Fake Calendly “Meta Careers” pages steal Facebook and Google logins

Phishing attempts are occurring using fake booking pages designed to steal user credentials and two-factor authentication codes by mimicking legitimate scheduling platforms like Calendly. Attackers lure victims by framing the process as a routine job interview invitation from Meta, exploiting the urgency felt by job seekers. The scam proceeds by having visitors enter personal details, pass a fake CAPTCHA, and then prompt them to log into Facebook and Google accounts to purportedly complete a security verification process.
The malicious pages replicate the look of a legitimate booking tool, providing a seemingly harmless entry point that masks the actual data harvesting. Attackers maintain control over the sequence of requests, forcing users to provide sensitive information across multiple steps. A key method involves tricking users into providing one-time security codes from authenticator apps or SMS messages on the fake site.
The persistence in this type of attack is enabled by how attackers manipulate authentication flows. By keeping the victim on the malicious page, they can intercept real-time responses, allowing them to use stolen credentials or session tokens immediately upon entering information, circumventing some security measures. The tactics also leverage the fact that job applicants are conditioned to share personal details easily and view interview invitations with high anticipation.

* Attackers create websites impersonating Calendly booking pages for Meta job interviews.
* Visitors select a time slot, enter details, and pass a fake CAPTCHA on these pages.
* The process requires visitors to log in to Facebook and sign into Google accounts.
* The objective is to steal Facebook login details, including two-factor authentication (2FA) codes.
* Fake screens mimic the Calendly booking interface, displaying a calendar, time zone picker, and call options.
* The process involves collecting personal details (name, email, phone number) and prompts for security codes from apps or messages.
* Fake Google screens request passwords and security codes similar to those from Google Authenticator or SMS.
* The page simulates sending a calendar invitation after the user completes the steps.
* Phishing domains follow a pattern including "join" plus recruiting-sounding words on TLDs like .cfd, .info, and .works.
* Attackers use error logging, version numbers, and campaign keys in their phishing kits.
* The collection endpoint uses Amazon API Gateway in AWS’s Singapore region.

The mechanism of this attack leverages the cognitive shortcut where immediate desires—like securing a job interview—override critical security evaluation. The narrative structure expertly exploits familiarity: the routine action of booking a meeting is used as camouflage for a complex credential theft operation. This suggests an understanding that perceived legitimacy, especially when coupled with high-stakes outcomes (like a potential job), creates a powerful inertia against skepticism.
The sophistication lies not just in mimicking interfaces but in controlling the flow of authentication. By forcing users to engage step-by-step across different services (Facebook, Google) and demanding real-time codes, attackers force the victim into performing security actions while the attacker simultaneously attempts login on the real systems, creating a window for code reuse or prompt approval. This structure moves beyond simple credential harvesting into session hijacking orchestrated through multi-stage deception.
The repeated use of generic domain names and the inclusion of detailed technical artifacts like version numbers and specific AWS collection endpoints indicate an organized, reusable infrastructure rather than isolated, opportunistic scams. The focus on stealing Google credentials specifically highlights the goal of achieving broad access to email and associated recovery mechanisms, suggesting that the ultimate payoff is accessing deeper personal data beyond simple login access.
Bridge Questions:
What psychological levers are most effective in compelling individuals to bypass security protocols when motivated by career advancement? How can system-level defenses be designed to detect interactive behaviors across multiple authenticated sessions rather than just static domain checks? If users shift their default expectation from "verification" to "independent confirmation," what systemic changes would enable greater cognitive sovereignty in high-pressure digital interactions?