Malicious interview apps targeting job seekers

Cybercriminals are targeting job seekers through fraudulent Android applications designed to install spyware. These malicious APK files, such as “MyInterview”, are presented to applicants under the guise of completing interviews, verifying identities, or accessing salary agreements on platforms like Indeed.

Technical analysis indicates these apps function as Trojan droppers. They impersonate legitimate login pages to steal credentials and establish VPN connections. Once users grant the apps Accessibility permissions, the malware can take control of the mobile device and prevent uninstallation by forcing the screen back during the process.

Reports of these activities have emerged from users in the UK and Brazil. More recent observations note that these technical schemes are occurring alongside broader social engineering trends, where criminal networks use structured training to impersonate authorities such as police or doctors to manipulate victims.

In September 2026, the use of the “MyInterview” Android malware was identified as part of a wider wave of cyberattacks and phishing scams targeting consumers in Germany and Austria. This broader criminal activity includes impersonating financial institutions like Sparkasse and Volksbanken Raiffeisenbanken, as well as service providers such as Asfinag and Deutsche Telekom, to steal sensitive personal and financial data.