Fake job app installs malware on Android phones
The National Cyber Security Centre (NCSC) is aware of scammers distributing malware disguised as a job-seeking app on Android phones.
We’re advising New Zealanders to be cautious of downloading apps that do not come through the official Google Play app store, particularly if they have been sent through social media, messaging apps, or by someone they don't know.
If a job opportunity seems too good to be true, or you're asked to download an app before you've had a proper conversation with an employer, take a moment to verify the request is legitimate before proceeding.
How the malware works
Scammers are tricking people into manually installing a malicious Android app disguised as a job-seeker app.
People are instructed to download the app via chat messaging, and potentially through phone calls from the attacker.
After installing the app, a fake Google Play update page is presented to the person. This makes the app appear more legitimate and as if it is being downloaded from the official Google Play store.
Once downloaded, the app will request access to a series of settings, in particular "Accessibility" settings. Once these settings have been permitted, the malware is able to modify permissions and settings on the phone, ultimately giving the scammer full access to the device.
We’re also aware scammers are using alternate methods to spread this type of malware, such as disguising it as a banking app.
How to protect yourself
-
Be careful with job ads on social media
Treat unexpected job offers or recruitment messages with caution, especially if you’re quickly asked to move the conversation to another platform.
-
Only download apps from official app stores
Only install apps from trusted sources such as the Apple App Store or Google Play Store. Avoid downloading apps through links sent in social media messages, texts, or messaging apps.
Android defaults to disallowing sideloading of applications.This is called "Installation from Unknown Sources". The NCSC recommends never enabling this setting.
-
Take your time
Scammers often try to create a sense of urgency, so you act before checking whether something is genuine.
-
Limit approved permissions to apps
Ensure that the apps you download are only given permissions to things that they need to function. If an app is asking for extra permissions that they shouldn’t need access to, consider removing the app altogether.
-
Watch for unusual activity
If your phone starts behaving strangely, becomes unresponsive, or displays unexpected update screens, stop using it and seek advice from a trusted IT provider as soon as possible.
-
Keep your devices secure
Keep your phone and apps up-to-date, enable security features, use strong, unique passwords for your accounts, and always use multi-factor authentication when possible.
What to do if you’ve been targeted
If you think you've downloaded a malicious app or shared information with a scammer, take the following steps as soon as possible. The sooner you act, the better your chances of limiting any financial loss or further damage.
- Contact your bank immediately if you think your financial information may be at risk.
- Change all your passwords, starting with your email account, banking accounts, and any other accounts you may have used or signed on your device.
- Run a security scan on your device if possible.
- Follow the instructions here to back-up your data and clean your device: Remove malware from your device - Own Your Online
- As the app can install further malware, uninstalling the malicious app may not be enough to completely remove malware from your device. The guide above contains instructions on how to factory reset your device, which is more likely to successfully remove the malware.
- After resetting your device, only reinstall apps you recognise and trust. Reinstalling the same malicious app could expose you to the same risk again.
- Contact your mobile provider if you believe your phone has been compromised.