Fake Job Interviews Are Now Spreading a Dangerous VPN Malware

Emily Davis · 2026-08-11

The Computer Emergency Response Team of Ukraine (CERT-UA) just dropped a warning about a sneaky new cyberattack campaign. Hackers tied to Russia are pretending to be recruiters, reaching out to IT workers with fake job interviews. Their goal? Get you to install a VPN that secretly runs commands on your machine. This isn't some random group of cybercriminals. CERT-UA says the attacks come from a cluster they track as UAC-0145, which is a subgroup within the notorious Sandworm hacking unit (also known as APT44). These are the same folks responsible for some of the most disruptive cyberattacks in recent history, including targeting critical infrastructure in Ukraine and beyond. ### How the Attack Works The social engineering starts with a message that looks like a legitimate job offer. The attacker poses as a recruiter from a well-known tech company and invites the target to a video interview. Once the interview is set up, they send a link or a file that supposedly contains the interview details or a VPN client needed for the call. Here's the kicker: that VPN isn't what it seems. It's a backdoor that gives the attackers remote access to your system. Once installed, it can run commands, steal files, and move laterally across your network without raising any alarms. - The initial contact often comes through LinkedIn, email, or messaging apps. - The attacker pushes a custom VPN client, which is actually malware. - The malware can execute commands, upload files, and download additional tools. ### Why This Matters to You If you work in IT, cybersecurity, or any role that involves sensitive data, you're a target. These attackers aren't just after personal info. They want credentials, access to corporate networks, and any intelligence they can get. The fake interview is just the hook, but the real damage happens after you let them in. We've seen this pattern before. Threat actors love using job offers as bait because they prey on ambition and trust. Who doesn't want to hear about a great new opportunity? But when a recruiter asks you to install software before the interview, that's a massive red flag. ### How to Protect Yourself Here are a few practical steps to keep yourself and your company safe from this kind of attack: - **Verify the recruiter**: Check the domain of their email. If it's not from the actual company's official domain, it's likely a scam. - **Never install software from a link**: Legitimate recruiters won't ask you to install a VPN or any tool before a first interview. - **Use a separate device**: If you're job hunting, use a dedicated machine or at least a separate user profile on your computer. - **Keep your defenses up**: Make sure your antivirus and endpoint detection tools are up to date, and consider using an antidetect browser for sensitive browsing sessions. ### The Bigger Picture This campaign is a reminder that cyber threats are becoming more personal and more creative. Attackers are moving away from generic phishing emails and stepping into targeted, human-centric attacks. They're using psychology, not just code, to break through your defenses. For professionals in the United States, the risk is just as real. While this specific campaign is targeting Ukraine, the techniques are easily repurposed. Sandworm and similar groups have a history of expanding their operations, and the fake interview tactic could easily show up on American shores. ### Final Thoughts Stay sharp out there. If something feels off about a job offer, trust your gut. A little skepticism can save you from a world of pain. And if you're managing a team, make sure your people know about these tactics. Awareness is your first line of defense. Remember, the best way to beat these attackers is to never let them in the door in the first place. Keep your software updated, your tools configured properly, and your instincts sharp.