Job seekers using the Indeed platform are being targeted by scammers employing fake Android "interview" applications to install spyware on their devices. These malicious apps, which impersonate Indeed's branding, are distributed outside of official app stores and can lead to full device compromise.
Indeed, one of the world's largest employment websites, confirmed that its official interview process occurs entirely within a browser and never requires downloading a specialized app. Any request for a job seeker to install an app for an interview is not legitimate. The company encourages users to avoid clicking links or downloading files from such messages.
Reports from various users indicate a consistent pattern of deception. A user in the UK was instructed to install an "Interview App" by a supposed employer on Indeed. Similarly, a user in Brazil reported being told to install an APK named "MyInterview" from a shared link during a job interview. Reddit users also discussed an "Indeed Interview" app that allegedly compromised one user's phone. The victim who installed the "MyInterview" APK observed their phone closing apps autonomously after installation and shared a screenshot showing "MyInterview" listed under Android's downloaded Accessibility services.
Common lures used by the scammers include prompts to "complete your interview by installing the Indeed app," "update your Indeed application," "identity verification required," "download our recruitment portal," or "salary agreement available after app installation."
Analysis by a Malwarebytes Android Malware Researcher, Nazeeh Sulaiman, revealed that these Android applications mimic Indeed's login page. After an applicant enters an email address, the apps establish a VPN connection. Static analysis identified these applications as Trojan.Droppers, meaning they are designed to install additional untrusted applications. While initially suspected of delivering banking Trojans, the observed final payload was spyware.
Once granted Accessibility permission, the malware can effectively take over the device. A notable feature of this malware is its ability to prevent uninstallation; when a user attempts to uninstall the malicious app from Android Settings, the malware forces the screen back, preventing removal.
The malicious workflow begins with scammers advertising fake job openings on Indeed. Once an applicant shows interest, they receive instructions to download and install the fake Android app, connect to a VPN, create an account, and enter an invitation code, often being told to keep the app open while awaiting confirmation.
The official Indeed Job Search app is distributed exclusively through Google Play. The company emphasized that any app supplied via a recruitment message or an unfamiliar interview website is not affiliated with Indeed.
The "dropper" functionality means the initial fake Indeed app is not necessarily the ultimate threat but rather a mechanism to deliver more dangerous malware. The establishment of a VPN connection by an interview app immediately after an email address is provided is highly suspicious, as it could allow attackers to route communications through their controlled systems, obscure the app's activities, or facilitate later stages of an attack. While a VPN connection itself doesn't confirm interception, combined with brand impersonation and dropper capabilities, it serves as a significant warning sign.
The presence of the fake app in Accessibility settings is also concerning. Accessibility services can view screen content and perform actions on behalf of the user, making them a common target for malware developers. Although the "MyInterview" service was disabled in the provided screenshot, its mere presence as a downloaded Accessibility service indicates potential risk.
To mitigate risks, job seekers should be wary of any interview process that requires sideloading an Android app, enabling a VPN connection, or installing software from an unknown source. It is crucial to understand the legitimate hiring process of any recruitment platform and to be suspicious of requests that deviate from it or attempt to move the interaction to another platform. Apps should only be installed from trusted sources like Google Play. Verifying job offers through independent channels is also recommended, as some reported cases involved non-existent companies or companies claiming to hire in cities where they had no offices.
Indeed reiterated its commitment to job seeker safety and trust, condemning bad actors who exploit their platform and brand. The company directs users to its Help Center for guidance on verifying legitimate Indeed apps and identifying signs of fake ones.
Indicators of compromise include specific MD5 hashes and package names for the Trojan droppers and the dropped malware payload, as well as the domain startcareer[.]org.
