Unit 42 identifies a recruitment phishing campaign targeting senior professionals via impersonation and fraudulent resume fees.

Unit42 is a cybersecurity research team known for its  analysis of cyber threats, malware, and cyber attack trends. Through research reports, threat intelligence briefings, and data analysis, Unit42 offers insights into emerging cyber threats and adversary tactics. Readers can learn about threat detection methodologies, vulnerability trends, and cyber attack attribution to enhance their cybersecurity posture and protect their organizations from advanced cyber threats.

Unit 42

Unit 42 has tracked a recruitment phishing campaign since August 2025 where attackers impersonate Palo Alto Networks talent acquisition staff. Using scraped LinkedIn data, they target senior professionals with personalized emails, then manufacture a fake bureaucratic barrier claiming the candidate's resume failed ATS requirements. Victims are directed to pay $400–$800 for fraudulent 'executive ATS alignment' or resume rewrite services. Guidance includes verifying sender domains, never paying fees during recruitment, cross-referencing recruiters on official platforms, and reporting suspicious contacts. Indicators of compromise including Gmail addresses and phone numbers linked to Nigeria are provided.

Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team

Palo Alto Networks Product Protections for This Activity