes: start at the genuine company site, search for the role, and ask its hiring team whether that scheduling service is approved.

Step 3: The page paints a familiar login pop-up

Clicking a slot triggers a small window that appears to belong to Google or another identity provider. It may display a padlock and a recognizable sign-in address.

In a browser-in-the-browser attack, that window is not browser chrome. It is an image-like collection of page elements controlled by the recruiting site.

The address inside it can say anything. The real address to judge is in the outer browser, which remains on the untrusted scheduling page.

Typing a work username and password into the painted form gives them to the page operator, not to the genuine identity provider.

On mobile, the impostor may switch to a full-screen login. Small screens remove much of the context that would reveal the inner window as fake.

Step 4: The kit filters and may challenge the account

The observed recruitment pages can refuse ordinary personal addresses and insist on business email. That filter improves the attacker’s chance of reaching workplace systems.

CTM360 described MFA challenge relay in its campaign overview. A victim may see another prompt after entering credentials, making the experience resemble a real login.

Do not approve a push notification or enter a one-time code merely because it arrived while the fake calendar is open.

A prompt from your actual provider can be generated by an attacker testing a stolen password. Its authenticity does not make the surrounding site legitimate.

The safer response is to close the page and inspect account activity from your employer’s established security portal or through the IT team.

Step 5: Business access becomes the prize

A successful account compromise can expose messages, shared files, contacts, and connected applications. The exact scope depends on permissions and whether the attacker obtained a valid session.

The intruder may read hiring discussions, invoices, customer data, or internal approval chains. They might send messages from the victim’s mailbox to extend the attack.

Not every opened page leads to account takeover. The key questions are whether credentials were submitted, a second factor was approved, and a session was established.

Those details matter to workplace responders. Report the incident promptly and describe precisely what happened rather than guessing at the damage.

Even if no login succeeded, the recruiter pretext may return under another domain or invite a different account owner in the same organization.

Why the Address Inside a Pop-Up Cannot Settle Trust

Most people know to check the address bar before signing in. The scam turns that good habit against them by drawing an address bar that is not real.

On a genuine separate browser window, browser controls live outside the website’s page content. The website cannot simply type over the window’s true location.

Inside a fabricated window, every pixel is part of the attacker’s site. A displayed padlock or familiar provider hostname is only text and graphics.

A page can also dim the background to concentrate attention on the false window. That lighting effect resembles real sign-in flows, adding confidence without authority.

Browser-in-the-browser attacks do not require a broken browser. They rely on the visitor confusing a rendered interface with the browser’s own controls.

The difference is clearest when you examine the outer address, open the alleged sign-in in a new tab, or navigate independently to the provider.

Do not use the fake window’s close button as a test of authenticity. A webpage can imitate that behavior too.

Instead, leave the recruiting page and begin again from your employer’s bookmarked login or the job company’s real careers site.

Recruiter, Portal, Window, and Account Checks

Confirm the recruiter outside their message

Search for the role on the employer’s own site. Compare the position, location, team, and application route with what the invitation claims.

If the approach names an employee, verify that person through a known company contact channel. A copied profile picture or signature is not enough.

Be cautious when the recruiter refuses a normal conversation until you authenticate through a link they supplied.

Separate the real domain from branding

Read the registered domain in the actual browser bar. A company name inside a path, subdomain, logo, or page title does not establish ownership.

HTTPS protects traffic to whichever site you reached. It cannot turn an imitation careers domain into the employer’s approved service.

If a legitimate hiring system uses a vendor, the employer should be able to identify that vendor and the exact route from its real careers page.

Identify whether the login is browser chrome

A fake pop-up sits inside the surrounding tab and can be drawn with a false address line. On mobile, it may occupy nearly the entire screen.

When an unrelated recruiting portal demands your current workplace password, stop. Verify with your employer’s security team before any further sign-in.

Never approve a second-factor prompt that you did not initiate through the provider’s normal page or application.

Review workplace sessions promptly

If you entered credentials, report the event through the workplace incident route. Your IT team can revoke sessions and inspect audit logs that you may not see.

Record the URL, message, role name, approximate time, and whether you completed an MFA challenge. Avoid repeatedly revisiting the page to gather more evidence.

A clean antivirus scan does not settle whether a password or active cloud session was stolen. Account logs matter more for this kind of phishing.

What to Do if You Used the RecruitTrap Sign-In Window

1. Stop the interaction and preserve the invitation. Close the page. Save the original email, sender address, scheduling URL, screenshots, and time without reopening the suspicious login.
2. Tell your workplace security team immediately. Explain whether you entered a password, approved MFA, or saw a successful booking. Fast reporting lets administrators search logs and warn coworkers.
3. Change the exposed password through the real portal. Use a trusted bookmark or company-managed device. Replace reused passwords on other services as well.
4. Revoke sessions and suspicious app access. Ask administrators to end active sessions, inspect OAuth grants, review recovery settings, and examine unusual mail rules or forwarding.
5. Check business activity after the login. Look for sent messages, file downloads, new device registrations, and unauthorized payment instructions. Notify affected colleagues or customers through approved channels.
6. Scan only if a file or app was involved. Credential entry alone calls for account response. If you downloaded something, run Malwarebytes. AdGuard can also curb misleading redirects.
7. Report the false careers page. Send details to the impersonated employer and the platform that delivered the invitation. Do not accuse the real hiring team without confirming the sender.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions

Is RecruitTrap a real employer or recruitment platform?

No. RecruitTrap is the name used for the phishing campaign described by researchers, not a genuine hiring service applicants should use.

Could the company named in the invitation still be legitimate?

Yes. Real employers and real vacancies can be impersonated. Confirm the particular recruiter, role, and scheduling service through the employer’s independently reached channels.

Why does the pop-up show a familiar login address?

The website draws that address inside its own page. It does not prove the actual browser is connected to the identity provider.

Does a real MFA prompt mean I am safe?

No. An attacker using a stolen password can trigger a genuine prompt. Deny an unrequested challenge and report the attempted sign-in.

What if I only opened the calendar page?

Closing it is usually the immediate step. Review whether you typed data, granted permissions, approved a prompt, or downloaded anything before deciding further action.

Should I use my work account to schedule an outside interview?

Be skeptical. An outside recruiter rarely needs your current employer’s credentials. Ask the hiring company for an independently verified booking route.

The Bottom Line

RecruitTrap turns an inviting calendar task into a false work-account login. Its strongest illusion is a pop-up whose familiar address is drawn inside the attacker’s page.

Verify the job and recruiter independently, inspect the real browser address, and involve workplace security quickly if you entered credentials or approved a prompt.