Google Impersonation Scam Exposes Phishing Script in Recruitment Ad
Cybercriminals contradict themselves by banning script reading while providing the exact phishing script.
1Contradictory phishing recruitment
A Telegram ad recruiting for a fake Google Security Team explicitly stated 'NO SCRIPT READING' while simultaneously providing the exact script callers must use. The script begins with 'Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team.' This contradiction highlights the often sloppy operational security of cybercriminal groups, despite their sophisticated social engineering tactics.
2Trellix's mockery approach
Trellix Advanced Research Center's Dark Web Roast initiative uses humor and memes to expose criminal blunders. Their August report featured this Google impersonation scam among other examples where criminals undermined their own operations. While entertaining, Trellix emphasizes these incidents represent serious crimes causing real harm, with voice phishing becoming the second most common initial access method for cybercriminals.
3Social engineering demand surge
The FBI's IC3 reported record cybercrime losses of $20.87 billion in 2025, with English-language social engineering skills highly sought on underground forums. ReliaQuest data shows job ads mentioning these skills more than doubled from 2024 to 2025. Google reports voice phishing became the top tactic for breaching cloud environments, explaining criminals' need to recruit English-speaking callers.
4Psychological warfare strategy
Trellix VP John Fokker describes their Dark Web Roast as an 'almost psyops' approach against cybercriminals. Instead of glorifying threat actors, they publicly mock operational failures to demystify criminals. Fokker emphasizes these are ordinary people without superpowers, just using computers to steal data - a perspective shift for the security industry.
5Compliance theater in scams
The phishing script's inclusion of 'on a recorded line' demonstrates criminals' understanding of psychological triggers that suggest legitimacy. Trellix analysts note this 'compliance theater' makes scams more effective, even as the recruitment process remains amateurish. Such details reveal how criminals balance sophistication with operational vulnerabilities in their schemes.
6Targeted recruitment criteria
The ad specifically sought 'USA/CA (white sounding)' applicants, showing criminals' awareness of demographic targeting in social engineering. This precision in victim profiling contrasts with the ad's obvious contradiction about script usage, illustrating the uneven professionalism in cybercriminal operations where some elements are carefully planned while others are neglected.
7Industry-wide impact
With voice phishing now the second most common attack vector overall and first for cloud breaches, such recruitment efforts directly impact enterprise security. The Telegram ad represents just one thread in a growing ecosystem of specialized cybercrime labor markets, where different roles (callers, hackers, money mules) are recruited separately to streamline operations.
8Changing threat intelligence
Trellix's unconventional approach reflects evolving strategies in threat intelligence. By combining rigorous analysis with public mockery of criminal mistakes, they aim to both inform defenders and psychologically impact attackers. As Fokker notes, this method sparks industry conversations about balancing technical defense with psychological countermeasures against social engineering.