MIL Email Publisher (NZ)

Article by Ondrej Mokos, Threat Analysis Engineer at Gen

Scammers are creating fake hiring pages that impersonate major brands, including FIFA, to steal login credentials. These pages imitate real recruiting flows, with recruiter profiles, calendar invites, and familiar sign-in buttons. In this investigation, our threat researchers examine this recruitment scam pattern and share their findings, alongside hints on staying protected.

As excitement builds around the 2026 World Cup, scammers are exploiting FIFA’s trusted brand to target unsuspecting victims. But while many fraudsters are leveraging the hype through World Cup ticket scams, others take a different route: fake job opportunities.

Threat researchers at Gen (the company behind Norton) are finding fake hiring pages that impersonate FIFA, as well as other well-known brands, in order to phish for login credentials. These polished pages use familiar elements such as a recruiter profile, a scheduling prompt, and a “Continue with Google” button, making them more believable than clumsy pop-ups or email spam.

According to the Netsafe State of Scams Report, employment and impersonation scams are rising sharply across New Zealand, contributing to estimated national scam losses of roughly NZ$3 billion annually in 2025.

How these recruitment scams work

From the job seeker’s perspective, these recruitment scams often look like a routine step in the hiring process. You click a link and land on a branded recruitment page that shows FIFA’s logo, a recruiter profile, and a prompt to schedule an interview or introductory call.

In some cases, the “recruiter’s” name and picture are lifted directly from the public LinkedIn profile of a real person, adding a veneer of legitimacy.

The page then prompts you to sign in using a familiar option, usually your Google account. Some versions even reject personal email addresses and request business credentials instead. For scammers, corporate accounts are far more valuable, as they can provide access to company systems, internal files, and coworkers who can be targeted next – potentially leading to broader data breaches.

Once you enter your login details, they go straight to the scammers. The page looks routine, but the goal is simple: to move you from “interested in a job” to “entering credentials” with as little friction as possible.

Revealing your Google login credentials could expose you to account compromise, data theft, identity theft, and follow-up scams targeting your contacts or coworkers.

Behind the scam: What our threat researchers found

When Norton threat researchers investigated these fake FIFA hiring pages, they found pages that look polished on the surface but display major warning signs under closer inspection. Here’s an in-depth look at one such fake job posting.

The first clue was the domain. The fake page didn’t sit on FIFA’s official hiring web domain. Instead, it lived on fifahiring[.]com, which combines FIFA’s name with a hiring-related term to look legitimate.

Other examples our threat researchers found included careers-fifahiring[.]com and fifajobs[.]com. These pages are often ephemeral: when they’re taken down, they’re quickly replaced by new scam pages with similarly spoofed or typosquatted domains.

Security tip: FIFA’s only legitimate hiring pages at the time of writing are jobs.fifa.com and fifa.pinpointhq.com. Any other website claiming to offer FIFA jobs or recruitment opportunities is likely to be fraudulent.

Other technical signals raised concern. The domain and certificate were newly created, and the site used common web-hosting services such as Vercel and Render instead of infrastructure that looked like a corporate hiring environment.

But the clearest red flag was the sign-in experience. The Google sign-in prompt was not a real Google authentication window. It was rendered inside the page itself, meaning the user never actually left the fake hiring site for a Google-controlled login page. The visible buttons and links did not work as expected, and the page appeared to load only Google’s favicon (the small browser icon representing Google) to make the fake login box look familiar.

The smoking gun? Login details were sent to a malicious domain not connected to Google or FIFA – meaning any data entered was exfiltrated straight to fraudsters.

Examples beyond FIFA

When our threat researchers investigated further, they found that these fake recruitment pages extend well beyond FIFA imitations, affecting at least a dozen employers. The brands varied, but the setup stayed largely the same: The scam page impersonates a trusted company, urges job seekers to schedule a meeting, and pushes them toward a fake sign-in step.

Since May 1, 2026, Gen products, including Norton, have blocked these recruitment scam attacks more than 250 times, according to internal product data, although the true scale of the problem remains unknown. New malicious URLs are being created as quickly as others can be taken down.

These recruitment pages were found impersonating companies including:

Aquent.
Coca-Cola.
Delta.
Hays.
Heineken.
Hilton.
Netflix.
PepsiCo.
Spotify.

