Job seekers, particularly those in Gen Z, are falling victim to a new wave of sophisticated recruitment scams that trick them into downloading malicious mobile applications. These fake apps, disguised as tools for interviews or job applications, can grant attackers access to sensitive personal data, which is then used for extortion or financial attacks.
Cyber-security researcher Charlie Kelly of Have I Been Squatted described the attacks as particularly difficult to detect. "This wasn't a badly written email with a suspicious attachment," Kelly stated. "This person was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app."
Scammers are leveraging the pressure and excitement associated with job interviews to lure unsuspecting candidates. Tactics include messages like "Complete your interview by installing the Indeed app" or "salary agreement available after app installation." Once a fake app, such as a counterfeit Indeed Interview app or one named MyInterview, is downloaded, it can compromise the user's device.
Indeed, the job listing platform, has issued warnings about these scams. The company emphasized that interviews conducted through its official platform occur entirely within a browser and do not require the download of any special application. Indeed advises job seekers that any request to download an app to participate in an interview is a red flag.
Similar scams have been reported by users of other job listing platforms. Malwarebytes, a cyber-security company, noted that the fake recruiters exploit job seekers' desire for employment and potential salary information to coerce them into installing the compromised software. The company warns that these malicious apps can enable hackers to steal private data for extortion or financial fraud.