Jobseekers are being warned to remain vigilant after scammers were found to be targeting people on job listings websites, tricking them into downloading bogus interview tools laced with malicious software.
One victim was invited on LinkedIn by a fake recruiter to take part in a job interview process and downloaded a normal-looking document that turned out to be malicious. Within hours, hackers had drained his cryptocurrency accounts of £18,000 in savings and disappeared.
"It's a horrible feeling to be out a substantial amount - something I wouldn't wish on my worst enemy," said the victim, who wished to remain anonymous.
Professional recruitment platforms LinkedIn and Indeed have both warned of growing numbers of job scams in recent months. LinkedIn released data highlighting what it called the Gen Z "Scam Gap", finding that younger professionals face the highest exposure to scams, at 32%, yet nearly a third admit to ignoring red flags because of a competitive job market.
When approached by the BBC, LinkedIn said that in a crowded and competitive job market, "many young people feel they can't afford to be sceptical... because they feel opportunities are so scarce". The platform pointed to advice on its website about how to spot recruitment scams, including verifying that a company and job listing are genuine and carrying out thorough research before engaging in talks.
The victim who lost his savings had handed in his notice and had made it clear on LinkedIn that he was looking for a new job. A fake recruiter sent him a potential job offer and held a video call about the role before asking him to carry out a standard technical assessment, with instructions contained in a Google Sheet document. The document was laced with malicious software.
After completing the task, the candidate went to bed and woke to find his online wallets emptied of savings.
"I wiped my computer and changed all my passwords and was exhausted emotionally and mentally drained," he said. "I felt a mixture of disbelief and anger - at the hackers and at myself. I was also confused until I figured out how they had got me."
Cyber-security researcher Charlie Kelly, from Have I Been Squatted, analysed how the attack worked and said the new wave of recruitment scams were hard to spot. "This wasn't a badly written email with a suspicious attachment - this person was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app," Mr Kelly said.
The case comes as others have reported similar attacks through the job listing platform Indeed, which issued advice in July about avoiding scams. Criminals are using the pressure and excitement of job interviews to lure people into downloading booby-trapped mobile applications, including a fake Indeed Interview app and one called MyInterview.
According to cyber-security company Malwarebytes, fake recruiters use lures such as "Complete your interview by installing the Indeed app" or "salary agreement available after app installation". Once downloaded, the malicious apps allow hackers to access private data for extortion or to use in further financial attacks.
"Interviewing through Indeed's platform happens entirely in a browser and never requires downloading a special app," the company posted online recently. "Any message asking a job seeker to download an app to participate in an interview is not legitimate."
Jobseekers are advised to verify recruiters and companies independently, avoid downloading software or applications as part of an interview process, and to be cautious of any instructions received during video calls or via shared documents.
