Spearphishing link to fake aerospace recruitment portal (teledyneflir.com.de-style lookalike)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects web proxy traffic containing links to lookalike recruitment portals using specific typosquatting suffixes (e.g., .com.de) and URL paths (/careers/auth). These patterns are linked to UNC1549, an adversary identified as targeting aerospace and defense organizations with fake React-based recruitment lures.