criminals weaponise fake job postings to spread infostealers

Threat actors are now launching fake job postings to distribute infostealer malware onto unsuspecting victims, transforming the job advert into a delivery vehicle for credential theft. Across recent investigations, researchers have documented waves of counterfeit listings, fraudulent recruiter personas, and weaponised application portals designed to harvest browser cookies, stored passwords, cryptocurrency wallet keys, and corporate session tokens. The same social engineering hooks that once populated generic phishing kits now ride atop polished recruitment branding, complete with fabricated company domains and convincing interview pipelines.

The shift reflects wider maturation in initial access tradecraft. Where attackers previously relied on bulk spam blasting malicious attachments, modern operators favour narrower, context-aware campaigns that mimic the rhythm of professional hiring. By the time a candidate uploads a CV or opens an "interview brief", the payload has often already executed, silently siphoning data long before the applicant realises anything is wrong.

For Australia, the trend carries particular weight. Local hiring platforms such as Seek and LinkedIn enjoy deep penetration in Sydney, Melbourne, Brisbane and Perth, and the country's reliance on recruitment agencies to fill roles across mining, finance, healthcare and government creates fertile ground for impersonation. The Australian Cyber Security Centre has repeatedly flagged recruitment-themed scams, and the Office of the Australian Information Commissioner continues to log credential-related breaches that frequently trace back to malicious software deployed through seemingly legitimate hiring flows.

How recruitment lures are constructed

Operators running these campaigns invest considerable effort in presentation. A typical lure begins with a vacancy posted on a job board or shared via direct message from a spoofed recruiter profile. The role description is tailored, often referencing local projects in Parramatta or Docklands, and the company name aligns with a real business whose identity has been lifted from public filings, LinkedIn pages, or industry directories. The cloned branding extends to email signatures, telephone numbers answered by voicemail, and physical addresses drawn from mapping services.

Once a candidate expresses interest, the attacker moves the conversation off the public platform into a private channel, usually email or a chat application. The applicant is then asked to download a "pre-interview questionnaire", complete a skills assessment, or install "interview software" - in practice a loader for an infostealer such as RedLine, Raccoon, Lumma or Vidar. Sometimes the payload hides inside an Office document carrying macros, while other iterations rely on JavaScript or HTA attachments disguised as PDF portfolios.

The deception is sustained over multiple steps. Attackers schedule video calls, send calendar invites, and request follow-up documentation, mimicking a genuine hiring process so closely that even seasoned professionals have clicked through malicious links. Once the malware runs, harvested credentials are bundled into archives, exfiltrated to attacker-controlled infrastructure, and either sold on criminal marketplaces or redeployed for further intrusions.

Why Australia presents a rich target

Several characteristics of the Australian employment landscape make it attractive to operators specialising in recruitment-themed malware distribution. The country hosts a sprawling ecosystem of small and medium recruitment agencies whose brand presence is easily cloned, and a high proportion of white-collar roles in Sydney and Melbourne are filled through intermediaries rather than direct hires. Job seekers routinely submit résumés to multiple agencies simultaneously, normalising the practice of sharing personal information with unfamiliar parties.

Public sector hiring adds another layer. Listings on the Australian Public Service careers portal and state government boards attract tens of thousands of applicants each year, and candidates often treat official-looking correspondence with elevated trust. Threat actors have been observed registering look-alike domains that mirror ".gov.au" subdomains, then reaching out under the guise of departmental recruitment officers. These spoofed identities carry extra credibility in regional centres such as Hobart, Darwin and Cairns, where government employment is a significant economic driver.

Mining communities in Western Australia and Queensland also feature prominently in lure crafting. Fake job postings promising fly-in fly-out roles, accommodation packages, and six-figure salaries for trades and operators routinely circulate on social media, where verification is minimal and urgency is high. Similar dynamics apply to seasonal harvest work advertised around Mildura and the Riverland, where working holiday visa holders may be less familiar with local scam patterns and more likely to install unfamiliar software under the guise of "remote onboarding".

Anatomy of an infostealer payload

The malware families currently riding recruitment lures share a common objective: extract everything of value from a compromised endpoint, then quietly exit before the victim notices. RedLine and Raccoon remain among the most prevalent, with Lumma gaining ground since late 2024 thanks to its modular architecture and aggressive affiliate programme. Vidar, StealC and a rotating cast of lesser-known strains round out the ecosystem, each offering customisable plugins for browser data, VPN credentials, FTP clients, messaging apps and crypto wallets.

