Fake job offers used to plant malware: how recruitment phishing works

A promising job offer can be the first step of a cyberattack. According to Claudio Álvarez, an associate professor at the Faculty of Engineering and Applied Sciences of Chile's Universidad de los Andes (UANDES), quoted by El Reportero de Iquique, recruitment phishing uses fake vacancies and selection processes to obtain confidential information or to trick applicants into running malicious software.

The Binance case. The outlet cites a case involving Binance in which an engineer downloaded code during a supposed job interview and ended up compromising his computer. According to Álvarez, a supposed CEO joined the second interview and asked the candidate to download the code that infected the machine. The case shows that technical knowledge does not remove the risk, the report says.

An attractive job opportunity sparks interest, raises expectations and can lead people to lower their guard, Álvarez explains.

Convincing scenarios. Álvarez says attackers use legitimate recruitment platforms, simulated interviews and technical tests that look like a normal part of hiring. For software developers, downloading and running code as a technical assessment is fairly common, and that habit can be exploited to introduce malware without raising suspicion. He adds that attackers can build entire selection processes, with several contacts and stages, so their requests look legitimate.

Why it matters

Not just individual error. Álvarez warns that the problem should not be reduced to one person's mistake: an organisation must have security controls able to contain an incident even when an employee is deceived. When a work computer is used, a fake interview can become a doorway into a company's systems.

• Be wary of offers that look too good, unexpected recruiter contact, unusual requests and pressure to move fast.
• Be suspicious if senior executives appear very early in the process.
• If you installed suspicious software, cut contact and disconnect the computer from the internet.
• From another trusted device, change potentially compromised passwords and turn on multi-factor authentication.
• If it was a work computer, tell your IT security team immediately, keep evidence and report it to the authorities (in Chile, the PDI, Carabineros or the Public Prosecutor's Office).

Reporting rules in Chile. Álvarez notes that Chile's Cybersecurity Framework Law (21.663) sets reporting obligations for certain institutions that provide essential services and for operators of vital importance, but these do not apply generally to individual phishing victims.

Sources: El Reportero de Iquique, El Vacanudo