Fake Google Security Team job ad banned script reading, then printed the script

A job advertisement posted on Telegram by people recruiting callers for an apparent Google Security Team voice-phishing operation told applicants that reading from a script was forbidden. Two lines further down, the same message printed the exact script it expected those callers to read. The incident appears in the August 2026 edition of the Dark Web Roast, a monthly round-up from Trellix Advanced Research Center that uses memes and mockery to document criminals getting things wrong.

The ad that banned scripts, then supplied one

According to Trellix, the advertisement was posted in the UK Fraudsters Telegram channel by a user the company identifies as Derian (@crɑick). Headed "Hiring - Female/Male Mail Callers", the listing sought "USA/CA (white sounding)" applicants and stated in bold: "NO SCRIPT READING". The post then reproduced the script itself: "Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with Larry Boyles?" Trellix analysts called the "recorded line" flourish a nice touch, "because nothing says legitimacy like a fraudster cosplaying compliance theatre". The same report also covers a crypto-exchange operator who answered a ban by cloning himself into more than ten "independent" storefronts sharing one server, and a ransomware crew that billed a 217.8 MB leak as 217.8 GB.

Why a shoddy job ad still matters

Voice phishing is not a fringe problem. Google reported that vishing surged last year to become the second most common method criminals use to gain initial access to a victim's IT estate, and the leading tactic when breaking into cloud environments. The FBI's Internet Crime Complaint Center (IC3) logged its most damaging year for internet scams, with reported losses of $20.87 billion in 2025. Demand for English-language social engineering skills is climbing on underground forums as well: security firm ReliaQuest found that job advertisements mentioning that talent more than doubled between 2024 and 2025. Trellix states in the same report that while the incidents are genuinely amusing, "they represent real criminal activities causing significant harm".

Roasting criminals instead of glorifying them

Trellix VP of threat intelligence strategy John Fokker told The Register that the series grew out of a desire for an "almost psyops" approach to covering the criminal underground: "We don't want to glorify them, what's the opposite we can do? We're going to roast them." The goal, he said, is to spark a healthier conversation about how the industry describes threat actors, who are "just individuals, they just use computers, and they just want to steal your data and make money".