Execution typically begins with a loader that runs in memory to evade signature-based detection. The payload then enumerates installed browsers, decrypts locally stored passwords using known algorithms, and copies autofill data, payment card details and active session cookies. Many modern variants also target password manager vaults, including those synchronised through cloud services, and harvest authentication tokens that allow attackers to bypass multi-factor protections on platforms like Microsoft 365, Google Workspace and Okta.

Exfiltration happens fast. Stolen archives are typically uploaded over HTTPS to bulletproof hosting, and the loot is sorted within minutes by automated panels operated by the threat actors. According to an earlier security report, early credential theft operations in late 2018 moved at a far slower pace, often relying on manual review before resale. The contemporary infostealer supply chain now runs on near-instant processing, with harvested bundles funnelled directly into access broker networks that feed ransomware affiliates and initial access brokers targeting Australian enterprises.

Distribution methods beyond email

Email remains the workhorse of recruitment-themed distribution, but operators have diversified aggressively. LinkedIn spoofing has become particularly refined, with attackers cloning the profiles of real Australian recruiters, complete with endorsements and connections, then reaching out to job seekers with unsolicited offers. Once rapport is established, the conversation pivots to a malicious attachment delivered through LinkedIn messaging or a shared cloud-storage link posing as an interview brief.

Mobile-first targeting has grown sharply. SMS campaigns impersonating recruitment consultancies in Brisbane, Adelaide and Perth promise lucrative roles and include shortened links that resolve to malicious landing pages or APK installers. WhatsApp groups dedicated to local industries - hospitality, construction, aged care - are routinely seeded with fraudulent vacancies, leveraging the trusted context of a community chat to lower suspicion.

Telegram and Discord channels host an entire underground market for recruitment-themed payloads, with vendors offering ready-made landing pages, cloned corporate identities, and turnkey "interview kits" that bundle malicious documents with scripted recruiter dialogue. Affiliates pay a monthly subscription for access, then run their own campaigns with minimal technical knowledge, democratising the same techniques that once required specialist tradecraft.

Warning signs recruiters and candidates should recognise

Spotting a recruitment-themed infostealer lure before payload execution depends on a handful of behavioural and technical tells. Security teams and applicants alike benefit from a shared checklist that catches the majority of active campaigns.

• The recruiter's email domain does not match the company's official website, often by a single character or a hyphenated variation.
• The role is offered without a formal interview, references, or background checks, yet promises unusually high compensation.
• Communication moves rapidly to a request for software installation, document macros, or remote desktop access under the guise of an "assessment platform".
• Attachments arrive in unusual formats such as .iso, .img, .vbs, .lnk, .js, .hta, or password-protected archives that bypass mail scanning.
• The candidate is asked to enable macros, disable protected view, or run an executable signed by an unfamiliar or recently issued certificate.
• Mobile outreach arrives over WhatsApp or SMS from international numbers, with shortened URLs pointing to brand-new domains registered within the previous 30 days.

Reporting suspicious outreach to the recruiting company's official contact channels, rather than the address listed in the message, helps confirm whether the communication is legitimate. Candidates who have already opened attachments should assume exposure, rotate credentials from a clean device, and monitor financial accounts for signs of misuse.

Hardening defences against recruitment-themed attacks

Mitigating this class of threat requires action from candidates, the platforms that host job listings, and the recruitment agencies that circulate them.

• Enterprises should publish their official recruitment email domains on the corporate website and instruct HR teams to never share interview materials through personal accounts or third-party file hosts.
• Job boards operating in Australia, including Seek, Indeed and LinkedIn, need stronger identity verification for recruiter accounts, ideally anchored to ABN lookups and registered business addresses.
• Candidates should treat any request to install software as part of an interview with the same suspicion as a request for online banking credentials, and verify the legitimacy of the recruiter through a separate communication channel before opening attachments.
• Endpoint protection on devices used to handle recruitment documents should enforce application allow-listing, macro-blocking policies, and behavioural detection tuned to infostealer loaders.
• Under Australia's Notifiable Data Breaches scheme, organisations that lose credentials through recruitment-themed malware must conduct rapid assessment and disclosure, reinforcing the need for detection tooling that flags unusual authentication patterns within minutes of compromise.

Recruitment platforms now sit firmly within the third-party risk surface of Australian organisations, and the tradecraft underpinning these campaigns continues to mature with each hiring cycle. Operators are iterating on what already works, layering mobile-first outreach, AI-generated dialogue and look-alike corporate identities to extend their reach. The recruitment channel will remain an attractive vector as long as candidates continue to apply for roles and attackers continue to seek efficient paths into corporate networks.