Malwarebytes Labs Finds Fake Calendly Pages Stealing Meta and Google Logins

Malwarebytes Labs published research detailing a phishing campaign that uses fake Calendly scheduling pages to steal Facebook and Google account credentials. The attackers disguise these malicious sites as legitimate interview booking portals for Meta careers, targeting job seekers who expect to schedule phone calls with recruiters.

According to the findings, victims select a time slot for a thirty-minute call and provide personal details before being prompted to log in to Facebook. The pages then request two-factor authentication codes and subsequently ask for Google sign-in credentials, claiming Facebook requires this step for security purposes.

How the Phishing Mechanism Works

The malicious sites replicate the visual design of Calendly, including a monthly calendar, time zone picker, and available slots loaded from the attackers' servers. After users enter their name, email, and phone number, they encounter a fake CAPTCHA grid that may hinder automated security scanners from analyzing the page content.

The Facebook login screen is embedded within the page, featuring a fabricated address bar to mimic a genuine browser pop-up. It includes realistic error messages and requests for a "Career Profile" sign-up. If the account has two-factor authentication enabled, the page prompts the user to input the code from their authenticator app, text message, WhatsApp, or email.

Who Is Affected and Why It Succeeds

Job seekers are the primary targets, as the promise of an interview at a major tech company like Meta creates urgency and excitement. Users accustomed to sharing personal information with recruiters may lower their guard, especially after already providing their name and contact details on the form.

The campaign exploits the routine nature of scheduling interviews. By the time the page requests unusual login steps, victims have already invested effort in the process. The fake Google sign-in screen asks for passwords and additional verification methods, such as tap prompts or recovery email addresses, sending all data to the attackers' collection server.

What should you do?

Malwarebytes Labs advises anyone who has entered passwords or approved sign-in prompts on these pages to secure their affected accounts immediately. The fake confirmation screen states a calendar invitation was sent, but no actual interview is scheduled. Users should be wary of any unsolicited interview links that request social media or email logins.

What to do and how to stay safe: Malwarebytes

• Check your Facebook and Google account security settings for unfamiliar login locations or devices if you clicked a suspicious interview link.
• Enable two-factor authentication using a hardware key or authenticator app if you have not already, as this can help detect unauthorized access attempts.
• Verify the URL of any scheduling page before entering personal information, ensuring it matches the official domain of the company or tool you expect to use.
• Monitor your email and social media accounts for unexpected password reset requests or login alerts that indicate an attacker may have your credentials.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Do these fake pages actually connect to Meta or Calendly?

No, the pages are not affiliated with Meta, Calendly, or Google, according to Malwarebytes Labs.

Can this scam bypass two-factor authentication?

Yes, the pages ask users to manually enter their 2FA codes, allowing attackers to complete the login process.

How do the attackers make the pages look real?

They use fake address bars, realistic error messages, and a CAPTCHA grid to mimic legitimate browser behavior and scheduling tools.