Spyware scam targeting Indeed users – infected interview apps

IT security researchers are reporting increased attacks on users of the job platform Indeed. Criminals are trying to trick them into installing malware apps, which are disguised as interview apps.

This is currently being warned by Malwarebytes virus analysts . According to them, several Indeed users have been contacted by supposed employers and instructed to install an app for an interview. The cases occurred worldwide: IT security researchers have gathered reports from Brazil, Great Britain, and other countries, including from affected individuals on .

Affected users report that after installing a “MyInterview” APK file, which was shared via a file link and did not come from the Google Play Store, their smartphone was completely compromised. After installation, the phone closed apps, and the malicious app was categorized under accessibility services.

The malicious actors use phrases like “Complete your interview by installing the Indeed app,” “Update your Indeed application,” “Identity verification required,” “Download our recruitment portal,” or “Salary agreement available after app installation” – all in English – as bait in their requests. The Android apps offered with these messages mimic the Indeed login page before establishing a VPN connection after the user enters their email address. During analysis, the apps turned out to be so-called Trojan Droppers, capable of installing additional untrusted apps. At the time of analysis, the droppers delivered spyware. Once they obtain accessibility permissions, they take over the device. Among other things, they also prevent users from uninstalling the app.

The scammers advertise fake job openings on Indeed and then lure victims into installing fake Android apps that imitate Indeed. After confirming the application receipt, victims receive messages with subjects similar to “Interview with ” in English, which appear in Indeed’s visual style, contain the aforementioned requests, and include a download link as a button.

Indeed uses an official Android app called “Indeed Job .” The company informed Malwarebytes that interviews are conducted exclusively through Indeed’s official website in a web browser and never require the download of additional apps. Any message to job seekers that asks them to install an app for an interview is not legitimate. At the end of their analysis, the virus hunters also provided some indicators of compromise (IOCs).

Cybercriminals never run out of ideas for tricking victims into installing malware. Malware apps pose a constant threat and can even be found in the official app stores of smartphone platforms. a year ago, IT security company Zscaler discovered 77 malware apps in Google’s Play Store , which had been installed 19 million times. These apps delivered the Anatsa trojan, which targeted financial apps on Android devices to steal crypto assets and money from victims.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.