Fake Calendly "Meta Careers" pages steal Facebook and Google logins

This campaign involves fraudulent websites mimicking Calendly booking pages for Meta job interviews to steal credentials from job seekers. Victims interact with the fake pages by selecting interview slots, providing personal information, and completing fake CAPTCHA challenges. They are then prompted to log into Facebook and Google accounts through convincing fake login screens that include fake address bars displaying authentic URLs. The phishing kit captures login credentials and bypasses two-factor authentication by relaying authentication codes to attackers in real-time. Eleven domains with similar naming patterns have been identified, and the collection infrastructure is hosted through Amazon API Gateway in Singapore. Code comments in Vietnamese hint at the possible origin of the threat actors.

The campaign enables attackers to steal Facebook and Google login credentials, including bypassing two-factor authentication, which can lead to account takeover. Victims may suffer from unauthorized access to personal and professional accounts, potential identity theft, and further social engineering attacks. The use of convincing fake login interfaces increases the likelihood of successful credential theft.

No official patch or fix applies as this is a phishing campaign. Users should be educated to recognize phishing attempts, verify URLs carefully, and avoid entering credentials on suspicious sites. Organizations should warn job seekers about this scam and encourage the use of official channels for interview scheduling. Monitoring and blocking the identified malicious domains can help reduce exposure.