The Job Interview From Hell: How a Fake Recruiter Stole £18,000 in Hours as Fake Indeed Apps Spread Spyware

A job seeker had £18,000 ($24,300) stolen within hours of downloading malicious software during what he believed was a genuine recruitment process, one of a growing number of interview-themed scams targeting people looking for work.

The man, who asked to remain anonymous, was approached on LinkedIn by someone posing as a recruiter. During the process, he downloaded a file that appeared to be an ordinary document but contained malware. The attackers drained his cryptocurrency accounts of £18,000 ($24,300) and disappeared, he told the BBC.

'It's a horrible feeling to be out a substantial amount — something I wouldn't wish on my worst enemy,' he said.

His case reflects a wider pattern of recruitment fraud, though it took a different route to the scam now drawing warnings. He was approached through LinkedIn and tricked into opening a disguised file, not a fake app. Separately, the cybersecurity company Malwarebytes has documented a campaign of fake Android apps that impersonate Indeed's login page, one of the world's largest job platforms.

How the Fake Interview App Scam Works

Malwarebytes said scammers advertise fake vacancies or pose as employers, then direct applicants to install an Android app they claim is required to complete the interview. The messages tell candidates that identity verification is needed, that a salary agreement is available once the app is installed, or that the interview can be finished by installing the Indeed app.

According to the company's researchers, the apps impersonate Indeed's login page and open a VPN connection once a victim enters an email address. They then act as Trojan droppers, installing further malware. In the case Malwarebytes examined, the final payload was spyware.

The spyware can take control of an infected phone and, in some cases, block attempts to remove it, the company said. Once installed, the apps can also give attackers access to private data for extortion or financial fraud.

The scheme does not rely on breaching Indeed's own systems. The scammers instead exploit the platform's credibility and the urgency of a job offer to push applicants toward files and steps that Indeed says are not part of its process.

The apps included ones named 'Indeed Interview' and 'MyInterview', neither of which was available through Google Play. Each had to be sideloaded as an APK from a link sent during the fake process. Indeed's official apps, Indeed Job Search and Indeed Flex, are distributed only through the Apple App Store and Google Play.

Reports came from several countries. A user in the UK flagged an 'Interview App' on Malwarebytes' forums, a user in Brazil reported an APK named MyInterview, and Reddit users described compromised phones. One victim said their device began closing apps by itself after installation, then found MyInterview listed among Android's accessibility services, the settings that let an app monitor and control the screen.

Why the Interview Scam Keeps Working

LinkedIn has warned of a rise in job scams and released figures it describes as a Gen Z 'Scam Gap'. The data shows people early in their careers are the group most often targeted, at 32%, with a comparable proportion admitting they carry on despite noticing warning signs because of the competitive job market. The company told the BBC that many young people feel they cannot afford to be sceptical because opportunities seem scarce.

Indeed issued scam guidance in July. The company said interviews on its platform take place entirely in a browser and never require a separate app, and that any message asking a job seeker to download one to take part is not legitimate.

It said the fake apps are not affiliated with Indeed and condemned those exploiting the trust placed in its brand.

Researchers advise job seekers to confirm recruiters through official channels, avoid interviews that depend on installing software from unfamiliar links, and refuse any APK sent during a conversation.

LinkedIn pointed to guidance on its website on spotting recruitment scams, including checking that a company and its vacancy are real before entering talks.