Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter.
After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.
“While the visitor is on the page, it keeps checking in with the attackers’ server and waits to be told which screen to show next,” the researchers write. “That allows the attackers to try the stolen password on the real Facebook site right away. If Facebook asks for a code, the fake page asks the visitor for the same code, and the attackers can use it before it expires. If the code doesn’t work, the page simply says ‘Incorrect code. Please try again.’ The Google screens support the same approach. If Google sends a sign-in prompt to the visitor’s phone, the fake page can tell them to “tap Yes,” potentially approving the attackers’ login. The visitor sees the fake page while the attackers attempt to sign in to the real service out of sight.”
Malwarebytes offers the following advice to help users avoid falling for these attacks:
- “Check the address, not the design. Direct Calendly booking links use calendly.com, although legitimate forms can also be embedded on other websites. Treat an unfamiliar recruiting domain as a reason to verify the invitation independently.
- Don’t give a booking page your Facebook password. Scheduling a call doesn’t require handing your social media password to a recruiter. If a booking flow suddenly asks you to sign in elsewhere, verify both the request and the actual login domain.
- Look at your browser’s real address bar. These fake login windows draw their own address bars showing Facebook or Google web addresses. For a separate pop-up, check the address displayed by the browser itself. A login window that cannot be dragged outside the webpage may be part of the page rather than a separate browser window.
- Verify the recruiter and role. Go directly to the company’s official careers site. A genuine job listing doesn’t prove the person contacting you represents the company, so verify unexpected invitations through an independent contact.
- Don’t share codes or approve unexpected prompts. Only enter a code on the genuine service for a login you initiated. Never approve a phone prompt just because a recruiter or booking page tells you to.
- Use passkeys or a security key where you can. They resist this kind of phishing. Be wary if a page pushes you to use a password and code instead.”
Malwarebytes has the story: https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins
