The short answer
A fake recruiter scam, also called recruitment phishing, is a social engineering attack in which someone poses as a recruiter and uses one step of a fake hiring process, usually a take-home test or a meeting-app “update”, to put malware on an employee’s work laptop or steal their logins. Hoxhunt’s Phishing Trends Report 2026 lists recruitment scams as a top new threat. Hoxhunt trains employees against it with a simulation of the full scam, from the interview invitation to the take-home task, and one-click reporting.
Most advice on fake recruiters is written for job seekers protecting their bank details. If you run security awareness, the bigger risk sits with your company, because the person answering a recruiter on a Tuesday afternoon is usually logged in to your email, your code, and your ad accounts. That is how the Binance theft disclosed in November 2026 began: with a fake job interview and a coding test on a work laptop.
How a fake recruiter scam works, step by step
A fake recruiter scam follows the same stages as a real hiring process, which is why each step feels normal on its own.
- The approach: A message arrives by email or LinkedIn from a recruiter at a well-known company. Campaigns documented in the Secure Culture Hub were sent through real platforms such as Zoom Events and Xero, so the sending platform is genuine.
- The booking page: The candidate is sent to book a call. The page imitates Calendly or a careers portal, and the only working button is a login. A fake browser pop-up then collects the password (a browser-in-the-browser attack).
- The interview: The candidate joins a video call or chat that looks like a normal first round, and the conversation moves quickly to the next step.
- The payload: The candidate is asked to download and run a coding test from a repository, or to install an update after a “your meeting app is out of date” prompt during the call. Either way, the candidate runs the attacker’s code.
- The takeover: A remote-access tool or a backdoor lands on the device, and the attacker can control it remotely.
Not every campaign uses all five steps. Credential-harvesting versions stop at step 2, and versions that deliver malware go all the way.
The Binance case: how a fake job interview led to a $6 billion theft
Binance is the clearest recent example of a fake recruiter scam reaching the company. In its incident report of November 3, 2026, Binance says one of its software engineers was contacted through a legitimate job-hunting platform by someone posing as a project director. A purported HR representative ran a live video interview, and a second round followed with someone claiming to be the CEO of a fictitious company. The engineer was then told to download an “assignment” containing a malicious code repository onto his work computer. The malware was a zero-day that Binance’s endpoint security tools did not detect at the time.
From that laptop, the attackers used an internal AI tool to reach other employees, including a wallet DevOps engineer. On October 29, 2026, about $6.34 billion in digital assets were impacted, and the FBI attributed the theft to North Korea, to the activity it calls TraderTraitor. Every step before the malware looked like a normal hiring process, which is why your developers’ coding tests on work laptops are part of your attack surface.
Who attackers target, and what they take from the company
Fake recruiter scams pick roles whose access is worth more than the employee’s personal data.
- Marketing and social media staff: Hoxhunt’s Phishing Trends Report 2026 found recruitment scams targeting mainly marketing employees, with lures impersonating brands such as Google, Coca-Cola, and Meta. The likely prize is the ad accounts and publishing tools: one fake “Google AI” recruiter campaign asked candidates which ad platforms they manage and how much they spend on each.
- Software developers: In the campaign researchers call Contagious Interview, the fake recruiter asks a developer to download and run a project from GitHub as part of a technical test. Palo Alto Networks Unit 42 first described it in 2023, and Google’s Threat Intelligence Group reported it still running in October 2025.
- Finance and crypto organizations: Microsoft Threat Intelligence reported in April 2026 on a group it tracks as Sapphire Sleet, which primarily targets the finance sector, including cryptocurrency, venture capital, and blockchain organizations. The group schedules technical interviews with its targets, then asks them to run a fake Zoom SDK update that prompts for the computer’s password.
The risk to your company comes from the device the employee uses. A developer testing a “take-home assignment” on a work laptop runs it on the same machine as the company’s code and accounts.
Real campaigns: Contagious Interview and the fake meeting update
Contagious Interview is a well-documented fake recruiter campaign. Google’s Threat Intelligence Group describes the whole chain: fraudulent recruiter profiles on LinkedIn and job boards, a move to Telegram or Discord, a coding test pulled from a repository, and a video interview that throws a fake error and tells the candidate to download a “fix”. The fix is the malware.
For high-value targets the attackers deploy a backdoor that gives them remote control of the system.
The fake meeting update works without any code test, and attackers use it beyond hiring lures. Sapphire Sleet puts it inside a technical interview. Hoxhunt Threat Operations tracked a separate campaign in October 2026, sent as a meeting invite instead of a job offer, where a fake Zoom join page showed a host already waiting, then a “Zoom version expired” prompt.
The goal was to get the recipient to install ScreenConnect, a legitimate remote-access tool that gives the attacker full control of the device, and that your security tools may not flag as malicious because it is real software.
