This is an important social engineering attack vector that all companies should be aware of. These kind of targeted attacks (often spoofing valid contacts that

This is an important social engineering attack vector that all companies should be aware of. These kind of targeted attacks (often spoofing valid contacts that employees would legitimately exchange documents with) were common since I can remember the space, but using job applications is particularly disingenuous because employees are naturally going to be a bit secretive about those.