Fake Greenhouse / Lever ATS subscription payment failed, job postings suspended, applicant pipeline inaccessible, or hiring pipeline halted phishing

Phishing emails impersonating Greenhouse or Lever claiming the recruiting subscription payment has failed, job postings are suspended, the applicant pipeline is inaccessible, the hiring pipeline is halted, or candidates will not be able to apply for open positions — directing them to update billing or restore their subscription through a credential-harvesting portal. A distinct attack category targeting applicant tracking systems (ATS) that power the entire recruitment pipeline. Key facts: (1) Greenhouse serves 7,500+ paying customers (enterprise pricing, typically $6,000-30,000+/year) as the dominant ATS for high-growth tech companies and mid-market enterprises — Greenhouse is typically the central system that connects to LinkedIn Jobs, Indeed, company career pages, Slack interview coordination, and calendar scheduling; billing suspension that takes job postings offline affects every candidate-facing touchpoint simultaneously; (2) The 'candidates will not be able to apply' hook is uniquely high-stakes during active hiring campaigns: companies running recruiting pushes (aggressive headcount expansion, critical role backfills) are acutely sensitive to any disruption that could cost them a candidate — an ATS billing suspension during a hiring push means every inbound application from a job posting is lost; for companies paying $5,000-30,000/month to LinkedIn Recruiter and Indeed to drive candidates to job postings, losing the ability to capture those applications is immediately costly; (3) Lever serves 5,000+ customers ($3,000-25,000+/year) with particular strength in tech companies that value the Lever Nurture feature (CRM for keeping passive candidates warm) — Lever billing suspension locks not just active job postings but the entire candidate relationship database, preventing recruiters from nurturing passive candidates; (4) Greenhouse and Lever are typically integrated with every other HR system: HRIS (Workday, BambooHR), background check (Checkr), offer management (Docusign), and payroll onboarding (Rippling) — an ATS subscription suspension breaks all downstream integrations, meaning extended billing failure also delays onboarding for accepted offers; (5) Greenhouse and Lever credentials expose the complete hiring pipeline: every candidate resume, interview feedback from every hiring manager, salary negotiation details for every accepted offer, internal compensation bands (implied by offer history), and the company's talent acquisition strategy including which roles they are struggling to fill. Warning signs: sender not greenhouse.io/lever.co; genuine Greenhouse billing at greenhouse.io/billing; Lever billing at hire.lever.co/settings/billing.