Phishing Alert – Scammers using interviewer@careers-gotyto.com to phish job seekers
On October 23, 2024, Tyto Athene LLC became aware of a phishing scam targeting job applicants for a Technical Writing position. An individual or individuals (scammers) are posing as a Tyto Recruiter by the name of James Dean or Richard Wray from an email address URL of “inbound.gohire-mail.com“. These scammers are also using a reply to the email address of interviewer@careers-gotyto.com in the header and body of the email.
Tyto Athene is not associated with the careers-gotyto.com URL.
To be clear, none of Tyto’s systems have been hacked. The scammers have created accounts that appear to be similar to that of legitimate Tyto accounts. This is a phishing scheme to get personally identifiable information (PII), including individuals’ Social Security numbers from the applicants.
Action to take:
If you have received outreach from this address, do not click on any links and do not reply to the email. Tyto Athene further recommends reporting the email as Phishing to your email provider.
If you have already clicked on the email or responded this is what may happen:
In their email communication with potential candidates, the scammers ask individuals to download WebEx and create a WebEx account. After making the WebEx account, the scammers ask the individual to add their email to their messaging list at interviewer@careers-gotyto.com.
On October 25, 2024, we became aware that actual interviews had been taking place with these scammers, and false job offers were being extended to individuals. Additionally, individuals have been told they will be sent a $500 check along with their offer letter via UPS. If you do receive such a check, under no circumstances should this check be deposited into your account. This can be part of the scam.
Actions we have taken:
Tyto’s security team has reviewed the emails, forwarded to us, that the applicants have received. In the messages, the scammers are using a platform called gohire.io to email people (sent from). We have reported the phishing scam to gohire.io and have received no response from them to date. Additionally, the scammers appear to have created an account using Hirevire.com. We have reported the scam to Hirevire.com and have asked them to remove the scammer’s account and any data they collected. We have also reported the careers-gotyto.com domain to its registrar, Tucows.com. We have made WebEx aware. We have also reported the domain to the Federal Trade Commission.
More Information to keep yourself safe:
The Federal Trade Commission’s Guide for Job Ad Scams: Scammers are hijacking job ads. Here’s how to spot the fakes | Consumer Advice