Counterfeit scheduling sites mimic Meta interviews to steal Facebook and Google logins with 2FA
Counterfeit scheduling sites mimic Meta interview bookings to harvest Facebook and Google logins, bypassing two-factor authentication protections.
Key points
- Malwarebytes Labs identified fake Calendly pages posing as Meta Careers interview bookings.
- The scam steals Facebook and Google credentials, including two-factor authentication codes.
- Attackers use server-side logic to dynamically display login screens and capture data.
Malwarebytes Labs reported a campaign using counterfeit Calendly booking pages to steal Facebook and Google login details. These sites impersonate Meta Careers interview scheduling, tricking job seekers into surrendering credentials and two-factor authentication codes. The operation targets individuals actively seeking employment at the social media giant.
How does the attack work?
The fake pages replicate the Calendly interface, showing a calendar for a thirty-minute phone call with a recruiter. Visitors select a time and enter personal details like name and email. The site then displays a fake CAPTCHA before prompting for Facebook login credentials. This sequence mimics legitimate scheduling workflows to lower user suspicion.
Why does it bypass two-factor authentication?
The pages capture two-factor authentication codes in real time. After the victim enters their Facebook password, the site asks for the security code from an authenticator app, text message, or email. It then requests Google sign-in details, claiming Facebook requires verification. All entered data is sent to the attackers' server immediately.
What makes this disguise effective?
The scam leverages the routine nature of scheduling interviews. Users are accustomed to sharing contact details with recruiters and clicking booking links. The excitement of a potential Meta interview encourages quick action without verifying the source. The fake address bar within the login window further reinforces the illusion of legitimacy.
Questions to ask your suppliers
Security teams should verify whether scheduling tools used by recruiters integrate with identity providers securely. Ask vendors if they monitor for domain impersonation or brand spoofing in their ecosystem. Determine who within HR and IT is responsible for validating external booking links. Check if employees receive training on recognizing counterfeit scheduling interfaces. Ensure that service agreements include clauses for rapid response to phishing campaigns targeting your brand.
Background: Phishing
This checklist provides actionable technical controls to stop phishing. It covers email authentication, identity hardening, and endpoint detection. Implement these measures to reduce reliance on user training and close common infrastructure vulnerabilities that attackers exploit.
Read the full guide: Phishing Prevention Checklist for Technical Defenses
What to do and how to stay safe: Malwarebytes
- Check account activity for unauthorized logins or new devices.
- Reset passwords for affected social media and email accounts.
- Enable two-factor authentication using hardware keys where possible.
- Monitor for unexpected calendar invitations or email forwarding rules.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these pages affiliated with Meta or Calendly?
No, Malwarebytes Labs states these pages are not affiliated with Meta, Calendly, or Google.
Does the scam steal Google passwords?
Yes, the page asks for Google sign-in details after capturing Facebook credentials.
Can two-factor authentication stop this attack?
No, the page captures two-factor codes in real time to bypass this protection.
