Fake Calendly Pages Mimic Meta Careers to Steal Facebook and Google Logins
Threat actors are using sophisticated phishing pages disguised as Calendly interview scheduling tools to steal Facebook and Google credentials, including two-factor authentication codes.
A wave of malicious websites impersonating Meta's career portal and leveraging the legitimate Calendly scheduling service has emerged, aiming to pilfer sensitive login credentials from job seekers. These phishing pages trick unsuspecting victims into believing they are scheduling an interview for a position at Meta, a highly sought-after tech company.
The attackers have meticulously crafted these fake pages to mirror Calendly's familiar interface, presenting users with a calendar to select an interview slot, typically a 30-minute phone call with a recruiter. This initial step, combined with the allure of a potential job at Meta, lowers the victim's guard. After selecting a time, users are prompted to enter personal details such as their name, email, and phone number, which is a standard part of the job application process.
To further legitimize the scam, the phishing pages incorporate a fake CAPTCHA, presenting users with a grid of images to verify they are not a bot. This step not only adds a layer of perceived authenticity but may also serve to evade automated security scanners. Once past this hurdle, the attackers reveal their true objective: stealing login credentials.
The scam then directs victims to a fake Facebook login page, presented within the same browser window and even mimicking a Facebook web address in a fake address bar. This deceptive tactic aims to capture the user's Facebook username and password. Crucially, if the account is protected by two-factor authentication (2FA), the phishing page proceeds to request the 2FA code, whether it be from an authenticator app, SMS, or another method, before the code expires.
Following the compromise of Facebook credentials, the attackers escalate their efforts by demanding Google login information. The fake page falsely claims that Facebook requires a Google sign-in for security purposes, assuring users that their data will not be shared. Similar to the Facebook login, a fake Google sign-in screen appears, prompting for the password and any subsequent 2FA prompts or codes required by Google.
This multi-stage phishing approach is particularly effective because it bypasses the security benefits of 2FA. By presenting the login prompts in real-time as the attackers attempt to access the accounts on the legitimate sites, the victims inadvertently provide the necessary codes or approve sign-in requests. The attackers can then use these stolen credentials to gain full access to both Facebook and Google accounts, potentially leading to identity theft, financial fraud, or further malicious activities.
Analysis of the phishing kit reveals features like version numbers, detailed error logging, and campaign keys, suggesting a reusable and sophisticated phishing framework. Comments within the code, written in Vietnamese, hint at the potential origin of the kit. The use of Amazon API Gateway in Singapore for the collection server further points to a globally distributed operation.
Security researchers advise anyone who may have entered credentials or approved sign-in prompts on these fake pages to immediately secure their affected accounts by changing passwords and reviewing recent login activity. While passkeys and hardware security keys offer stronger protection against such phishing attempts, users should remain vigilant and scrutinize any unexpected login requests, especially when interacting with job application or scheduling platforms.