Fraud Management & Cybercrime
,
Fraud Risk Management
,
Governance & Risk Management
It’s Time for Enterprises to Manage Risks Posed by Compromised Personal Devices
We’ve all read the texts. A corporate recruiter just read your profile and has multiple high-paying job opportunities to discuss. Follow the link, submit your personal information and get ready for a new chapter in your career.
See Also: Thwarting Cyberthreats in the Power Sector
These online job scam campaigns have snared thousands of consumers, leading to credential theft, fraud and breaches. But they’re no longer just a nuisance for consumers. They also pose a direct threat to corporate networks and create new enterprise security risks for CISOs.
A recent advisory by Google warns that scammers are embedding remote access Trojans and info-stealers disguised as interview software or application materials to hack personal devices and corporate systems.
“Victims face severe consequences ranging from financial theft and identity fraud to system compromise that enables credential harvesting and corporate network infiltration,” Google researchers said.
The numbers are in the scammers’ favor. The Global Anti-Scam Alliance’s 2025 report found that 57% of adults experienced an online scam in the past year, and 23% of respondents reported financial losses. Consider a scenario involving a company with 5,000 employees. If 57% of employees are targeted, that’s 2,850 people with phishing emails or texts in their inboxes. Even if only 5% of these attempts successfully deliver the malware, that’s 142 potential points of compromise from devices that access corporate networks and data – and may even share the same passwords.
The modus operandi is simple. Attackers create detailed replicas of career pages of leading companies, fake recruiter profiles posted to professional networks and fraudulent recruitment postings distributed across multiple channels.
The next step is data harvesting. Fake online application forms collect personal data and banking details that fuel financial theft, credential stuffing attacks, business email compromise campaigns and supply chain attacks.
The critical inflection point occurs when victims download job application forms. These downloads deliver RATs that provide persistent backdoor access, info-stealers targeting browser credentials and authentication tokens, and credential harvesting tools that exfiltrate password managers. When the victim’s personal device later connects to a corporate network, the consumer scam can turn into an enterprise security incident.
The problem facing CISOs is that traditional security controls largely do not cover this attack vector. Endpoint detection and response tools do not necessarily monitor personal devices, and network monitoring cannot detect malware installed on devices not yet connected to corporate infrastructure. Data loss prevention tools don’t flag employees submitting personal information to fake recruiters. The visibility gap is compounded by human psychology, according to Eva Casey Velasquez, CEO at ITRC.
“Employees who realize they have been scammed experience embarrassment that prevents disclosure, fear of judgment about job hunting while employed and uncertainty about whether the incident is even reportable,” she said. More than 60% of fraud victims delay reporting by at least 30 days, she said.
Even a single RAT providing network access can result in a data breach costing on average about $4.4 million, according to IBM’s Cost of a Data Breach Report 2025.
How can security teams fight back? The first step is to have clear guidance on incident response protocols to ensure that job scam victimization is reportable. Though, given the sensitive nature, it’s no easy task. “Companies will need to create psychological safety. Leadership needs to have a regular communication normalizing scams exposure,” Velasquez said.
Technical controls must expand to cover the extended perimeter. This includes mandatory endpoint protection on any device accessing corporate email, behavioral analytics for unusual data exfiltration following credential use and multifactor authentication mandated for all corporate access, said Brett Johnson, a consultant on cybercrime, cybersecurity and identity theft.
While staff training is a long-term goal, enterprise security awareness training should include dedicated modules on personal device security.
The reality is that the boundary between personal and corporate security has dissolved.
Enterprises can no longer treat job scams as an HR problem. Unmanaged personal devices accessing corporate resources are one of the largest unaddressed attack surfaces. It’s time for enterprises to expand their threat models beyond traditional parameters.