Charlie Kelly, a cybersecurity researcher at Have I Been Squatted, said the sophistication of these attacks makes recruitment scams difficult to analyze and detect.
“This wasn’t a badly written email with a suspicious attachment. This person was on a real Google page, behind a real Google login, making it look like a genuine job interview. The software they were asked to install was digitally signed, just like a legitimate application.”
The incident follows reports of similar job interview scams targeting users through the Indeed job platform. Read Indeed’s advice on how to avoid job scams, external.
Cybercriminals are exploiting the pressure and excitement of job interviews to convince applicants to download malicious mobile applications, including the fake Indeed Interview app and another app called MyInterview.
According to cybersecurity company Malwarebytes, fake recruiters use messages such as, “Install the Indeed app to complete your interview,” or, “Payroll is available after installing the app.”
Installing a malicious app can give hackers access to personal information, which may then be used for identity theft, extortion or financial fraud.
“Interviews conducted through Indeed’s platform take place entirely in your web browser and do not require users to download special software,” the company recently said online.
“Messages asking job seekers to download an app to participate in an interview are not legitimate.”
Source: www.bbc.co.uk