Install the Indeed app to finish your interview? Don't.

"Complete your interview by installing the Indeed app." It sounds ordinary enough, and if you've been job hunting for a few months you're primed to do whatever the recruiter asks. There is no such requirement. The app is spyware.

Malwarebytes wrote this campaign up on 26 August, after reports from job seekers in the UK and Brazil and a run of posts on Reddit. The shape is consistent: a fake vacancy on Indeed, a recruiter who keeps things moving briskly, then a request to install an Android app sent as an APK file directly rather than through the Play Store. One variant goes by MyInterview. It opens with a convincing copy of Indeed's login screen, and the moment you type in your email address it quietly sets up a VPN connection, which lets whoever is running it sit in the middle of your phone's traffic. Analysis identified these apps as droppers: first-stage software whose only job is to fetch the real payload, which here is spyware.

Then it gets nasty. The app asks for Android's Accessibility permission, the feature built for screen readers, which in practice hands over control of the whole phone. One victim described apps closing by themselves. When they went to uninstall it, the malware threw them off the screen every single time they tapped Uninstall.

Indeed's own position is unambiguous: interviewing through its platform happens entirely in a browser and never requires downloading an app, and the company says it will never contact job seekers to offer employment by phone call, text, or apps like WhatsApp and Telegram. So an employer who wants you to install something has failed the interview. If it's already on the phone, revoke its Accessibility permission first, in Settings under Accessibility, and only then uninstall. The desktop version of this trick swaps the APK for an installer, and that's the sort of leftover Tendvane's Safety check is built to surface: startup programs and browser extensions on your PC that you never chose to add.