Scammers use fake Calendly pages to trick job seekers into handing over Meta interview credentials and 2FA codes
Attackers mimic interview scheduling tools to bypass two-factor authentication and harvest login details from job seekers targeting Meta roles.
Key points
- Fake Calendly booking pages harvest Facebook and Google passwords along with two-factor authentication codes.
- The scam uses real-time server communication to dynamically present login screens and bypass automated scanners.
- Victims are tricked into believing they are completing a standard Meta interview scheduling process.
Malwarebytes Labs identified a phishing campaign exploiting the trust users place in Calendly scheduling interfaces to steal credentials from Facebook and Google accounts. The operation targets job applicants expecting interview invitations from Meta, using cloned booking pages that mimic the legitimate scheduling tool’s design and functionality.
Root cause
The attack succeeds by replicating the visual interface of Calendly, including calendar views and time zone selectors, to create a convincing disguise. Attackers load available time slots from their own servers, making the schedule appear authentic. This routine interaction lowers user suspicion, as selecting a meeting time and entering basic details is a standard part of the application process.
Attack path
Visitors select an interview slot and submit personal details before encountering a fake CAPTCHA grid. The page then presents a cloned Facebook login window, complete with a simulated address bar and realistic error messages. If two-factor authentication is enabled, the page requests the security code. Subsequently, it demands Google sign-in credentials, claiming Facebook requires verification of the associated Gmail address.
Affected versions
This campaign does not target a specific software vulnerability or version. Instead, it exploits user behaviour and the trusted appearance of third-party scheduling services. The fake pages are designed to look identical to current Calendly interfaces, meaning any user interacting with unsolicited booking links is potentially at risk regardless of their software configuration.
Mitigation
- Verify the sender’s identity through a separate, trusted communication channel before clicking any scheduling links.
- Check the URL carefully for discrepancies, even if the page displays a fake address bar within the browser window.
- Be cautious of requests for two-factor authentication codes during unsolicited login prompts, as this indicates credential theft.
What it means for organisations
Security teams should assess how employees handle external scheduling links and whether current training covers multi-step phishing scenarios. Organisations need to determine if their identity providers can detect anomalous login patterns associated with credential harvesting. Incident response plans must account for scenarios where two-factor authentication is bypassed via social engineering. Leadership should be informed about the risk of account takeover through trusted third-party service impersonation.
Background: Phishing
Phishing uses deceptive messages to steal data, while vishing uses voice calls to manipulate victims. The core difference is the medium. Email relies on visual cues and links, whereas voice relies on urgency and tone. Both aim for credential theft, but voice attacks bypass text-based security filters entirely.
Read the full guide: Phishing vs Vishing: How Audio Bypasses Your Defences
What to do and how to stay safe: Malwarebytes Labs
- Monitor account activity for unexpected logins or password reset requests following any interaction with scheduling links.
- Review connected applications on social media and email accounts to remove any unrecognised access permissions.
- Enable additional security alerts for new device logins and unusual location changes on critical accounts.
- Report suspicious booking links to the relevant platform’s abuse team to help identify the campaign’s scope.
Step-by-step guide: Social Engineering Response: Containment and Recovery Steps
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can this attack bypass two-factor authentication?
Yes, the fake pages request the two-factor authentication code directly from the user after they enter their password, allowing attackers to complete the login process.
Is Calendly software vulnerable to this exploit?
No, the attack uses fake websites that mimic the Calendly interface; it does not exploit a technical vulnerability in the Calendly application itself.
How do attackers keep the fake pages dynamic?
The pages communicate with the attackers’ server in real-time to determine which screen to display next, allowing them to adapt the phishing flow based on user input.