Deepfakes in job interviews: what is documented and what comes next
Deepfakes in job interviews are documented today in the opposite direction, with attackers posing as job candidates. The FBI warned in January 2025 that North Korean IT workers use artificial intelligence and face-swapping during video job interviews to get hired. Unit 42 reported in April 2025 a rise in candidates using real-time deepfakes in interviews.
No public report yet shows attackers using a deepfake interviewer against a candidate. The pieces exist: attackers already run live video interviews in Contagious Interview, and Gartner found in 2025 that 62% of organizations had been hit by at least one deepfake attack in the previous 12 months, 37% of them on a video call. A synthetic recruiter on the call would be a small step from there, and a live face on video is one of the things candidates use to decide whether a recruiter is real.
The bottom line
The safest habit to teach your employees is never to run anything a recruiter sends on a work device, however real the call looks. For how deepfake attacks work more broadly, see our guide to deepfake attacks.
Red flags employees can check
Fake recruiter scams rely on each step feeling routine, so employees need checks that work at any step.
- Unsolicited offer: The role finds you, it is often more senior than you would expect, and the praise is general with nothing specific about your work.
- Mismatched sender: A Google recruiter writes from a Zoom Events or scheduling platform address, or the careers page sits on a domain that is only days old.
- Login first: The only button that works on the booking or careers page is “Continue with Google” or another sign-in.
- Off-platform chat: The recruiter pushes the conversation to WhatsApp, Telegram, or Discord, or sets a 24-hour deadline.
- Questions about your access: Before any real interview, the recruiter asks which ad accounts you run, how much you spend, or what admin rights you hold.
- Something to run: You are asked to clone and install a repository, run a project “assignment”, or install an app update before the call can start.
- AI interviewer: A fake company can use an AI interviewer just as easily as a real one, so an AI interview is no sign the job is real.
- A secret offer: A recruiter who asks you to keep the job secret is trying to stop you from checking with someone.
Any one of these is enough to stop and verify the recruiter through the company’s official careers site, using contact details the employee finds themselves.
What the security team can do
You cannot stop employees from looking for jobs, but your team can make running a recruiter’s file hard and reporting the recruiter easy.
- One clear rule: Employees should never run recruiter files, repositories, or “updates” on work devices. Security teams should say it plainly to developers too, because a coding test is the payload in Contagious Interview.
- Easy reporting: Reporting a suspicious recruiter message should take one click, and nobody should be judged for it. Every reported message helps the security team find the rest of the campaign.
- Software controls: The security team should block unapproved remote-access tools and watch for new ones, since at least one documented campaign installs a legitimate remote-access product.
- Practice beyond the inbox: Employees should practice the video-call step as well as the first email, so they learn that what they see and hear on a call can be faked before they meet the real thing. See how phishing simulation tools compare and how the same lures move to voice calls.
Security awareness practitioners compare notes on attacks like these in the Secure Culture Hub, a practitioner community powered by Hoxhunt, including a members’ session on deepfakes and voice cloning.
How Hoxhunt trains employees against a fake recruiter scam
Hoxhunt is a human risk management platform that trains employees to recognize and report attacks like fake recruiter scams, and helps your security team act on what they report. Each step of the scam needs a different response, and this is how Hoxhunt covers each one.
| Step of the scam | What stops it | How Hoxhunt does it |
|---|---|---|
| Recruiter message by email or Microsoft Teams | The employee reports it instead of replying | One-click reporting in the inbox. In Teams, employees report with Microsoft’s native report button, and both kinds of report reach your security team’s queue. |
| Recruiter message on LinkedIn or a personal channel | The employee’s own habit, because no company inbox sees it | Training builds that habit: regular phishing simulations teach employees to stop and check a sender before they reply. |
| Booking page with a fake login | The employee recognizes the fake page | Phishing simulations matched to each employee’s role, language, and skill level, with a micro-lesson after every report. |
| Video interview | The employee knows a face and a voice can be faked | Deepfake simulations in a fake Teams, Google Meet, or Zoom meeting, with follow-up training after every simulation, and voice phishing simulations in which Hoxhunt calls the employee. |
| Coding test or fake app update | The employee does not run it, and reports it | Reporting is one click from the inbox or Teams, and every report earns the employee stars in training, so reporting becomes the habit. |
| The rest of the campaign | Your security team finds every copy | Hoxhunt’s phishing incident response automation groups employee reports into campaign-level incidents, and a single employee report can trigger the removal of a confirmed campaign from every inbox in your company in minutes. |
The Hoxhunt fake recruiter simulation
Hoxhunt has built a simulation of this attack, so your employees meet a fake recruiter in training before a real one finds them. It follows the same chain as the real scam:
- The invitation: A job interview invitation arrives by email from a recruiter at a company that does not exist.