Some examples varied slightly from the main pattern. For instance, a few used a fake Facebook sign-in button instead of a fake Google sign-in button.

How to spot fake recruitment pages before you enter credentials

A polished hiring page does not prove a job is real. Scammers can copy logos, photos, job language, and sign-in buttons from legitimate sites. And, thanks to AI, malicious websites are becoming disturbingly easy to create – giving rise to what our threat researchers have dubbed “VibeScams.”

Before entering your email or password, pause and check the page itself. Look for warning signs like these:

• The domain does not match the company’s official careers site.
• The web address adds words like “jobs,” “careers,” “hiring,” “talent,” or “opportunities” around a brand name.
• The page pushes you to provide a business email before you have verified the job.
• The sign-in box appears inside the hiring page instead of opening on the real Google, Microsoft, Facebook, or LinkedIn domains.
• Since the sign-in box is fake, your password manager won’t recognise it and won’t autofill your login credentials – which is another security advantage of password managers.
• Buttons, links, or menu items on the sign-in window do not work.
• The job page came from an unsolicited message, social post, or ad.
• The page pressures you to schedule quickly or uses urgent language.

The safest way to check a job page is to start from the company’s official website. Do not rely only on a link someone sent you. Enter the company’s URL directly into your browser’s address bar and find the careers page from there. In some cases, even a Google search may surface fraudulent results, because scammers can use SEO poisoning tactics or paid ads to place fake job listings near the top of search results.

What to do if you fell for a recruitment phishing scam

If you entered a password on a fake recruitment page, act quickly:

• Change the password for the account you entered. If you reused that password anywhere else, change it there too. Then touch up on password security basics.
• Check your account recovery settings for new emails or phone numbers you don’t recognise. To do this on Google, tap your profile icon, tap Manage your Google account, then Security & sign in. Check that the Recovery phone and Recovery email are yours. If a scammer added their own recovery option, they may be able to reset your password even after you change it.
• Check if unknown devices are logged in to your account: Review the list of devices currently signed in to your account and log out of any you don’t recognise. On Google, you can find this under Security & sign in – scroll to Your devices to see where you’re signed in and remove anything suspicious.
• Turn on multi-factor authentication: Enable 2FA or MFA for potentially affected accounts. This can help prevent someone who has your password from gaining access to your accounts, as they’ll need an extra code sent to your SMS inbox or authenticator app.
• Report it to your employer’s IT or security team if you entered a work email or work password. They can help secure the account and check for suspicious activity.
• Watch for follow-up scams from people pretending to be recruiters, HR staff, background-check companies, or payroll teams.
• Be careful with requests for sensitive information, including ID documents, tax forms, bank details, or payments for training and equipment.
• Report the fake page to the platform where you found it, the impersonated company, and the relevant fraud reporting authority in your country.

What this all means for consumers

Fake job postings are a reminder that job scams are not limited to suspicious emails or too-good-to-be-true offers: some now look like ordinary hiring pages from trusted brands. The FIFA example is timely, but the lesson is broader: any major brand can be copied, a recruiter profile can be faked, and a familiar sign-in button can be used as bait.

Knowing who to trust online can feel increasingly difficult, which is why AI-powered scam protection is so helpful. These tools add an extra layer of security to your digital life, helping flag suspicious links, malicious websites, and scammy messages.

“Exercise professionals are often among the few health and wellbeing professionals that people see frequently….

“At 67%, mental wellbeing is the second most popular reason Kiwis exercise, behind only overall health at 78%…”  

“Exercise is shown to improve mood, reduce stress, and build resilience, but it can also create something equally important, connection… We want men to know that it's okay to talk about how they're feeling and to seek help when they need it.”

As Aotearoa marks Men's Health Week and Men's Mental Health Month this June, ExerciseNZ is encouraging Kiwi men to prioritise their mental wellbeing and reminding New Zealanders that regular physical activity remains one of the most accessible and evidence-based ways to support positive mental health.

The message comes at a time when mental wellbeing remains a significant challenge across New Zealand. Recent data from the Ministry of Health and the Mental Health and Wellbeing Commission shows that one in seven adults experienced high or very high psychological distress.

For men, the challenge is particularly concerning. Around three-quarters of suicides in New Zealand are men, and recent provisional figures show 474 male suspected self-inflicted deaths in 2024/25 compared with 156 females.

