Fake Job Interviews Are Spreading Malware: What to Check
A convincing recruiter, video call and familiar cloud document can still lead to a malicious interview task. UK jobseekers should verify the role independently and refuse unexpected software installs.
The short version
What you need to know
- The BBC reports that one target followed a realistic-looking interview process, opened instructions hosted on a familiar cloud service and installed malicious software before cryptocurrency accounts were drained.
- A video call, signed app or real document platform is not proof that the recruiter or assessment is genuine. Check the role on the employer's own careers site and contact the organisation through an independently found channel.
- A VPN cannot inspect an installer, remove infostealing malware or reverse a cryptocurrency transfer. Refuse unexpected interview software and act quickly from a separate clean device if you ran it.
How the fake interview worked
The BBC describes a jobseeker who had advertised that he was looking for work and was approached on LinkedIn by a fake recruiter. The process included a video call and a technical assessment presented through a Google document, but the task led him to install malicious software.
The victim told the BBC that £18,000 in cryptocurrency savings was taken within hours. A researcher who examined the incident said the flow used real Google pages and a digitally signed application, showing why surface-level signs of professionalism cannot replace independent verification. This is one reported case, not evidence that every recruiter message or online assessment is malicious.
Why the first contact matters
LinkedIn's 2026 safety research says 90% of reported scam messages involved an attempt to move the conversation off-platform. It recommends checking the employer's own careers site, the company page, recruiter profile and available verification signals before engaging further.
Indeed warns that fake job advertisements and messages commonly aim to steal money or personal information. In the pattern reported by the BBC, requests to install a special interview application were a key warning sign; Indeed says interviewing through its platform happens in a browser and does not require a separate interview app.
What to do before an interview task
Find the vacancy on the employer's typed, official careers address and call or email a contact listed there if anything is unusual. Keep early messages on the recruitment platform, inspect the sender's history and domain, and ask why software is required. Do not disable security controls, paste commands into a terminal or grant remote access for an assessment.
Treat pressure, secrecy, early requests for identity documents, fees, cryptocurrency, gift cards or banking details as reasons to stop. A legitimate employer should tolerate a short delay while you verify an unexpected download through its official recruitment team.
If you installed the software
Disconnect the affected device from the network and use a different, clean device to secure your primary email, password manager, financial, cloud and cryptocurrency accounts. Revoke active sessions and tokens, change unique passwords, enable strong multi-factor authentication and contact relevant financial providers immediately.
Preserve the recruiter's profile, messages, file name, download address and transaction evidence without reopening the suspected file. Report the account to the platform and the incident through the UK's official Report Fraud route. Because infostealers can copy session cookies and wallet data, a password change alone may not be enough; seek professional device cleanup or reinstall guidance where appropriate.
Where a VPN helps — and where it does not
A reputable VPN can encrypt supported network traffic on untrusted Wi-Fi and reduce what the local network can observe. It does not establish that a recruiter is real or tell whether a document, app or command is safe.
A VPN cannot stop malware that you authorise, prevent it reading accessible files and sessions, recover stolen funds or clean the device. Independent identity checks, refusing unexpected software, endpoint protection, account controls and a rapid incident response address this scam.
VPN Rocks view
Modern recruitment scams exploit urgency and professional-looking context rather than obvious spelling mistakes. The safest rule is not 'trust the platform'; it is 'make the claimed employer prove the process through a separate official channel.'
Jobseekers should not be penalised for checking. A genuine hiring team can explain its assessment tools, confirm a recruiter and point to an official download. If it cannot, do not let the pressure of an opportunity turn an unknown installer into trusted software.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.