Thought Leadership
Security researchers at Malwarebytes warn of fake job postings on the major job platform Indeed.
According to the researchers, the perpetrators pose as recruiters and, after initial contact, urge affected individuals to install a special app for the alleged application process, for instance citing reasons such as an identity verification being required or a salary agreement only being unlocked after installation. The app is not available in the Google Play Store; instead, the criminals specifically direct their victims to manually download it from an unknown source. Malwarebytes classifies the app as a so-called Trojan dropper, an initial malicious component whose actual purpose is to subsequently install further malware, in this case spyware, on the victim’s device.
The installed spyware can give criminals control over infected devices. According to Cybernews, no direct financial losses have been reported so far in connection with the scam; however, one affected individual publicly reported on the online forum Reddit that his smartphone was completely compromised. His bank advised him to reset it to factory settings because repeated attempts had been made to lock him out of his own account, and ultimately he even had to purchase a new device because he remained permanently locked out due to broken two-factor authentication.
Fake Indeed app actively prevents its own uninstallation
Malwarebytes also confirmed that the malware can specifically prevent itself from being uninstalled: If a user attempts to remove the app via the Android settings, the malicious application independently forces the screen back into the foreground. The researchers advise following a simple basic rule.
“A job interview should never require sideloading an Android app, enabling a VPN connection, or installing software from an unknown source.”
Malwarebytes
Job offers should also always be verified via an additional, independent channel, and apps should generally not be installed simply because a counterparty in the application process explicitly requests it.
(Editorial Team)
