You can lose crypto before you get the job. Nobody promises returns, and nobody asks for a seed phrase; a recruiter offers to discuss a role, but first needs a quick update. Here is how that update empties wallets, with the cases behind it, and the one habit that ends the interview at the right moment. Published for Cybersecurity Awareness Month 2026.

A “recruiter” arranges an interview, then replaces the meeting link at the last minute. The new page says your conferencing app needs an update, or that a command pasted into the terminal will fix the connection. The update is malware that collects passwords, browser sessions, exchange logins, and wallet secrets. The defense: join only through the app you already have, and treat any install request as the end of the call.

It starts with a job, not with crypto

The sequence security researchers reported through 2026 is unremarkable until the last step, which is why it works. A recruiter messages you directly. The vacancy is plausible, the company exists, and nothing in the conversation touches money. You agree on a time. Often you create the meeting yourself and send the invitation, so the link is yours.

Shortly before the call, the other side reports a problem: the link won’t open, their client is outdated, or they try this one instead. Anyone who has ever gathered colleagues for a work call has lived through a Zoom problem and will not find this strange. The new link opens a page that looks like Zoom, Microsoft Teams, or Google Meet and asks for one more thing before you can join: install an update, or copy a short command into the terminal to fix an audio error. People are waiting. You do not want to be late. Sorting out the connection becomes more important than reading exactly what you’re being asked to run.

What runs is malware. Depending on the family, it can take saved passwords, active browser and messenger sessions, exchange logins, and the files and extensions that hold wallet keys, and the theft follows days or minutes later.

The update is the attack

Switzerland’s National Cyber Security Center described the pattern in its weekly review for the 26th week of 2026: victims receive invitations to fake Zoom meetings and are prompted to download a supposedly necessary update that contains malware or a remote-access tool; the same scheme has been seen internationally with Teams and Meet. In one of the two cases the agency reported, the victim sent a genuine meeting link, and the counterpart replied with a link to a convincing copy of the Zoom site with an urgent update pop-up. By its 39th-week review, the NCSC was noting a rise in targeted attempts to infect devices, including “ClickFix” attacks and attempts to trick people into downloading malware as part of a recruitment process.

ClickFix is the name for the terminal variant: a page shows an error or a verification step and tells you to paste a command to resolve it. The command is the payload. In July 2026, researchers at JUMPSEC obtained the source code of a phishing kit used by the group known as BlueNoroff, as The Hacker News reported. The kit imitates Zoom and Teams, shows the victim a room with “waiting for other participants,” lets the operator send “your mic isn’t working” messages, and triggers a “Zoom SDK Update” that delivers the command. Before any of that, the page scans the visitor’s browser for wallets, so the operators know who is worth infecting; Cryptopolitan noted that the invitations often arrive from hijacked Telegram accounts of the victim’s own contacts, and each new victim’s contact list becomes the next round of targets.

The cases behind it

The money is documented. In November 2024, Microsoft described a group it tracks as Sapphire Sleet that had stolen more than $10 million in cryptocurrency from multiple companies over six months. The method: set up an online meeting, show the target a frozen screen or an error on the day, send a “fix” script when they ask for help, then hunt the infected device for wallets and credentials. The same group ran fake recruiter profiles on LinkedIn that sent candidates “skills assessments” hosted on attacker sites, as The Hacker News reported from Microsoft’s findings.

In March 2026, Moonlock published its analysis of a campaign aimed at crypto and Web3 professionals, first flagged publicly by one of its targets in January: “venture capitalists” from an invented firm approached targets on LinkedIn, sent a Calendly link, and let Calendly redirect to a fake Zoom page with a ClickFix command for both macOS and Windows. Arctic Wolf described an intrusion that began on January 23, 2026, in which a Calendly invite led to a typo-squatted Zoom link, the audio “stopped working” mid-meeting while deepfaked participants waited on screen, and a prompt offered to update the conferencing “SDK”; the firm counted more than 80 typo-squatted Zoom and Teams domains registered on the same infrastructure between late 2025 and March 2026. The recruiter, the investor, and the partner are the same script with different nouns.

