Sublime’s Attack Spotlight series is designed to keep you informed of the email threat landscape by showing you real, in-the-wild attack samples, describing adversary tactics and techniques, and explaining how they’re detected. These attacks can be prevented with a free Sublime account.
EMAIL PROVIDER: Google Workspace, Microsoft 365
ATTACK TYPE: Credential Phishing
Recently, we’ve been detecting variations of a scam that uses a Google Careers impersonation to phish credentials. The scam is simple. An adversary sends an “are you open to talk?” message impersonating an outreach email from Google Careers. If the target clicks the link, they’re taken to a landing page designed to look like a Google Careers meeting scheduler. From there, they’re taken to the phishing page.
What makes this attack particularly interesting is that it is in active development. We have observed threat actors refining and adjusting their tactics and techniques over time, evolving to evade detection. In this post, we’ll take a look at the attack and its variants.
The message
This attack begins with a message impersonating a Google Careers outreach about a job opening:
Language variation
Most noticeably, the attack was sent across multiple languages. The majority were English, but there were also Spanish, Swedish, and many other variants:
Swedish variant
Spanish variant
Sender variation
The message comes from an impersonated talent recruiter or recruiting department. Here are some examples:
Within that set of senders, we also saw multiple cases of service abuse or compromise for message delivery. Abused services included Salesforce, Recruitee, Addecco, Muckrack, and more.
Payload link variation
The Book a Call button leads to a URL that also has a hiring-themed subdomain and Google Careers-themed root domain, although they did not always match the sender’s domain. Here are examples of some of the malicious links:
apply.gcareersapplyway[.]com
hire.gteamshiftline[.]com
hire.gteamjobpath[.]com
hire.gteamcareers[.]com
recruit.gcareerspeople[.]com
recruit.gcareerscrewfind[.]com
recruit.gcareerscandidatelink[.]com
schedule.ggcareerslaunch[.]com
We observed that the domains were all recently registered, and mostly through NiceNIC. Some were also registered through Porkbun.
HTML word padding evasions
We observed an interesting evasion tactic in later attacks. In the cases, the attackers broke up the words “Google Careers” with HTML formatting to evade text scanners.
In one case, they put every letter of “Google” into its own <label> element, effectively breaking up the word into six labels, not one word:
In another, the attacker did similar formatting using <p> elements:
Two analyses prevent this evasion from being effective against Sublime:
Sublime strips out the HTML wrappers during text analysis. The above examples render as GoogleCareers and G o o g l e Career, respectively.
Sublime takes a screenshot of messages and applies Optical Character Recognition (OCR), seeing what the end user sees (and ignoring hidden characters).
The payload workflow
In almost all cases, after clicking on the Book a Call button, the target is taken to either a real or impersonated Cloudflare Turnstile page:
Impersonated Cloudflare Turnstile
After confirming human status, they are then taken to a spoofed Google Careers meeting scheduling page. Here, there name, email, and phone number are all phished.
Fake Google Careers meeting scheduler
After clicking Save & continue, they are taken to the password phishing phase of the attack. It is a standard fake login page as seen in most Google credential phishing attacks:
Fake Google login page
Indicators of C2 infrastructure
Modern credential phishing attacks typically use Adversary in the Middle (AITM) infrastructure to automate the validation and theft of credentials. In the case of this attack, though, it appears to be using a C2 server.
We saw a few variants of C2 implementations. Below is one we saw that used satoshicommands[.]com and shows indications of iteration. We’ve included comments to explain the code inline as necessary.
The C2 connection starts when the user visits the “Schedule a Meeting” page. The HTML includes the below snippet which sets up the variables used by the C2 server:
The following JS code was the response body for https://apply.gcareerhub[.]com/assets/js/main.js?v=24. Here are the relevant components of the .js file:
This back and forth between the browser and gw.php is indicative of backend processing by the threat actor while stepping the target through the phishing kit.
Personal address filtering
Another interesting artifact we noticed in some attacks was the filtering out of non-business emails. Below is a code snippet used to filter and the response from the form:
Business email validation
IOCs
Here is a non-exhaustive list of Indicators of Compromise (IOCs) from a selection of attacks.
Sublime's AI-powered detection engine prevented these attacks. As there were variations over time, here are some of the top signals shared across attacks:
Brand impersonation: These messages impersonated Google Careers, but were delivered on non-Google Careers infrastructure.
Domain deception: Links to domain that mimics Google branding but is not a Google domain (ex: gteamcareers[.]com).
Newly registered domain: The sender and/or links within the message use domains that were registered within the past 30 days.
Suspicious sender domain: Misalignment between claimed sender identity (Google Careers) and actual sender domain (varied).
Response urgency: Job offers came with vague details, but required immediate action (scheduling a call).
Deceptive recruitment outreach: Follows typical job scam patterns with flattering language and limited specifics.
ASA, Sublime’s Autonomous Security Analyst, flagged these emails as malicious. Here is ASA’s analysis summary for one of the messages:
See through impersonations
Adversaries will impersonate trusted sites and services to improve their chances of success. That’s why the most effective email security platforms are adaptive, using AI and machine learning to shine a spotlight on seemingly minor discrepancies.
If you enjoyed this Attack Spotlight, be sure to check our blog every week for new blogs, subscribe to our RSS feed, or sign up for our monthly newsletter. Our newsletter covers the latest blogs, detections, product updates, and more.
Brandon is a Threat Detection Engineer at Sublime. He is a seasoned cybersecurity professional with over a decade of experience protecting internet users. Prior to Sublime, Brandon put his detection engineering expertise to use as a Sr. Staff Threat Analyst at Proofpoint.
Get the latest
Sublime releases, detections, blogs, events, and more directly to your inbox.
Thank you!
Thank you for reaching out. A team member will get back to you shortly.
Oops! Something went wrong while submitting the form.
Related Articles
December 29, 2025
Sublime news
5 email security trends from 2025
Brian Baskin
Threat Research
December 18, 2025
Sublime news
How to build fast similarity search for email from the ground up
Email security refers to protective measures that prevent unauthorized access to email accounts and protect against threats like phishing, malware, and data breaches. Modern email security like Sublime use AI-powered technology to detect and block sophisticated attacks while providing visibility and control over your email environment.
Now is the time.
See how Sublime delivers autonomous protection by default, with control on demand.
.svg){kind=icon}
.svg)
.svg)
