Cyber-security researchers from Have I Been Squatted carried out an analysis of how the attack worked and say the new wave of recruitment scams are hard to spot.
“This wasn’t a badly written email with a suspicious attachment – this person was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app,” said chief executive Juxhin D Brigjaj.
The case comes as others have reported similar attacks through the job listing platform Indeed, which put out advice in July about avoiding scams, external.
Criminals are using the pressure and excitement of job interviews to lure people into downloading booby-trapped mobile applications like a fake Indeed Interview app or one called MyInterview.
According to cyber-security company Malwarebytes, the fake recruiters use lures such as: “Complete your interview by installing the Indeed app” or “salary agreement available after app installation”.
Once downloaded the malicious apps allow hackers to access private data for extortion or to use in financial attacks.
“Interviewing through Indeed’s platform happens entirely in a browser and never requires downloading a special app,” Indeed recently posted online.
“Any message asking a job seeker to download an app to participate in an interview is not legitimate.”
