A job seeker gets a link to book a 30-minute phone interview with a Meta recruiter. The page looks exactly like Calendly: a monthly calendar, a time zone picker, open slots. But after the visitor picks a time and fills in their details, the page asks them to log in to Facebook, then to Google, and the interview never happens. Researchers at Malwarebytes have found a wave of these fake "Calendly | Meta Careers" pages built to steal both accounts, including the two-factor authentication (2FA) codes that are supposed to protect them.
The pages have no connection to Meta, Calendly or Google. Malwarebytes counted 11 domains, all following the same pattern of "join" plus a recruiting-sounding word on the .cfd, .info and .works top-level domains. None of them mention Calendly or Meta, which means the same names could be reused for lures about other employers.
A booking page that walks you into a login
The fake page loads its available times from the attackers' server so it looks like a real recruiter's diary. After the visitor enters a name, email and phone number, a fake CAPTCHA image grid appears, which makes the page feel legitimate and may also keep automated security scanners away from what follows.
Next comes a copy of Facebook's login screen inside the page, with its own drawn-on address bar showing a Facebook web address so it resembles a genuine browser pop-up. It even returns realistic error messages. If the account uses 2FA, the page asks for the code from an authenticator app, text message, WhatsApp or email. It then claims Facebook needs the visitor to sign in to the Gmail address on the account and shows fake Google screens, again under a fake address bar, asking for the password and whatever Google asks for next: a tap on a phone prompt, an authenticator code, a text code or a recovery email.
How the kit relays two-factor codes live
Unlike pages that grab a password and stop, this kit keeps checking in with the attackers' server and waits to be told which screen to show next. That lets the operators try the stolen password on the real Facebook site immediately and, if Facebook asks for a code, request the same code from the victim and use it before it expires. On the Google side, the page can tell the visitor to "tap Yes" on a phone prompt, potentially approving the attackers' own sign-in. Malwarebytes notes that passkeys and compatible hardware security keys are tied to the genuine site and cannot be relayed this way. Job hunters keep turning up as targets: in August fake Indeed interview apps planted spyware on applicants' phones.
The code carries a version number (0.8.0), detailed error logging and a "campaign key" sent with every message, which Malwarebytes reads as signs of a reusable kit. Stolen data goes to an Amazon API Gateway endpoint in AWS's Singapore region, and a code comment is written in Vietnamese. Malwarebytes is clear that neither detail establishes who runs the pages or where they operate.
Check the real address bar, and use a passkey
Genuine Calendly booking links use calendly.com, and scheduling a call never requires a social media password. Check the browser's own address bar rather than one drawn inside the page; a "pop-up" that cannot be dragged outside the webpage is likely fake. Verify unexpected invitations through the company's official careers site, never approve a phone prompt because a page tells you to, and switch to passkeys or a security key where possible. Anyone who already entered details should change passwords from a trusted device, sign out other sessions, check recovery details, look for unfamiliar Gmail forwarding rules and filters, and review any Facebook business pages or ad accounts they manage.
Indicators published by Malwarebytes:
- joinconnect[.]cfd, joinconnect[.]works
- joinhire[.]cfd, joinhire[.]info
- joinquest[.]cfd, joinquest[.]info, joinquest[.]works
- jointhetalent[.]cfd, jointhetalent[.]info, jointhetalent[.]works
- jointheteam[.]cfd
- Collection endpoint: rkrt01c0mc[.]execute-api[.]ap-southeast-1[.]amazonaws[.]com
The trap works because it arrives at the moment a job seeker most wants to say yes. A real recruiter will wait while you check the link; a scam needs you not to.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.