“Every one of these cases ends with a command the victim typed or a file they ran. The attackers never break the laptop. They ask its owner to open it, and they ask when the owner is late for something. Anything a call wants you to install is untrusted code, and the interview can wait a minute while you treat it that way,” said Stefan Lauer, Head of Infrastructure at SimpleSwap.

What gives it away

The link changes at the last minute, and the new one is not from the calendar invitation you created. Joining requires a download or a command, not the app you already use. The “update” page lives in a browser tab, not in the Zoom or Teams menu. The audio or video fails in a way that only an install can fix. You are alone in a room “waiting for other participants” while someone types to you. A page or a person asks you to disable security software for the duration of the call.

Two Cybersecurity Awareness Month habits cover this pattern: update software only through the software itself, and recognize phishing, which here wears a calendar invitation instead of an email.

The check: six steps that end the interview at the right moment

• If a link leads to a download or an “update,” ask for the meeting ID and join through the Zoom, Teams, or Meet app already installed on your machine. A real meeting has an ID that works in the real app.

• Update conferencing apps only from their own menus or the vendor’s site. A browser page is never the place a conferencing app updates itself.

• Never paste a command from a web page into a terminal, PowerShell, or the Run dialog, no matter what error it claims to fix. This solves no connection problem.

• Any request to run a sent file, install an extension, paste a command, or disable protection “for the interview” is sufficient reason to end the call and report the account. A genuine recruiter will reschedule.

• Keep wallets off the machine you use for calls and job hunting, or keep meaningful balances on a hardware wallet. Infostealers take what the browser and the file system can reach.

• If you already ran something: disconnect the machine from the network, assume every password, session, and wallet on it is compromised, move funds from a clean device to a new wallet, revoke sessions and change passwords from that clean device, and report the incident to the company being impersonated.

What the check does not prove

Joining through the app you already have sidesteps a potentially malicious page. It does not prove the earlier link was malicious, and it says nothing about who is on the other end or whether the vacancy exists. A clean antivirus scan after running a command proves little, because several of these campaigns use fileless payloads and remote-access tools built to pass it. And a call where nothing was installed can still be a reconnaissance step: the kit JUMPSEC described checks your wallets before it decides whether to attack.

Where this meets your swap

SimpleSwap is a self-custodial, wallet-to-wallet swap aggregator: funds move from a wallet you own to a wallet you own, and the service never sees your laptop, your sessions, or your keys. That is the limit too. A swap signed from a wallet whose keys an infostealer copied looks exactly like one you signed, and no service can reverse it.

What we can do is name the rule from our side. No interview, ours included, requires installing software from a link in a chat, running a command, or switching off protection. SimpleSwap support never messages first, and the Safety Academy keeps the current list of impersonation patterns. Our only official domain is simpleswap.io.

FAQ

What is the fake interview scam with a Zoom update?
A “recruiter” arranges a call, then replaces the meeting link shortly before it starts. The new page imitates Zoom, Teams, or Meet and requires an “update” or a pasted terminal command to join. The update is malware that steals passwords, sessions, and wallet keys. Switzerland’s NCSC and Microsoft have both documented the pattern.

Can a Zoom link install malware?
A real Zoom link cannot. A fake page styled as Zoom can offer a download or a command, and running either installs the malware. Join only through the app already on your machine, using the meeting ID, and update the app only from its own menu.

I ran the “update” before the interview. What should I do?
Disconnect the machine from the network and assume everything on it is compromised. From a different, clean device, move crypto to a new wallet, change passwords, revoke active sessions on exchanges, email, and messengers, and report the incident to the company whose name was used.

Is a SimpleSwap swap at risk if my laptop was infected?
SimpleSwap never has access to your private keys. If malware compromises the wallet on your device, your funds are at risk regardless of where you swap. Before swapping, use a clean device to move your funds to a new wallet with a new seed phrase.

This article is for educational purposes only and is not financial or investment advice. Products and services named here are examples, not endorsements, and none replace your own judgment. SimpleSwap’s only official domain is simpleswap.io.