Jobs site Monster denied that it needs to upgrade its security after recruiters using its service were targeted with malware.
Security firm F-Secure this week revealed that cyber criminals are attacking users with Gameover Zeus malware to steal banking details, and recommended the company strengthen its log-in system with two-factor authentication.
But Monster, which was not aware of the attacks until F-Secure published its blog post, insisted its measures are robust.
A spokesman for the firm told CBR: "Monster employs a layered system to protect access to our site that goes significantly beyond passwords and security questions. We think this level of security and monitoring is an appropriate balance of security and usability.
"We operate under the assumption that we are always a target and take strong measures to defend ourselves."
However, the spokesman added that it has used F-Secure’s analysis to update security procedures and "engage with our industry partners".
Gameover Zeus is a two-stage attack installed via spam advertising or a bot installer, which takes information a user types into forms.
It then attempts to trick the user into giving up the remaining information it needs to take control of the user’s Monster account, by using a fake security check form.
F-Secure said the malware was most probably targeting HR departments using Monster’s site, but that while Gameover bots number in the tens of thousands, it was hard to tell how many victims the hack has caused.
But the consequences for recruiters could be severe. The blog post warned: "HR recruiters with website accounts should be wary. If the account is potentially tied to a bank account and a spending budget … it’s a target for banking trojans."
Monster declined to estimate the number of victims, but said it regularly reminds users of how to protect themselves from malware attacks.
The latest news comes at a bad time for Monster, with the security of the British government jobs site it provides under question.
Universal Jobmatch has been plagued by fake job listings, some of which lead to the risk of identity fraud, and Labour MP Frank Field yesterday warned that jobseekers using the site remain "open to being ripped off" despite government claims the site is safe and functioning.
While a joint statement from Monster CEO Sal Iannuzzi and Jobcentre Plus head Neil Couling said Jobmatch was "here to stay", no commitment to extending Monster’s deal – expiring 2016 – was made.
Monster told CBR Jobmatch users were not at risk from the cyber attacks revealed by F-Secure.
The spokesman said: "Universal Jobmatch is a completely separate site from Monster, both logically and physically. It would not be affected by malware targeting Monster."
