omnicom-hiring[.]com

This domain, omnicom-hiring.com, is an active credential theft operation designed to deceive job applicants by impersonating a legitimate recruitment portal. Visitors are presented with fake job application forms that harvest login credentials, personal information, and sensitive employment details. The site may also attempt to distribute malware under the guise of document uploads or interview scheduling tools. Individuals seeking employment with Omnicom or related agencies are the primary targets, with attackers likely using stolen data for identity theft, corporate espionage, or follow-on phishing attacks. Analysis indicates this infrastructure was registered on June 12, 2026, through Name.com, Inc., a registrar frequently abused for malicious domains. The domain resolves to 91.195.240.94, an IP address with a history of hosting phishing sites. As of the latest scan, 15 out of 95 security vendors on VirusTotal have flagged omnicom-hiring.com as malicious, while it appears on at least one security blocklist. The SSL certificate, issued by DigiCert Inc, is likely used to lend false legitimacy to the site, though this does not mitigate the underlying threat. The creation date in the future (2026) suggests either a typo or deliberate obfuscation to evade detection. If you or someone in your organization has visited omnicom-hiring.com, immediate action is required. First, disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Do not enter any credentials or upload documents, even if prompted. Reset passwords for any accounts accessed on the device, particularly those tied to job applications, email, or financial services, using a separate, secure device. Enable multi-factor authentication where available. Scan the device with updated antivirus software to detect and remove any downloaded malware. Report the incident to your IT security team or a trusted cybersecurity professional, and consider filing a complaint with relevant authorities, such as the FBI’s Internet Crime Complaint Center (IC3) or your local cybercrime unit. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and be cautious of follow-up phishing attempts via email or phone.