Beware of fake Indeed interview apps used to install spyware

Recent investigations have unveiled a troubling trend where scammers are exploiting the Indeed platform, one of the largest employment websites globally, to target job seekers. These fraudsters utilize counterfeit Android “interview” applications, taking advantage of the heightened competition in the job market to access a vast pool of potential victims.

What we found

A user from the UK shared their experience on online forums after being prompted by a supposed employer on Indeed to download an “Interview App.” Similarly, a user in Brazil reported receiving instructions to install an APK named MyInterview, which was linked during a job interview. Discussions on Reddit revealed that an “Indeed Interview” app had allegedly compromised a user’s phone entirely.

The individual who installed the MyInterview APK reported that their device began to malfunction, closing applications autonomously post-installation. A screenshot they provided indicated that MyInterview was listed under Android’s downloaded Accessibility services. Common tactics employed by these scammers include:

• “Complete your interview by installing the Indeed app.”
• “Update your Indeed application.”
• “Identity verification required.”
• “Download our recruitment portal.”
• “Salary agreement available after app installation.”

Analysis by Malwarebytes Android Malware Researcher Nazeeh Sulaiman revealed that these fraudulent apps mimic Indeed’s login page and establish a VPN connection once an applicant inputs their email address. Static analysis classified the apps as Trojan.Droppers, capable of installing additional untrusted software. Initially, the final payload was identified as spyware, although a banking Trojan was anticipated. Once granted Accessibility permission, the malware effectively seizes control of the device, complicating uninstallation attempts by redirecting users back to the app when they try to remove it.

How it works

Scammers post fake job listings on Indeed, enticing applicants to download a fraudulent Android app that masquerades as an interview tool. After confirming their application, job seekers receive directives such as:

In this scenario, the job seeker is instructed by a “recruitment firm” to download and install the app, connect to a VPN, create an account, and enter an invitation code. They are advised to keep the app open while awaiting confirmation. It is crucial to note that this malicious application has no affiliation with Indeed. The official Android app, Indeed Job Search, is available exclusively through Google Play, not via an APK provided in a recruitment message or an unfamiliar interview website. An Indeed spokesperson confirmed that the interview process does not necessitate the installation of a separate app:

“Interviewing through Indeed’s platform happens entirely in a browser and never requires downloading a special app. Any message asking a job seeker to download an app to participate in an interview is not legitimate. We encourage job seekers to avoid clicking links or downloading files from any message directing them to do so.”

It is essential to understand that the dropper is merely an initial-stage app designed to install other malicious or unwanted applications onto the device, often bypassing the victim’s caution with a seemingly legitimate pretext. Even if the counterfeit Indeed app does not overtly steal data, it can serve as a conduit for more dangerous malware. While a VPN connection can be legitimate in various contexts, there is little justification for an interview app to create one immediately after an applicant provides their email address.

In a malicious context, a VPN can grant an app significant control over the device’s network traffic, allowing attackers to route communications through their systems, obscure the app’s activities, or facilitate subsequent stages of the attack. Although the VPN behavior alone does not confirm that traffic was intercepted or altered, it raises serious concerns when combined with brand impersonation and dropper functionality. Additionally, the app’s presence in Accessibility settings is alarming, as these services can view screen content and perform actions on behalf of the user, making them appealing to malware developers. In the provided screenshot, MyInterview was disabled, indicating that the service was not active on that device; however, its presence as a downloaded Accessibility service is pertinent to the overall risk assessment.

How to stay safe

Job interviews should not require candidates to sideload an Android app, enable a VPN connection, or install software from unknown sources. In this scheme, the purported interview app serves merely as bait: it impersonates Indeed, establishes a dubious network connection, and is engineered to deliver additional malware.

Before engaging with any recruitment platform, it is vital to familiarize yourself with its hiring process and remain cautious of requests that diverge from it or direct you to another platform. Avoid installing applications simply because someone instructs you to, particularly if they require installation outside of Google Play. Verify job offers through independent channels, as some reported companies either do not exist or lack offices in the cities they claim to be hiring from.

An Indeed spokesperson emphasized:

“Job seekers are at the heart of everything we do, and their safety and trust are a top priority. We are aware of scams involving individuals instructing job seekers to download an app to complete a virtual interview. These are in no way affiliated with Indeed, and we strongly condemn bad actors who exploit the trust job seekers place in our platform and brand. For more on how to verify a legitimate Indeed app and spot the warning signs of a fake one, visit our Help Center.”

Indicators of compromise (IOCs)

Trojan droppers:

Dropped malware payload:

Domain: startcareer[.]org