The technique works because it maps cleanly onto a plausible part of the recruitment process. A fake employer contacts a jobseeker, instructs them to download an app — ostensibly to complete an online interview or verify their identity — and the app either is or delivers malware.
Malwarebytes analysed one such app, named MyInterview, and found it functions as a Trojan dropper: an app that appears functional but installs further malware once granted access. The final payload the researchers observed was spyware. Victims in some cases are also told to connect to a VPN and grant Android Accessibility permissions. Once accessibility access is granted, the malware can actively resist removal.
The campaign exploits the credibility of Indeed as a platform without originating from it. Indeed itself has flagged this attack pattern, stating publicly that it will never ask users to install an APK file delivered directly to them, and maintaining a help page listing fake app names including “Indeed Interview” and “Indeed Hiring.”
The scam’s effectiveness comes partly from context: jobseekers expect contact from employers they don’t know, they’re motivated to respond quickly when an interview appears to be at stake, and downloading an app as part of an onboarding process is increasingly normalised. That combination makes the social engineering straightforward.
Malwarebytes’ findings connect several independent reports of the technique, suggesting it is being used at some scale rather than in isolated incidents. The UK cases the company documented sit within a broader pattern. The Home Office’s most recent national fraud assessment identifies tech-enabled social engineering as a growing vector, and the Disclosure and Barring Service has previously issued specific warnings about recruitment-based scams targeting jobseekers.
The practical advice is unchanged: never install an APK file sent directly during a recruitment process, verify app authenticity through official app stores, and treat any request to grant Accessibility permissions with significant caution.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