- The interview: The employee joins a video interview with an AI interviewer in a fake meeting window.
- The take-home task: The interviewer asks the employee to download a take-home task.
- The result: If the employee downloads it, the simulation counts as a fail, and the employee gets short training on the red flags they missed right away.
Our deepfake phishing training page walks through a simulated call step by step, from the employee’s side, and shows how a custom deepfake of your own executives is built.
Questions to ask any vendor about this attack
If you are comparing security awareness platforms, these questions show whether a vendor covers a fake recruiter scam end to end:
- Does it simulate attacks beyond email, in Microsoft Teams, on phone calls, and on video calls?
- Does it set the difficulty for each person, or for a whole campaign at once?
- Can one employee report remove the same campaign from every inbox?
- Do its deepfake simulations run inside the meeting platform your company already uses?
Frequently asked questions about fake recruiter scams
What is a fake recruiter scam?
A fake recruiter scam is an attack where someone poses as a recruiter and uses a fake hiring process to steal logins, personal data, or company access. Modern versions end with malware: a take-home test, a project file, or a fake meeting-app update that runs the attacker’s code on the candidate’s device.
Is a fake recruiter scam a risk for the company or only for the job seeker?
A fake recruiter scam is a company risk whenever the employee uses a work device or work accounts. Campaigns target marketers who run ad accounts, developers who run code on their machines, and finance and crypto organizations, so the attacker’s real goal is often the employer.
How did a fake job interview lead to the Binance hack?
Binance says a software engineer was contacted on a legitimate job-hunting platform, interviewed on video by a fake HR representative and then by the “CEO” of a fictitious company, and asked to download a coding assignment onto his work computer. The assignment contained zero-day malware that endpoint tools missed, and the attackers used that laptop to reach the wallet team before about $6.34 billion in digital assets were impacted on October 29, 2026. The FBI attributed the theft to North Korea.
What is Contagious Interview?
Contagious Interview is a North Korea-linked campaign that targets software developers with fake job interviews. Fake recruiters ask candidates to run a coding project or install a “fix” during a video call, and the code installs malware. Palo Alto Networks Unit 42 named it in 2023, and Google reported it still active in 2025.
Do attackers use deepfakes in job interviews?
Yes, but the documented cases so far are on the candidate side: the FBI has warned that North Korean IT workers use face-swapping in video interviews to get hired. No public report yet shows a deepfake interviewer targeting a candidate, but live video interviews are already part of these campaigns.
How can employees spot a fake recruiter?
Employees can spot a fake recruiter by checking whether the offer was unsolicited, whether the sender’s domain matches the company, whether the first step is a login, whether the chat moves off-platform, and whether they are asked to run anything. They should verify the role on the company’s official careers site before replying.
How do you train employees against fake recruiter scams?
Training against fake recruiter scams combines one clear rule (nothing from a recruiter runs on a work device), easy reporting, and realistic practice. Simulations that include the video-call step as well as the first email teach people that a convincing face and voice are not proof.
How does Hoxhunt protect employees from fake recruiter scams?
Hoxhunt trains employees with phishing, deepfake, and voice phishing simulations across email, Microsoft Teams, and video meetings, so they recognize each step of a fake recruiter scam, and it makes reporting one click. Hoxhunt also runs a simulation of the scam itself, from the interview invitation to the take-home task. Hoxhunt’s phishing incident response automation then groups the reports into one incident, and a single report can trigger the removal of a confirmed campaign from every inbox.
Sources
- Hoxhunt, Phishing Trends Report 2026, pp. 24-25 (recruitment scams as a top new threat; Calendly and browser-in-the-browser lure).
- Secure Culture Hub, Recruitment Phishing, July 2026.
- Secure Culture Hub, Phish of the Week, 12 October 2026 (fake Google AI recruiter via Zoom Events).
- Secure Culture Hub, Phish of the Week, 26 October 2026 (fake Zoom update pushes ScreenConnect).
- Binance, 29 October Binance Security Incident: Initial Findings and Response Update, November 2026.
- FBI, North Korea responsible for $6 billion Binance attack, October 2026.
- Google Threat Intelligence Group, DPRK Adopts EtherHiding, October 2025.
- Microsoft Threat Intelligence, Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise, April 2026.
- Palo Alto Networks Unit 42, Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors, November 2023.
- Palo Alto Networks Unit 42, North Korean synthetic identity creation, April 2025.
- FBI IC3, PSA I-012325-PSA, January 2025.
- Gartner, deepfake attack survey of 302 cybersecurity leaders, September 2025.
Get more cybersecurity insights like this
- Subscribe to All Things Human Risk to get a monthly round up of our latest content
- Request a demo for a customized walkthrough of Hoxhunt
.webp)