Home › Guides

Recruiter asking you to download a file, install an app or log in through a link? Stop and check

Published October 27, 2026 · Example messages are made up.

Not every job scam asks for money. Some are after your laptop or your phone. A “recruiter” sends a file with the offer details, a link to a candidate portal, an app you need for the interview, or a take-home coding test to run. One wrong click can hand your passwords, accounts and documents to someone who is only pretending to hire you.

What they get when you download something

Malware on your device, or a password typed into a fake login page, is worth far more to a scammer than a fake training fee. With access to your computer or accounts, they can read the passwords saved in your browser, get into your email and social media, message your contacts from your accounts, look for photos of your driver's license or passport, and try to get into your bank.

This is documented, not hypothetical. On September 18, 2026, the FBI, the US Department of Defense Cyber Crime Center, Japan's National Police Agency and agencies in Australia and Germany published a joint advisory on a North Korean group called “WaterPlum”, also known as “Contagious Interview”. According to the advisory, its members pose as employers, often impersonating AI, cryptocurrency or NFT companies, and during interviews and technical tests tell job seekers to download and run malicious files. The advisory reports at least 30,000 infected devices in more than 100 countries between December 2025 and July 2026, and lists the data it goes after: browser-saved logins, keystrokes, screenshots, crypto wallet data, and ID pictures such as driver's licenses and passports stored on the computer.

That campaign mainly targets developers and IT professionals, but the lesson applies to everyone. If a hiring process leads you to install something or enter a password outside official channels, pause.

The most common versions

1. The “job details” attachment

An email or chat message arrives with a file: “job description”, “offer letter”, “application form”. Often it is a compressed archive (.zip, .rar), or something that looks like a PDF but is really a program, such as “Offer_Letter.pdf.exe”. Or it is a document that asks you to “Enable Content” to view it properly. The FTC's advice on phishing is blunt: attachments and links in unexpected messages can install malware, so contact the company through a phone number or website you know is real instead.

Hi Sam, congratulations on moving forward! Please find your offer letter and onboarding pack attached. The file is secured, so click “Enable Content” to view it. We need the signed form back by end of day.

2. The candidate portal that wants your login

You are invited to “complete your application” on a portal. It looks polished, but to continue you have to sign in with Google, Facebook, LinkedIn or your email password. The page is fake: whatever you type goes to the scammers, who then log into your real account.

3. The interview app, or the tech problem that needs “fixing”

They suggest a video interview, but with an app you have to download from a link they send. Or the call starts normally and a few minutes in, your audio “isn't coming through” or your camera “isn't detected”, and you are asked to install an update or paste a command to fix it. The WaterPlum advisory describes exactly this: files to download and run to “troubleshoot an error” in the video conferencing platform.

4. The remote access tool

“To set up your company profile, install this program and read me the code it shows.” Remote access software is legitimate, but it lets another person see and control your screen. The FTC notes that scammers use phishing messages to trick people into giving them access to their phone or computer. Giving a stranger that code means letting them use your computer, including while you are logged into your bank.

5. The coding test you have to run

If you work in tech, this can feel completely routine: “clone this repo, install the dependencies and fix the bug”. The problem is the hidden code inside. The joint advisory mentions malicious npm packages and Visual Studio Code projects that run code automatically once you open the folder and confirm you trust the author.

6. The verification code “to activate your profile”

They ask for the six-digit code you just got by text, “to finish registering you on our system”. That code may be what someone needs to log into your email, your bank or your messaging app. The FTC's advice in its alert what's a verification code and why would someone ask me for it? is simple: never give your verification code to someone else.

What a real hiring process usually looks like

• Applications go through the company's own careers site or a well-known job board, which you can reach yourself without using the link you were sent.
• Video interviews use mainstream platforms that run in the browser or come from the official website or app store, not from a file sent over chat.
• Documents are ordinary PDFs, with no password-protected archives and no requests to enable macros.
• Work laptops are set up after you are hired, by the company's IT team, not during the interview by someone you met on a messaging app.
• Nobody asks for your passwords or verification codes. Not at any stage.

Red flags

• The contact came out of the blue, often over text or a chat app. See also recruiters on WhatsApp or Telegram.
• The file is an archive, a program, or a document asking you to “Enable Content”.
• The link goes to a different domain from the company's official website.
• To “view the offer” you have to sign in with the password for another service.
• You are asked to install an app from a link, run a command, or share your screen through remote access software.
• The technical problem always shows up at the wrong moment, and the fix is always “download this”.
• There is pressure: “by end of day”, “another candidate is waiting”.

Before you open anything: five checks

1. Verify the company and the person through official channels, not the contact details in the message. The step-by-step checks are in how to verify a company before a job interview.
2. Look at the file extension. Turn on file extensions in your computer's settings: a job offer has no reason to be a .exe, .scr, .bat, .js, .lnk, .iso or, on an Android phone, an .apk.
3. Only install apps from official sources, by typing the address yourself or searching the app store. If the recruiter insists on their own link, ask to do the interview in the browser or on another platform.
4. Don't run commands you don't understand, even if they are supposed to “fix your audio”. The advisory specifically warns about scripts containing strings like “curl”, “base64” or “-enc” unless you fully understand what they do.
5. If you are a developer, don't run a stranger's code on the machine you use for work, banking or crypto. The joint advisory recommends running unknown code only in a sandbox or virtual machine, and opening unfamiliar projects in VS Code in Restricted Mode by answering “No” when asked whether you trust the authors.

If you already opened the file or entered your password

1. Disconnect the device from the internet (Wi-Fi and cable) if you think you installed something. That is the first step in the joint advisory too.
2. Change your passwords from a different device, one you did not use to open the file: email first, then bank, social media and messaging apps. Turn on two-factor authentication, as the FTC recommends in what to do if you were scammed.
3. Call your bank if you used online banking on that device or gave anyone remote access, and ask them to watch for or block transactions.
4. Update your security software and run a scan, removing anything it flags. If you still have doubts, back up your files and do a full reset of the operating system: the advisory warns that malware can survive removal.
5. If you had crypto wallets on the device, assume the data is exposed. The advisory recommends creating a new wallet on a separate device and moving your funds there.
6. If it was a work computer, tell your company's IT or security team straight away.
7. If you shared personal information such as your Social Security number or ID, follow the steps at IdentityTheft.gov.
8. Report the message. In the US, the FTC asks you to forward phishing emails to [email protected] and texts to 7726 (SPAM). In the UK, the National Cyber Security Centre asks you to forward scam emails to [email protected] and scam texts to 7726.
9. Report it. In the US, file a report with the Federal Trade Commission at ReportFraud.ftc.gov, and with the FBI's Internet Crime Complaint Center at ic3.gov if the scam happened online or involved crypto. In the UK, report it to Report Fraud, the national service that replaced Action Fraud, at reportfraud.police.uk (England, Wales and Northern Ireland; in Scotland, call Police Scotland on 101).

If they also asked you for money, read asked to pay before you start a job?. If the job ad that started it all is still online, you can run it through the job scam checker.