Phishing from Home, The Hidden Danger in Remote Jobs Lurking in Tesla, Google, Ferrari, and Glassdoor

Cofense PDC observed a Q3 2024 phishing campaign impersonating Red Bull, Tesla, Google, and Ferrari to target social media and marketing professionals using fake job applications and spoofed trusted domains. The attacks used brand-specific subdomains, realistic logos, multi-step credential harvesting (including fake Glassdoor, Facebook, and X login pages) and requested resumes to collect additional PII. #RedBull #Tesla #Ferrari #Google

Keypoints

Threat actors impersonated major brands (Red Bull, Tesla, Google, Ferrari) to lure job candidates via fake job application emails.
Emails were sent from a reused trusted sender pattern (messaging-service[@]post.xero[.]com) to increase deliverability and perceived legitimacy.
Phishing landing pages used brand-named subdomains, up-to-date logos, CAPTCHAs, and multi-step flows to mimic legitimate recruitment processes.
Credential harvesting paths included fake Glassdoor pages, spoofed Facebook login portals, and counterfeit X login pages depending on the campaign.
Red Bull campaign introduced a resume upload step to gather additional PII beyond basic contact details.
Attackers tailored URLs and page elements per brand (e.g., Tesla/Ferrari led to fake Facebook logins; Google redirected to fake X login offering Google/Apple options).
Cofense emphasizes detection via human intelligence, managed phishing detection and response, and notes that observed defenses may vary with configurations.

MITRE Techniques

[T1566] Phishing – Attackers sent spear-phishing emails impersonating Red Bull, Tesla, Google, and Ferrari to lure candidates (“…baits the candidate with an opportunity to apply to well-respected companies…”).
[T1598] Phishing for Information – Credential harvesting via fake Glassdoor, Facebook, and X login pages to collect email and social login credentials (“…prompts users to either enter their email credentials or log in through a spoofed Facebook portal designed to harvest Facebook login information”).
[T1189] Drive-by Compromise (Use of malicious links) – Use of tailored URLs and subdomains containing brand names to trick users into visiting phishing pages (“…tailors the initial URLs to each brand by using their name within the subdomain of the URL…”).
[T1204] User Execution – Social engineering language in emails (“No pressure at all, but I thought you might want to take a look,”) to encourage interaction and clicking links.
[T1078] Valid Accounts (Credential Access) – Collection of valid login credentials via fake login portals for Facebook, X, Google, and email to enable account access (“…either choose to login with their Facebook credentials or with their email address…then leads back to the fake Facebook login”).
[T1530] Data from Information Repositories – Collection of resumes and additional PII via fake application pages to gather detailed personal information (“…request for the candidate to upload their resume…allows for the threat actor to collect additional PII…”).
[T1562] Impair Defenses (Use of trusted third-party infrastructure) – Abuse of a trusted sender domain (post.xero[.]com) to improve deliverability and bypass filters (“…spoofing various brand names while using ‘messaging-service[@]post.xero[.]com’ as the from address…exploit its email infrastructure…”).

Indicators of Compromise

[URLs] Observed infection and payload URLs – hxxps://www[.]redbull[.]com@rebrand[.]ly/redbull-interview-booking, hxxps://study-socialmedia[.]com/workspace/apply, and hxxps://redbull-social-media-manager[.]job-apply-now[.]com/login_job (and additional job-apply-now subpages).
[Domains] Malicious domains used for landing and payload hosting – career-tesla[.]com, careers-ferrari[.]com, bck-2qw8[.]onrender[.]com, globe[.]anotherlevel[.]app.
[IP Addresses] Observed infrastructure IPs – 76[.]76[.]21[.]93, 66[.]33[.]60[.]35, 38[.]114[.]120[.]167, 216[.]24[.]57[.]252 (and several additional IPs listed for payload hosting).
[Email Sender] Spoofed/trusted sender address used in campaigns – messaging-service[@]post.xero[.]com (used to increase trust and bypass filters).
[File Upload/Artifact] Resume uploads requested – victims were prompted to upload resumes on fake Glassdoor pages to harvest additional PII (no specific file hashes provided).

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print