Phish of the Week 12th of October

# Phish of the Week

# Phishing

Google AI Team Opportunity

Mette Luntama

Phish of the Week: Fake Google AI Recruiter Uses Zoom Scheduler to Collect Ad Account Details

This recruitment phishing campaign impersonates a Google AI recruiter and is sent through Zoom Events, a legitimate event and webinar platform. It offers the recipient a Chief Marketing Officer role, then uses a real Zoom Scheduler page to collect personal details and find out which business ad accounts the recipient control, and sets up a second link that arrives later by email.

How the attack works:

The email arrives from a Zoom Events address, with a real Google employee’s name in the sender field. The subject line offers a “Chief Marketing Officer (CMO) Opportunity” at Google AI, and the body carries the Google logo.

The message praises the recipient’s “impressive track record in marketing leadership, brand strategy, and executive communications” and describes a senior role working with Google’s AI leadership on products such as Gemini. The signature uses the same name and a link to the real Google recruiter's LinkedIn profile.

The email offers two links: one to apply for the role and one to book a 30-minute introductory call. However, both links open the same page on the legitimate Zoom Scheduler platform, showing a calendar and a role description.

To book a time, the recipient fills in a form asking for their name, email address, phone number and LinkedIn profile. The form also asks which ad platforms the recipient manages, their monthly ad spend on each, and their experience with platforms such as Meta, Google Ads, TikTok and LinkedIn.

Before the booking can be completed, the recipient must agree to finish a “job application” as a mandatory first step. The form says that the link to this application will arrive in the confirmation email.

Why the attack works:

Every link in the email points to a real service. The sender address belongs to Zoom, the booking page is hosted on Zoom’s own site, and the signature links to a genuine LinkedIn profile. Checking where a link goes shows nothing suspicious here. The only false thing is the story itself.

How to spot similar attacks:

A recruitment email for a well-known company is sent from an event or scheduling platform, not from the company itself

The job offer is unsolicited and based on general praise rather than specific details of the recipient’s work

The role is far more senior than a typical cold recruitment message would offer

Early screening questions ask about business accounts, ad platforms or budgets the recipient manages before any interview has been conducted

If you receive an unexpected job offer from Google or any other company, verify the recruiter and the role through the company’s official careers page or a contact you find yourself before sharing any details.

What is Phish of the Week?

Phish of the Week is a weekly content initiative by Hoxhunt’s Threat Operations team. Each week, we highlight a current phishing trend or notable real-world attack, covering what the threat is, how it works, and what to watch for to spot similar attacks in the future. The goal is to build consistent recognition of evolving phishing themes and tactics over time.

Comments (0)

Popular