A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time. The flow is designed to help attackers immediately take over accounts while the victim is still on the page.
This campaign used fake websites designed to look like Calendly booking pages for Meta Careers job interviews. Victims who clicked a scheduling link were guided through selecting a 30 minute interview slot, completing a fake CAPTCHA, and then logging into Facebook. If the account had two factor authentication enabled, the page asked for the code from an authentication app, text message, WhatsApp, or email. Visitors were then told that Facebook required them to sign in to Google as well, supposedly for security, and the fake flow asked for a Google password and whatever additional verification step Google requested.
The phishing pages were interactive rather than static. They adapted their screens based on what the real Facebook and Google login prompts actually required, allowing attackers to attempt the stolen password on the real site right away and request the matching 2FA code before it expired. When a code failed, the page simply displayed an error message and asked the visitor to try again, keeping victims engaged without raising suspicion. The kit also showed signs of reuse, including version numbers, logging, and a campaign key, and sent captured data to a cloud based API endpoint.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers create lookalike Calendly booking pages for Meta job interviews. After picking a time slot and completing a fake CAPTCHA, victims are prompted to log into Facebook and then Google, and the page captures passwords and 2FA codes as they are entered.
The phishing page is interactive and adapts its prompts based on what the real Facebook or Google login requires, so stolen codes can be used on the real site before they expire.
Warning signs include a booking page asking for a Facebook password or 2FA code, a fake drawn address bar inside the page instead of the browser's real one, and a domain that does not match calendly.com or an official Meta careers site.
Never enter passwords or MFA codes into a scheduling flow, verify unfamiliar recruiting domains independently, rely on the browser's actual address bar, and use phishing-resistant passkeys or hardware security keys where possible.
You get a link: “Calendly | Meta Careers – 30‑minute recruiter call.” Looks legit, right? You pick a time, do a fake CAPTCHA, then the page suddenly wants your Facebook password, security code, and even a Google login “for security.” This isn’t scheduling, it’s live credential theft. Here’s the trick: that Facebook and Google “popup” isn’t your browser at all. It’s just a picture of an address bar drawn inside the page, while your passwords and 2FA codes stream straight to an AWS server. If any “Meta interview” link asks you to log in to Facebook or Google, stop. Close it, then open facebook.com or calendly.com yourself and book from there.
Researchers found a large recruitment-themed phishing campaign where victims receive unsolicited interview invites and are sent to fake scheduling or recruitment pages. The pages use “Browser-in-the-Browser” fake login popups to steal Google/Facebook passwords and, in some cases, capture MFA codes…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms like Salesforce, Google Workspace mail-merge, and SharePoint links. The stolen accounts are valuable not just for the budget inside them, but because older accounts with…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
