A new malware campaign dubbed JobStealer uses social engineering via fake job interviews to trick victims into downloading trojanized video conferencing applications. The malware, targeting both Windows and macOS, steals cryptocurrency wallets, browser credentials, cookies, and sensitive files. This campaign represents an evolution in social engineering tactics, exploiting remote work culture by posing as recruiters on platforms mimicking legitimate services like Cisco Webex.
Malware Fake job interviews used to deploy JobStealer malware May 14, 2026 Share By SC Staff A new malware campaign is using fake job interviews to trick users into downloading malicious software, according to researchers from Dr.Web. The trojan, named JobStealer, disguises itself as a video conferencing application, aiming to steal crypto wallets, browser credentials, and sensitive files from both Windows and macOS users, HackRead reports. The campaign involves scammers posing as recruiters and inviting victims to online interviews via custom platforms that mimic legitimate services like Cisco Webex. Instead of an interview, users download malware disguised as conferencing apps. On macOS, attackers use Terminal commands or fake DMG files to trick users into running the malware, which then prompts for their password. JobStealer specifically targets cryptocurrency assets by searching Chromium-based browsers for wallet extensions and also extracts browser cookies, saved passwords, Telegram session files, and hardware wallet software traces. A Windows version of JobStealer exists with similar capabilities, and potential Linux, iOS, and Android variants have been identified. This campaign highlights the adaptation of social engineering tactics to remote work culture, moving beyond traditional phishing methods. Source: HackRead SC Staff Related Malware New CRPx0 malware campaign uses OnlyFans lure for crypto theft and ransomware SC Staff May 13, 2026 The CRPx0 campaign, analyzed by Aryaka Threat Research Labs, uses a malicious zip file containing a shortcut that appears to lead to free OnlyFans accounts. Malware Operation SilentCanvas: Attackers use .jpeg files to deliver malware SC Staff May 13, 2026 Attackers are weaponizing .jpeg files to deliver PowerShell payloads, trojanize ScreenConnect, and establish persistence on target systems. AI benefits/risks Why we need a ‘zero-trust for code’ behavioral approach to secure software Ken Ammon May 11, 2026 AI has broken down the old model for classifying code – here’s how a behavioral approach makes more sense today. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds