Jobseekers are being urged to remain vigilant as scammers increasingly target people using online recruitment platforms, using fake job opportunities to trick candidates into downloading malicious software.
According to the BBC, one victim was approached on LinkedIn by a fake recruiter and invited to take part in what appeared to be a genuine hiring process. After a video interview, the candidate was asked to complete a routine technical assessment using a document that looked legitimate.
The file, however, contained malicious software. Within hours, hackers had accessed the victim’s cryptocurrency accounts and stolen £18,000 in savings.
“It’s a horrible feeling to be out a substantial amount — something I wouldn’t wish on my worst enemy,” the victim, who asked to remain anonymous, told the BBC.
Growing risks in a competitive job market
Professional recruitment platforms such as LinkedIn and Indeed have warned users about an increase in recruitment scams.
LinkedIn recently published research highlighting what it described as the Gen Z “Scam Gap”. The platform found that younger professionals reported high exposure to scams, while many admitted to overlooking warning signs because of the increasingly competitive job market.
LinkedIn told the BBC that many young jobseekers feel they cannot afford to be overly sceptical because genuine opportunities can appear scarce.
The company advises candidates to verify that both the employer and the advertised position are genuine, and to conduct thorough research before entering into discussions with recruiters.
A convincing fake recruitment process
The victim featured in the BBC report had resigned from their previous job and updated their LinkedIn profile to show that they were looking for new employment.
A fake recruiter subsequently contacted them with what appeared to be a genuine job opportunity. After a video call about the position, the candidate was asked to complete a standard technical assessment using instructions provided through a Google Sheet.
The document was used to deliver malicious software.
After completing the assessment, the candidate went to bed. The following morning, they discovered that their online cryptocurrency wallets had been emptied.
“I wiped my computer and changed all my passwords and was exhausted emotionally and mentally drained,” the victim told the BBC.
“I felt a mixture of disbelief and anger — at the hackers and at myself. I was also confused until I figured out how they had got me.”
Cybersecurity researchers from Have I Been Squatted analysed the attack and said that modern recruitment scams can be particularly difficult to identify.
“This wasn’t a badly written email with a suspicious attachment,” chief executive Juxhin D Brigjaj told the BBC. Instead, the victim was taken through what appeared to be a legitimate interview process using genuine Google pages and a real Google login. The software they were asked to install was also digitally signed, making it appear legitimate.
Fake interview apps used to target candidates
The BBC report comes amid warnings about similar scams affecting users of Indeed.
Cybercriminals have reportedly been exploiting the pressure and excitement surrounding job interviews to persuade candidates to download fake mobile applications, including bogus versions of interview software.
According to cybersecurity company Malwarebytes, scammers have used messages such as “Complete your interview by installing the Indeed app” and claims that a salary agreement would become available after installing an application.
Once installed, malicious apps can potentially give criminals access to sensitive information, which may then be used for extortion or financial theft.
Indeed has also warned jobseekers that legitimate interviews conducted through its platform do not require candidates to download a special application.
The company said that any message asking a jobseeker to download an app to participate in an interview should be treated as a scam.
The cases highlighted by the BBC underline the importance of carefully checking recruiters, employers and interview processes before downloading software or sharing sensitive information. Even professional-looking communications and seemingly legitimate documents can be used as part of sophisticated recruitment scams.
Source: BBC
