Fake job interviews used to deploy JobStealer malware

A new malware campaign is using fake job interviews to trick users into downloading malicious software, according to researchers from Dr.Web. The trojan, named JobStealer, disguises itself as a video conferencing application, aiming to steal crypto wallets, browser credentials, and sensitive files from both Windows and macOS users, HackRead reports.

The campaign involves scammers posing as recruiters and inviting victims to online interviews via custom platforms that mimic legitimate services like Cisco Webex. Instead of an interview, users download malware disguised as conferencing apps. On macOS, attackers use Terminal commands or fake DMG files to trick users into running the malware, which then prompts for their password. JobStealer specifically targets cryptocurrency assets by searching Chromium-based browsers for wallet extensions and also extracts browser cookies, saved passwords, Telegram session files, and hardware wallet software traces.

A Windows version of JobStealer exists with similar capabilities, and potential Linux, iOS, and Android variants have been identified. This campaign highlights the adaptation of social engineering tactics to remote work culture, moving beyond traditional phishing methods.

Source: HackRead