Researchers reported a real scam campaign where criminals pose as employers on Indeed, then pressure applicants to install a fake “interview” Android app. The app impersonates Indeed’s login, requests powerful permissions, and acts as a Trojan dropper that installs spyware on the victim’s phone.
The scam begins with fake job listings on Indeed, where criminals pose as employers or recruiters to start conversations with applicants. Once trust is established, victims are directed to install an "interview" Android app, often distributed as a sideloaded APK rather than through an official app store. The pretext varies: identity verification, an application update, or access to a recruitment portal.
Once installed, the app impersonates Indeed's login page and prompts the victim to enter an email address. After that, it creates a VPN connection and functions as a Trojan dropper, delivering spyware onto the device. The malware also seeks Android's Accessibility permission, which can grant extensive control over the phone and even interfere with the victim's ability to uninstall the app.
This campaign works because it borrows credibility from a platform job seekers already trust. Conversations start on Indeed, a familiar and legitimate job site, which lowers suspicion before the malicious request ever appears. Combining that trust with the natural urgency of a job opportunity or interview process pushes applicants toward installing an app without pausing to verify it. Because the login screen inside the app mimics Indeed's own branding, victims may not realize they are entering credentials into a hostile application rather than the real platform.
Job seekers and mobile users should treat any request to install an interview app, especially via APK, as a stop-and-verify moment, even when the conversation started on a trusted platform. Rather than following a recruiter's link, open Indeed or the employer's official website directly to confirm the listing and company. Mobile users should be trained to question apps that request Accessibility permissions or unexpected VPN access, since these are uncommon and high-risk requests for a legitimate interview tool. If a suspicious app was already installed, the device should be treated as potentially compromised: change passwords from a separate trusted device and review account security and MFA settings. Building these habits into routine job-search behavior reduces the chance that platform trust can be turned into a malware delivery path.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Scammers pose as employers on Indeed and, after engaging applicants, direct them to install an interview app framed as identity verification, an update, or portal access. The app impersonates Indeed's login page, sets up a VPN connection, and acts as a Trojan dropper that installs spyware.
Requests for Android Accessibility permission and unexpected VPN connections are major warning signs, since Accessibility access can allow extensive control over a device and even interfere with uninstalling the app.
Treat the phone as potentially compromised, use a separate trusted device to change passwords, and review accounts and MFA settings.
Verify the request independently by opening Indeed or the employer's official website directly rather than following a link sent by the recruiter.
You apply on Indeed, a “recruiter” messages: “Please install an interview app to complete your interview.” Sounds legit, right? Here’s the trick: scammers post fake jobs on Indeed, then push an Android APK called something like “Indeed Interview.” It opens a fake Indeed login, then silently sets up a VPN and drops spyware. Aha moment: Indeed says there are only two real apps, Indeed Job Search and Indeed Flex. If an “Indeed Interview” app wants VPN or Accessibility access, it’s not hiring you, it’s hijacking your phone. Your move: if any recruiter tells you to install an interview APK, stop and verify by opening Indeed or the employer’s official site yourself, never from their link.
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Scammers posted fake jobs on Indeed and then instructed applicants to install a fake Android “interview” app via an APK link. The app impersonates an Indeed login screen and acts as a malware dropper, ultimately installing spyware and attempting to take control of the phone using high-risk…
The article describes real-world scams where attackers pose as recruiters on LinkedIn and send developers “take-home assessment” code repositories that contain hidden malware triggers. Simply cloning and opening the project in an IDE or coding agent can execute malicious hooks/configs that download…
Microsoft reports a real campaign where attackers contact employees through Microsoft Teams while pretending to be IT/helpdesk and persuade them to grant remote control (for example via Teams “request control” or Quick Assist). Once they get an interactive session, the attacker silently installs…
Researchers reported a real malvertising campaign where ads on Meta platforms promoted a fake TV-streaming app to Spanish-speaking users, leading them to sideload an Android app. After victims approved a chain of permissions (including Accessibility), the StreamRat trojan could remotely control the…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
