OTX Threat: Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials

A sophisticated multi-stage phishing operation has been active since April 2025, systematically exploiting legitimate SaaS platforms and cloud services to steal corporate credentials. The campaign utilizes 232 phishing domains and 80 command-and-control servers, primarily impersonating human resources consulting firms, with Robert Half Inc. and Aquent LLC representing 50% of targeted brands. Attac Sectors: Human Resources, Aerospace, Technology