Beware of fake Indeed interview apps used to install spyware

Threat actors are distributing fake Android "interview" apps impersonating Indeed to trick job seekers into sideloading APKs that act as droppers for spyware. The malicious apps impersonate Indeed's login, create a VPN connection after an email is entered, request Accessibility permissions (which can enable device takeover and prevent uninstall), and deliver additional payloads; the report provides MD5 IOCs for droppers and payloads and a suspicious domain (startcareer.org).