Grasscall Malware and fake job posting in LinkedIn
Share this post
Beware of Fake Job Listings Spreading GrassCall Malware
Update, October 2026: This article covers the GrassCall campaign reported by BleepingComputer in early 2025. The original report is kept below. Scammers change app names often, so the warning signs and steps in How to Spot a Fake Recruiter and If You Already Installed an App at the end apply to any fake-interview scam.
Scammers are using fake job listings on platforms like LinkedIn to trick job seekers into downloading a malicious video call application called GrassCall. Once installed, this app can steal sensitive data, including bank details and cryptocurrency wallets.
How the Scam Works
-
Scammers post fake job openings on platforms like LinkedIn.
-
When job seekers show interest, scammers persuade them to download the GrassCall app for an interview.
-
The app installs malware that steals personal and financial data.
Evidence and Reports
Cybersecurity experts have identified a cybercriminal group called Crazy Evil as the main operator behind this scheme.
Multiple reports have confirmed this ongoing scam:
How to Stay Safe
To protect yourself from such scams, follow these precautions:
-
Verify Job Listings: Always apply through official company websites.
-
Research the Company: Check their website and social media for authenticity.
-
Avoid Unknown Apps: Legitimate companies use well-known communication tools.
-
Protect Your Data: Never share bank details or personal information unless verified.
-
Report Suspicious Activity: If you encounter a potential scam, report it to LinkedIn or the relevant authorities.
By staying vigilant and informed, you can avoid falling victim to these fraudulent job scams.
How to Spot a Fake Recruiter
-
You must install a special app or "meeting software" you have never heard of, from a link they send. Real employers use common tools such as Zoom, Microsoft Teams or Google Meet, which you can get from the official sites or app stores.
-
The offer is unusually fast or generous, with little or no real interview.
-
They ask for money (for equipment, training or "processing") or for bank, crypto wallet or ID details early on. The FTC warns that honest employers don't ask you to pay to get a job.
-
The contact details don't match the company - a free email address, or a website that doesn't link to the company's real careers page.
Check the job on the company's own careers page, or contact the company through details you found yourself.
If You Already Installed an App
-
Disconnect the device from the internet and uninstall the app.
-
Run a full scan with your security software. Our guide on how to remove malware from Windows walks through it, and 10 signs your computer has malware helps you check whether anything is still running.
-
From a different, clean device, change the passwords of your email, bank and any accounts saved in your browser, and turn on two-step verification.
-
Crypto wallets: if the device held a wallet, treat its keys as stolen and move funds to a new wallet created on a clean device.
-
Tell your bank about any card or account details you entered, and report the scam to the job site and to your national fraud authority (in the US, ReportFraud.ftc.gov).
Frequently Asked Questions (FAQ)
What was GrassCall?
A fake video-call app that scammers asked job seekers to install for an interview. Security researchers reported in early 2025 that it installed malware to steal passwords and crypto wallets.
How do I know if a recruiter is fake?
Warning signs include being told to install an unfamiliar meeting app, requests for money or financial details, and contact details that don't match the company's official website.
What should I do if I installed a fake interview app?
Disconnect from the internet, uninstall it, run a full security scan, change your passwords from a clean device, and contact your bank if you shared financial details.
Do real companies use special apps for interviews?
Most use well-known tools such as Zoom, Microsoft Teams or Google Meet. Download them only from the official website or app store, never from a link in a job message.
Comments