Cybercriminals are using fraudulent job interview scheduling pages that impersonate Meta and Calendly to steal Facebook and Google login credentials, including two-factor authentication (2FA) codes, in a phishing campaign targeting job seekers.
The campaign, detailed in an October 14 report by cybersecurity firm Malwarebytes, uses convincing copies of Calendly’s appointment booking interface to trick applicants into believing they are scheduling interviews with Meta recruiters.
Researchers identified 11 phishing domains associated with the operation, which combines fake recruitment pages, counterfeit login windows, and interactive authentication prompts to capture account credentials.
The fraudulent websites display a page titled “Calendly | Meta Careers,” featuring a monthly calendar, time zone selector, and available appointments for a 30-minute phone interview. The scheduling interface retrieves available time slots from an attacker-controlled server, making the booking process appear legitimate.
After selecting an appointment, visitors are asked to provide their name, email address, and phone number. They are then presented with a fake CAPTCHA verification challenge before being redirected to a counterfeit Facebook login screen.
The login interface closely resembles Facebook’s authentic sign-in page and includes a fabricated browser address bar displaying a legitimate-looking Facebook URL. Because the window is rendered within the malicious webpage rather than opened as a genuine browser window, attackers can control its appearance and collect submitted credentials.
Victims are subsequently prompted to enter Facebook authentication codes received through text messages, WhatsApp, email, or authentication applications.
The phishing sequence then attempts to compromise Google accounts by falsely claiming that Facebook requires users to authenticate with the Gmail address associated with their accounts.
Fake Google login screens request passwords and additional verification details, including authentication codes, recovery email addresses, or approval of sign-in notifications.
According to Malwarebytes, the phishing infrastructure communicates with an attacker-controlled server throughout the process. This allows operators to attempt real account logins using stolen credentials while directing victims through corresponding verification screens.
If an authentication code is rejected, the fraudulent page can request another. Attackers can also instruct victims to approve Google sign-in prompts, potentially allowing unauthorized access despite two-factor authentication being enabled.
The researchers discovered several technical indicators suggesting the attackers are operating a reusable phishing toolkit. Its code contains version number 0.8.0, detailed error logging, and campaign identifiers that could support multiple phishing operations.
The infrastructure also uses Amazon API Gateway in AWS’s Singapore region to collect stolen information. Researchers identified a Vietnamese-language comment in the source code, although Malwarebytes cautioned that neither the language nor the hosting location establishes the attackers’ identity or geographic origin.
The 11 identified domains use recruitment-related names, including variations of joinhire, joinquest, and jointhetalent, across .cfd, .info, and .works domains. None are affiliated with Meta, Calendly, or Google.
Compromised Facebook accounts could expose business pages and advertising accounts, while access to Google accounts could enable attackers to obtain sensitive emails and reset passwords for other connected services.
Malwarebytes advises job seekers to verify interview invitations through official company channels, inspect actual browser addresses, and avoid entering social media credentials into appointment booking pages. The researchers also recommend using phishing-resistant authentication methods such as passkeys or hardware security keys. Google confirms that passkeys provide stronger protection against phishing because they cannot be copied or inadvertently submitted to fraudulent websites in the same way as passwords.
Users who may have entered their credentials into suspicious recruitment pages should immediately change affected passwords, terminate unfamiliar sessions, and review account recovery settings. Those who have lost account access can use the official Facebook account recovery service or Google’s compromised-account recovery guidance.
Leave a Reply