Fake job interviews used to infect IT specialists' computers, analysts warn

Scammers are staging fake job interviews to infect the computers of IT specialists and gain access to their employers' systems, according to analysts at the Smart Business Alert (SBA) service of ECA PRO, part of the Cross Technologies group. They shared their findings with Lenta.ru.

The scheme works like this: a supposed recruiter invites the candidate to a video meeting, then pushes them to install an "update" said to improve connection stability. The user receives a link mimicking a video-calling service. Seconds later, a message appears about audio or connection problems, along with a prompt to update the software. Persistent notifications and the waiting interviewer create pressure, and the person launches the file to connect faster. What installs instead is malware capable of stealing passwords, work sessions and documents.

Domain analysis backs up the trend. In October 2026, the number of newly discovered domains containing names or fragments of video conferencing service names rose 104 percent against September, from 1,575 to 3,206. Between November 2025 and October 2026, 21,852 unique domains tied to various video conferencing services were found, while the words "offer" and its Russian equivalent appeared in 56,495 domains.

Experts say the shadow market is actively hunting for up-to-date job seeker contacts, including through access bought from employees of classified ad and recruitment platforms, as well as databases previously leaked from job search sites. Mass applications and people currently looking for work are of particular interest, since they let attackers target a suitable candidate and make the approach more convincing.

Sergey Trukhachev, head of the service, said that when a job search drags on, an interview invitation takes on special value. Criminals exploit the fear of missing out, rushing the candidate and pushing them to follow technical instructions while the interviewer supposedly waits to connect.

The specialists warn it is especially dangerous to join such an interview from a work laptop during working hours, since corporate email and VPN may be open on the device and keys and access credentials to internal services may be stored there. For an attacker, that opens a path from infecting the applicant's computer to attacking their current employer.