The Recruiter Who Only Wants Your Work Email

There is a category of message nobody reports, and it has nothing to do with how convincing the message is. Somebody at your organization is quietly looking. They have not told their manager, they have not told the person sitting next to them, and they check certain messages in the car before they come inside. When a note arrives from a recruiter at a company they would genuinely leave for, the last thing that occurs to them is to forward it to security and ask whether it looks legitimate, because doing that discloses something they have decided not to disclose. Attackers found that gap, and this month researchers documented what they built inside it.

What the Kit Actually Does

Zimperium’s zLabs published research on a campaign it tracks as RecruitTrap, and the detail that separates it from ordinary credential phishing is a filter on the phishing page itself.

What gets submitted is screened, and a personal email address is rejected. The kit wants a corporate address and will keep asking until it gets one, because a compromised work account carries OAuth tokens and reaches internal communications and cloud applications, while a compromised personal address reaches somebody’s takeout receipts.

The pages impersonate recruitment domains for employers including Amazon, Apple, Boeing, Deloitte, Emirates Group, Heineken, Lego, and Louis Vuitton. Every one of those is a company whose name in an inbox produces a small physical reaction in the person reading it, which is the selection criterion. Researchers published 46 previously unreported indicators of compromise, and the operational advice was to stop relying on desktop-focused web gateways and static blocklists.

Why It Runs on a Phone

The pages are built mobile-first for a structural reason. On a phone, a full-screen login page removes the browser furniture that a suspicious person would use to check it. The address bar collapses or disappears entirely, and what remains is a login form that looks exactly like every legitimate login form the person has ever completed on that device. The single most reliable verification habit anybody has, which is glancing at the domain, has been engineered out of the frame.

Then there is where the phone is. A work laptop sits inside your controls, on your network, behind your gateway, running your endpoint agent. The phone is in a kitchen at nine at night, on home wifi, and every technical control you own is somewhere else entirely.

The Part That Is Not Technical

I spend most of my time on the human side of these programs, and the reason this campaign is worth your attention is not the kit. It is the state the target is in.

A person considering leaving a job is carrying something they have decided to keep private, and the privacy is the vulnerability. Ordinary phishing defense depends on a social move, which is asking somebody else whether this looks right. Every one of your controls that works at all works because a person was willing to raise their hand. This attack is aimed precisely at the messages a person cannot ask about without revealing something they are not ready to reveal.

There is a second effect underneath it, which is that hope makes verification expensive. When somebody genuinely wants a message to be real, the mental cost of checking goes up, because checking carries a risk of finding out it is not real. That is how people are built rather than a lapse in competence or intelligence, and it applies to your most careful employees exactly as much as to anyone else. Your best engineer is not immune to wanting a job at a company they admire.

What Your Program Currently Teaches

Pull your awareness training and look for the module about a message you were hoping to receive. It is not there, because the curriculum is built around messages that ask for something, because that is where the field started: an invoice, a password reset, a gift card, an urgent request from an executive. The whole model teaches suspicion of demands. A recruiter message does not demand anything, it offers, and the emotional posture of a person reading an offer is not the posture the training was written for.

The same gap explains why your reporting numbers look healthy while this category never appears in them. People report the messages they were told to report, and nobody told them about this one.

Four Things That Actually Help

None of these is a product, and the first two cost nothing but a decision somebody senior has to be willing to make in public. The order matters, because the technical controls only ever catch what the cultural ones let people report.

Say out loud that job hunting is not a security offense

This is the whole ballgame, and it belongs to leadership. If people believe that forwarding a recruiter message will be read as notice of intent to leave, they will never forward one, and no amount of tooling recovers what that silence costs you.

Put it in writing somewhere people will actually see it. The message is simple enough: we would rather know about a fake recruiter than not, looking around is normal, and nothing you send to security goes to your manager.

Give people a rule that survives the emotional moment

Advice to be vigilant fails exactly when it is needed, because vigilance is the resource the attacker is depleting. A mechanical rule works better precisely because it does not require judgement in the moment.

The rule that fits here is that you never enter a work credential in response to any inbound message, ever, for any reason. A real recruiter has no use for your corporate password, and there is no legitimate flow in which one is needed. That rule is checkable without evaluating whether the sender seems genuine, which is the evaluation people cannot reliably make when they want the answer to be yes.

Treat the phone as in scope, because the attacker already does

Your gateway sees the laptop and your phishing simulation lands in the work inbox, while this campaign runs on a personal device through a channel your program does not touch. Closing that fully means mobile controls on the identity layer rather than the network, and closing it partly means at least admitting the gap out loud in training instead of implying that coverage is complete.

Watch for the session, not the login

Corporate credentials taken this way get used from somewhere else, and the authentication that follows will look correct because it is correct. We covered the same shape in Mirage2FA today, where a phishing service captured session cookies across thousands of organizations without ever defeating the second factor, and the detection problem is identical. Our piece on why resetting the password does not kill the session covers the containment half of this, and it is the half most incident plans get wrong.

The Uncomfortable Read

Here is what makes this campaign worth a conversation with your leadership team. The employees most valuable to an attacker are frequently the same ones most likely to be approached by a real recruiter, because seniority and access travel together and so do seniority and being headhunted. The filter rejecting personal email addresses is doing the targeting work for them, and everybody who submits a corporate address has self-identified as somebody worth keeping.

For the surrounding material, our work on behavioral security training beyond phishing clicks covers why click rates measure the wrong thing, and our guide to the psychology of oversharing covers how the information that makes an approach credible got public in the first place.

Ask Your Program One Question

Find whoever runs your awareness training and ask when they last wrote a lesson about a message somebody wanted to receive. The answer will be never, and that is not a criticism of them, because the entire field was built around unwanted messages and the threat moved. The organizations that close this gap first will be the ones where somebody in leadership was willing to say plainly that looking for another job does not make you a suspect.

Want to know how your people actually behave under a message they hope is real? Contact Grab The Axe for a behavioral security assessment, or start with our free Human Attack Surface Score.

Director of Behavioral Security Operations

Marie Welch

The Operational Backbone.

With a dual background in I/O Psychology (PhD Candidate) and Business Management (MBA), Marie bridges the gap between clinical rigor and operational strategy. She oversees B2B relations, compliance, and the 'business' of risk management.

View Author Page →