Applicants were duped into installing a custom-made virtual meeting software, GrassCall, which would inject malicious software.