A New Phishing Wave Hits Marketing Professionals
A sophisticated phishing campaign is making the rounds, and it has a very specific target: marketing professionals. The hook? Fake job offers from some of the world’s biggest brands. The goal? Stealing their Google accounts.
Security researchers have identified a sharp uptick in these attacks, which rely on a mix of social engineering and technical trickery to bypass even cautious users. If you work in marketing — or know someone who does — this is worth paying attention to.
How the Scam Unfolds
The attack starts with an email that looks legitimate. It appears to come from a recruiter at a well-known company — think Google, Amazon, or Meta. The subject line often mentions a job opening, a request for an interview, or an invitation to apply for a role that matches the target’s profile.
Curiosity gets the better of most victims. They click a link that supposedly leads to a job description or an application portal. But that’s where the trouble begins.
Nested Redirects: The Core Trick
Instead of taking the user straight to a phishing page, the link goes through a series of intermediate redirects. This technique, known as nested redirecting, makes it much harder for security scanners and email filters to detect the malicious destination. Each hop looks harmless on its own. By the time the user lands on a fake Google login page, the trail has gone cold.
The fake page is convincing. It mimics Google’s real sign-in interface, right down to the logo and the layout. The victim enters their email and password — and that’s it. The credentials are sent straight to the attackers.
Why Marketers Are Prime Targets
This isn’t random. Attackers are deliberately going after marketing professionals. Why? Because a marketing person’s Google account often holds the keys to the kingdom: Google Ads accounts, Google Analytics profiles, access to the company’s YouTube channel, and shared Google Drive documents filled with strategy and data.
One compromised account can give a criminal access to ad budgets, customer data, and internal communications. It’s a high-value target wrapped in a low-suspicion package — a job offer.
“Marketing teams are used to receiving unsolicited emails from recruiters. It’s part of the job,” says one cybersecurity analyst tracking the campaign. “That familiarity is exactly what the scammers are exploiting.”
Red Flags to Watch For
So how do you tell a real job pitch from a phishing attempt? Look for these signs.
- Check the sender’s domain carefully. A recruiter from a big brand will use a corporate email address — not a Gmail address or a lookalike domain with a typo (e.g., amaz0n-careers.com).
- Hover over links before clicking. See where they actually lead. If the URL looks strange or doesn’t match the company’s real website, don’t click.
- Beware of urgency. Emails that pressure you to act quickly — “Apply within 24 hours!” — are a classic phishing tactic.
- Never enter your Google credentials on a page you reached from an email link. Go directly to the company’s career page instead.
What to Do If You’ve Been Targeted
If you suspect you’ve clicked a malicious link, act fast. Change your Google password immediately. Enable two-factor authentication if you haven’t already — it’s the single best defense against credential theft.
Also check your Google Account’s recent activity and review any devices or apps that have access. Revoke anything you don’t recognize. If you use the same password on other sites, change those too. For more on staying safe, read our guide on how to spot phishing emails.
Report the phishing email to your company’s IT or security team. They can block the sender and warn others. You can also forward it to Google’s phishing reporting address: phishing@google.com.
The Bigger Picture
This campaign is a reminder that phishing isn’t just about fake bank alerts or Nigerian prince emails anymore. Attackers are getting smarter. They’re doing their homework, targeting specific roles, and using techniques like nested redirects to stay under the radar.
For marketing professionals, the lesson is simple: treat every unsolicited job offer with a healthy dose of skepticism. The promise of a dream role at a big brand could be the bait that costs you your account — and a lot more.