________________________________

ExerciseNZ Chief Executive Richard Beddie says while exercise is not a replacement for professional mental health treatment, it is one of the most accessible and evidence-based tools available to support mental wellbeing.

“Exercise professionals are often among the few health and wellbeing professionals that people see frequently. They create trusted relationships, provide social connection, encourage healthy habits, and help people build confidence through movement.”

Research consistently shows that physically active people experience better mental wellbeing and lower rates of anxiety and depression. ExerciseNZ's own consumer research has repeatedly shown that improving mental wellbeing is one of the leading reasons New Zealanders exercise, with many gym and exercise facility members reporting reduced stress, improved mood, increased energy levels, and stronger social connections as key benefits of regular participation.

Additionally, ExerciseNZ research shows that Kiwis understand the importance of exercise when it comes to mental health.

“At 67%, mental wellbeing is the second most popular reason Kiwis exercise, behind only overall health at 78%. That's a positive sign, showing New Zealanders increasingly understand that exercise isn't just about physical fitness, it's also one of the most effective ways to support mental health and wellbeing”, says Beddie.  

________________________________

Importantly, exercise facilities provide more than exercise alone. They offer community, routine, accountability, and opportunities for social interaction, factors known to support mental wellbeing and reduce feelings of isolation. ExerciseNZ believes that movement is one of the simplest and most effective starting points. Beddie concludes;

“Exercise is shown to improve mood, reduce stress, and build resilience, but it can also create something equally important, connection. Sometimes the conversation that starts during a walk, a workout, or after a class can be the first step towards getting support. We want men to know that it's okay to talk about how they're feeling and to seek help when they need it.”

ExerciseNZ is encouraging employers, communities, whānau, and health professionals to use Men's Mental Health Month as an opportunity to start conversations around supporting the overall health and wellbeing of men in Aotearoa through exercise.

10 June 2026 – The Reserve Bank of New Zealand – Te Pūtea Matua welcomes the High Court's decision to impose a civil pecuniary penalty of $6.731 million on ASB Bank Limited for seven breaches of the Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) Act 2009.

This is the highest AML/CFT penalty ever imposed by the Court in New Zealand. ASB is one of New Zealand's largest banks and this penalty reflects the seriousness and prolonged nature of ASB's non-compliance.

Banks are exposed to a high risk of money laundering and terrorism financing, and transaction monitoring plays a critical role in banks' AML/CFT programmes. In this case, ASB's transaction monitoring system and AML/CFT programme were inadequate for approximately six years, which is unacceptable.  

“Transaction monitoring is a key pillar to detect money laundering and terrorism financing. It is incumbent on banks to ensure their systems and processes are robust and sufficiently recognise and mitigate these risks,” Acting Assistant Governor Financial Stability Angus McGregor says.

“The AML/CFT Act plays an important part in maintaining and enhancing New Zealand's international reputation and contributing to public confidence in our financial system. Non-compliance with transaction monitoring and reporting requirements denies New Zealand intelligence agencies crucial time-sensitive information that is needed to detect and deter money laundering and terrorism financing from impacting New Zealand communities,” Mr McGregor says.

Following an investigation, the Reserve Bank commenced proceedings against ASB in December 2025. ASB cooperated with the investigation and admitted to all seven breaches of the AML/CFT Act including failures to:

establish, implement, or maintain an AML/CFT programme relating to customer due diligence requirements;
establish, implement, or maintain an AML/CFT programme relating to requirements to manage and mitigate the risks of money laundering and terrorism financing;
establish, implement, or maintain an AML/CFT programme relating to monitoring and managing compliance with ASB's procedures, policies, and controls;
adequately conduct ongoing customer due diligence on foreign trust customers;
report suspicious activities within the time required;
conduct enhanced customer due diligence; and
terminate business relationships when required.

This is an important reminder of the essential role of banks in maintaining the integrity and reputation of New Zealand's financial system. In this case, ASB failed to meet this expectation.

In determining its enforcement response, the Reserve Bank applied its Enforcement Framework which is available on the Reserve Bank's website.

More information

• Full Judgment
• Settlement Agreement
• Enforcement Framework
• How we regulate banks to ensure they meet their obligations under the AML/CFT Act