Cybercriminals Used Job Offers to Hack Banking Apps

Imagine this: You receive a promising job offer from what looks like a reputable recruiter. The pay? Great. The company? Trustworthy. All they need is for you to download a “CRM tool” to get started.

Sounds harmless, right?

This is exactly how cybercriminals launched a large-scale attack on banking applications of Australia’s biggest financial institutions — just last week. How did it work? Here is the anatomy of the attack.

📩 The Hook — Fake Job Offers: Victims received messages from individuals posing as recruiters or HR representatives offering dream job opportunities. The emails were polished, the promises enticing, and everything felt credible.

📲 The Bait — Fraudulent App: As part of the process, victims were asked to download a Customer Relationship Management (CRM) application—a tool that businesses often use. What they actually installed was malware in disguise.

💣 The Malware — Taking Over Devices: Once downloaded, the malware (a Trojan known as AppLite Banker) went to work. It deployed fake login screens to steal banking app credentials and allowed attackers to control the device remotely — performing actions without the user knowing.

🎯 The Target — Banking Apps: Prominent financial platforms, including PayPal and National Australia Bank, were in the crosshairs.

💰 The Cost: For businesses, attacks like this are devastating — up to $5,000,000 in losses for a single breach. And don’t forget the cost of recovery — investigations, legal penalties, and rebuilding trust. For customers, the impact is equally damaging. Even if stolen funds are recovered, the delays, stress, and financial disruptions are costly.

At Technopeak, our mission goes beyond providing cybersecurity — we aim to keep you informed and ahead of the game.

Be suspicious of unsolicited messages or job offers, no matter how attractive they seem. Verify everything — especially downloads. No legitimate recruiter should require you to install third-party apps outside trusted platforms. Prioritize cybersecurity — regular audits, monitoring, and staff awareness can make all the difference.