Two coordinated phishing campaigns impersonating Coca-Cola and Ferrari use polished booking and careers pages to harvest credentials via fake login prompts and social-login pages. The Coca-Cola kit notably includes a fake Chrome window that relays credentials and MFA challenges in real time to an attacker-controlled backend, enabling account takeover; the Ferrari lure targets Facebook logins. #CocaCola #Ferrari
Keypoints
- Attackers impersonated major employers (Coca-Cola and Ferrari) using convincing scheduling and careers pages to lure job seekers.
- The Coca-Cola campaign used a fake in-page Chrome pop-up displaying a Google sign-in URL graphic to collect Google Workspace credentials.
- The Coca-Cola kit relays credentials to an attacker-controlled backend and polls that server every few seconds to dynamically serve MFA prompts, enabling real-time MFA bypass and account takeover.
- The kit explicitly blocks @gmail.com addresses, targeting corporate Google Workspace accounts for greater access and impact.
- The Ferrari campaign used a fake careers portal with an “Continue with Facebook” option to harvest Facebook credentials via an OAuth-style phishing flow.
- Job-market pressures and rising unemployment have increased the pool of vulnerable victims, and losses from employment scams have surged in recent years.
- Key defensive advice: be suspicious of unsolicited interview links, verify URLs and pop-up behavior, never enter passwords on scheduling pages, and immediately change credentials and revoke sessions if compromised.
MITRE Techniques
- [T1566] Phishing – Use of deceptive scheduling and careers pages to solicit credentials. (‘phishing campaigns impersonating major brands, including Coca-Cola and Ferrari’)
- [T1078] Valid Accounts – Harvested credentials and MFA codes are used to take over legitimate accounts and access corporate resources. (‘your credentials and any verification codes you entered have already been sent to the attacker’s server.’)
Indicators of Compromise
- [Domain ] backend server receiving stolen credentials – hrguxhellito281[.]onrender[.]com
- [URL ] displayed/faked login URL shown inside the fake browser window (graphic only) – https://accounts.google.com/signin/v3/ (displayed in the fake URL bar)
- [Name ] recruiter identity used in lure – “Tricia Guyer” (name on the fake Calendly scheduling page)