Cybercriminals have intensified a phishing campaign by posing as recruiters on popular job platforms. The attackers post vacancies for personal assistants with inflated salaries, and after an initial response they move victims to messengers to collect confidential information.
According to the investigation, one Moscow user responded to a personal assistant vacancy with a stated salary of 400,000 rubles on the HeadHunter platform. After making contact, the "recruiter" suggested continuing the conversation in Telegram — the first warning sign for the applicant. In the correspondence, the attacker said that the company had allegedly recently purchased office space in the Federation Tower in the Moscow City business district, but ongoing renovations were temporarily limiting in-person meetings.
At the online interview stage, the applicant was told that the candidate was being considered to accompany an Italian businessman planning a visit to Russia in March of this year. After ten standard questions, the applicant was offered a probation period with monthly compensation of 300,000 rubles. At the same time, a request followed for a full package of personal data: passport scans, SNILS, TIN, and bank details. As justification, the scammers cited the need to prepare documents in advance with the manager at the Moscow office.
The applicant suspected a fraudulent scheme and suggested an alternative — handing over the original documents in person in Krasnodar. In response, the "recruiter" insulted him, calling him a dim-witted man in cheap glasses, and then instantly blocked the communication channel. Within 24 hours, the vacancy was moved to the archive, and the profile of the fake recruitment specialist was completely deleted from the platform.
HeadHunter recommends that users not send document scans before signing an employment contract and verifying the employer through the company's official channels. All suspicious vacancies can be flagged through the "Report" function in the platform interface.