Information as of 4 November 2026. A plausible recruitment message and technical test can be used to deliver malicious software. Staff using company devices should verify the organisation and file source first.
What did researchers find?
In September 2026 Kaspersky disclosed a campaign targeting aviation and fintech sectors in the Middle East and Africa. Attackers posed as recruiters on LinkedIn, contacted software engineers and offered a link to download a technical assessment. Related malware was also detected in other countries.
Why is this a business risk?
Running untrusted software on a company-managed device can give an attacker an opportunity to access the device or work data. Not every recruiter or coding exercise is malicious, but unknown code should be verified before it is run.
What can employees do?
Verify the role and contact through the recruiting company's official website and a known contact channel, rather than relying only on details in the message. Do not run unapproved assessment software on a work device; ask IT to review anything suspicious.
How can companies prepare?
Set clear rules for software installation and external tests on company devices, restrict unnecessary administrator permissions, and make suspicious files easy to report. If malicious software may have been run, contact IT immediately and follow the incident response procedure.
Related services and reading
Discuss device, account and day-to-day IT support needs with Connet One. Explore managed IT services →
Read: the first hour of an IT incident