Loading story…
Cybercriminals are using fraudulent Indeed job listings and recruitment messages to lure job seekers into sideloading fake Android interview apps, including an APK called MyInterview. Reported victims include users in the UK and Brazil, while the campaign appears to target Indeed users more broadly. The apps imitate an Indeed login page and, after a victim enters an email address, establish a VPN connection and act as Trojan droppers to install an additional spyware payload.
The malware requests Android Accessibility permissions, enabling it to view screen content, perform actions, close applications, and resist removal; one sample reportedly redirected users away from the Android uninstall screen. Indeed said legitimate interviews take place entirely in a browser and never require a dedicated interview-app download; its official Android app is distributed through Google Play.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Indeed told Malwarebytes that legitimate interviews take place entirely in a browser and never require a dedicated application download. It said interview messages directing job seekers to download an app or file are illegitimate, and noted that its official Android app is distributed through Google Play.
Analysis found that the malicious droppers sought Android Accessibility permissions, which could enable device control and actions on a victim's behalf. The malware could close applications and obstruct attempted removal by redirecting victims away from Android's uninstall screen.
Scammers used fraudulent Indeed job listings and recruitment messages to lure job seekers, including victims in the UK and Brazil, into sideloading Android apps such as MyInterview. The apps imitated Indeed login pages, established a VPN connection after email entry, and acted as Trojan droppers that installed spyware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly targeting individuals with fraudulent job offers, often impersonating legitimate companies or organizations to lure victims. One reported scam involves text messages claiming to be from Indeed's recruitment team, offering highly flexible remote work with unusually high pay and benefits. The messages request recipients to respond via messaging apps or phone numbers, a tactic commonly used in employment scams to extract personal information or facilitate financial fraud. Indeed has issued warnings that it does not solicit job seekers through such channels and cautions users to be wary of unsolicited offers, especially those requesting communication outside official platforms. In a related trend, North Korean threat actors are orchestrating sophisticated fake employee schemes to secure remote positions at companies worldwide. These operations involve recruiting individuals to act as fronts for job interviews and team meetings, while the actual work is performed by North Korean operatives. The ultimate goals include stealing intellectual property, siphoning funds or cryptocurrency, and, in some cases, extorting employers. Law enforcement agencies have prosecuted individuals who knowingly participate in these schemes, highlighting the legal risks and broader security implications for organizations hiring remote workers.
Jul 1, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026
Researchers reported multiple Android-focused campaigns that rely on **sideloaded apps** from fraudulent websites, social media, and messaging channels rather than exploits in official app stores. ESET identified a previously undocumented spyware family, **Asin**, distributed since early 2025 through fake sites impersonating a government news outlet, a PDF tool, and a conflict-mapping service. The apps offered decoy functionality while covertly collecting data in the background, and victims had to manually install APKs and approve permissions; samples were linked to domains including `c-pdf[.]net` and `syriadefensemap[.]com`, with activity still observed into 2026 on Xiaomi Redmi Note 13 Pro-series devices running Android 15. A separate mobile threat trend used unofficial IPTV and football streaming apps to target users seeking pirated broadcasts in Spain and Italy, especially around major matches such as the UEFA Champions League final. ThreatFabric said apps masquerading as services like RojaDirecta were used to deliver banking malware including **Massiv** and **Perseus**, sometimes hidden inside functional apps with tools such as **Zombinder**. Once installed, the malware could abuse **Accessibility Services** for credential theft, MFA bypass, remote control, and full device takeover, underscoring how attackers are exploiting user demand for news, utilities, war tracking, and free sports streams to compromise Android devices.
Jun 29, 2026