4 November 2026
We’re advising New Zealanders to be cautious of downloading apps from the internet, particularly if they have been sent through social media, messaging apps, or by someone they don't know.
If a job opportunity seems too good to be true, or you're asked to download an app before you've had a proper conversation with an employer, take a moment to verify the request is legitimate before proceeding.
How the malware works
Malicious actors are tricking people into manually installing a malicious Android application disguised as a job-seeker app. People are instructed to download the application via chat messaging, and potentially through phone calls from the attacker.
After the person sideloads the application, a fake Google Play update page is presented to the person. This makes the application appear more legitimate and as if it is being downloaded from the official Google Play store.
Once downloaded, the app will request access to a series of settings, in particular "Accessibility" settings. Once these settings have been permitted, the malware is able to modify permissions and settings on the phone, ultimately giving the scammer full access to the device.
The malware can be disguised in a range of different ways, including as a banking app, so this may not be the only way malicious actors are deploying the malware.
How to protect yourself
Be careful with job ads on social media
Treat unexpected job offers or recruitment messages with caution, especially if you’re quickly asked to move the conversation to another platform.
Only download apps from official app stores
Only install apps from trusted sources such as the Apple App Store or Google Play Store. Avoid downloading apps through links sent in social media messages, texts, or messaging apps.
Android defaults to disallowing sideloading of applications. This is called "Installation from Unknown Sources". The NCSC recommends never enabling this setting.
Take your time
Scammers often try to create a sense of urgency, so you act before checking whether something is genuine.
Watch for unusual activity
If your phone starts behaving strangely, becomes unresponsive, or displays unexpected update screens, stop using it and seek advice from a trusted IT provider as soon as possible.
Keep your devices secure
Keep your phone and apps up-to-date, enable security features, use strong, unique passwords for your accounts, and always use multi-factor authentication when possible.
What to do if you’ve been targeted
If you think you've downloaded a malicious app or shared information with a scammer, take the following steps as soon as possible. The sooner you act, the better your chances of limiting any financial loss or further damage.
- Contact your bank immediately if you think your financial information may be at risk.
- Change all your passwords, starting with your email account, banking accounts, and any other accounts you may have used or signed on your device.
- Run a security scan on your device if possible.
- Follow the instructions here to back-up your data and clean your device: Remove malware from your device - Own Your Online
- As the app can install further malware, uninstalling the malicious app may not be enough to completely remove malware from your device. The guide above contains instructions on how to factory reset your device, which is more likely to successfully remove the malware. After resetting your device, only reinstall apps you recognise and trust. Reinstalling the same malicious app could expose you to the same risk again.
- Contact your mobile provider if you believe your phone has been compromised.
- Report the scam to the NCSC here