Jobseekers are being warned to be vigilant as scammers are targeting people on job listing websites to trick them into downloading bogus interview tools.
One victim was invited on LinkedIn by a fake recruiter to take part in a job interview process and downloaded a seemingly normal document that turned out to be malicious software.
Within hours, the hackers had drained £18,000 from his cryptocurrency accounts and disappeared.
“It’s a horrible feeling to be out a substantial amount – something I wouldn’t wish on my worst enemy,” the victim, who wanted to stay anonymous, said.
Crowded and competitive job market
Professional recruitment platforms LinkedIn and Indeed have warned of growing numbers of job scams in recent months.
LinkedIn released data highlighting what it called The Gen Z “Scam Gap” – “Younger professionals face the highest exposure to scams (32%), yet nearly a third (32%) admit to ignoring red flags due to a competitive job market.”
When approached by the BBC, the company said that in a crowded and competitive job market, “many young people feel they can’t afford to be sceptical… because they feel opportunities are so scarce”.
The platform pointed to advice on its website about how to spot recruitment scams by, for example, verifying that the company and job was real and doing thorough research before engaging in talks.
The victim who lost their savings after being hacked had handed in their notice and had made it clear on LinkedIn that they were looking for a new job.
A fake recruiter sent them a potential job offer and held a video call about it before asking them to complete a standard technical assessment using instructions in a Google Sheet.
But the document was laced with malicious software.
After completing the task, the candidate went to bed and woke up to find their online wallets emptied of their savings.
“I wiped my computer and changed all my passwords and was emotionally and mentally drained,” they said.
“I felt a mixture of disbelief and anger – at the hackers and at myself. I was also confused until I figured out how they had got me.”
Fake recruiters and malicious apps
Cyber-security researcher Charlie Kelly from Have I Been Squatted carried out an analysis of how the attack worked and said the new wave of recruitment scams were hard to spot.
“This wasn’t a badly written email with a suspicious attachment – this person was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app.”
The case comes as others have reported similar attacks through the job listing platform Indeed, which put out advice in July about avoiding scams.
Criminals are exploiting the pressure and excitement of job interviews to lure people into downloading booby-trapped mobile applications, such as a fake Indeed Interview app or one called MyInterview.
According to cybersecurity company Malwarebytes, fake recruiters use lures such as “Complete your interview by installing the Indeed app” or “salary agreement available after app installation”.
Once downloaded, the malicious apps allow hackers to access private data for extortion or to use in financial attacks.
“Interviewing through Indeed’s platform happens entirely in a browser and never requires downloading a special app,” the company recently posted online.
“Any message asking a job seeker to download an app to participate in an interview is not legitimate.”
DISCLAIMER: The Views, Comments, Opinions, Contributions and Statements made by Readers and Contributors on this platform do not necessarily represent the views or policy of Multimedia Group Limited.
Tags:
DISCLAIMER: The Views, Comments, Opinions, Contributions and Statements made by Readers and Contributors on this platform do not necessarily represent the views or policy of Multimedia Group Limited.
