Fake Meta interview pages bypass two-factor authentication to steal accounts

Malwarebytes Labs identified a campaign using counterfeit scheduling pages to harvest login credentials from job seekers. The sites impersonate Calendly, a popular tool for booking interviews, and claim to represent Meta recruiters. According to the research, these pages are designed to steal Facebook and Google passwords, effectively bypassing two-factor authentication protections that users rely on for account security.

The deception begins with an invitation to a thirty-minute phone call. Victims select a time slot and enter personal details like name and email address. The interface mimics a legitimate booking process, complete with a calendar view and time zone picker. This familiarity lowers suspicion, making the subsequent request for login credentials appear as a standard procedural step rather than a security threat.

What we know

The fake pages display a title reading "Calendly | Meta Careers" and load available times from the attackers' own server. After the user picks a slot, they encounter a form for personal details followed by a fake CAPTCHA grid. This visual element adds legitimacy and may hinder automated security scanners. The page then presents a window copying Facebook's login screen, complete with a simulated address bar and realistic error messages.

Once the user enters their Facebook password, the page requests their two-factor authentication code. It accepts codes from authentication apps, text messages, WhatsApp, or email. Following this, the site claims Facebook requires a Google sign-in for security purposes. It displays fake Google screens asking for passwords and additional verification steps, such as tapping a phone prompt or entering a recovery email.

All entered data, including passwords and security codes, is transmitted to the attackers' collection server. The page finally displays a confirmation message stating a calendar invitation was sent. The system remains connected to the attackers' server throughout the process, waiting for instructions on which screen to display next. This dynamic control allows the scammers to adjust the flow in real time.

Defender's checklist

• Verify the URL of any scheduling link before entering personal details or credentials.
• Check that the domain matches the official vendor or company name exactly.
• Be wary of requests to log in to social media accounts during job applications.
• Monitor account activity for unauthorized access after interacting with suspicious links.

The background in plain language

Phishing attacks often exploit trust in familiar services. By copying the look and feel of a known tool, attackers reduce the cognitive load required for a user to act. Two-factor authentication adds a layer of security, but it can be bypassed if the attacker captures the code in real time. This technique, known as man-in-the-middle, intercepts the second factor before it reaches the legitimate service. Teams usually advise verifying requests through separate channels. Check whether the sender used a corporate email address. Look for inconsistencies in the interface design. Trust your instincts if a process feels rushed or unusual.

What to do and how to stay safe: Malwarebytes

• If you entered credentials on a suspicious page, change your passwords immediately on a trusted device.
• Revoke active sessions for your social media and email accounts to disconnect any unauthorized access.
• Enable alternative two-factor methods, such as hardware keys, if your service supports them.
• Report the fake page to the impersonated companies and relevant cybersecurity authorities.

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are these fake pages affiliated with Meta or Calendly?

No, the pages are not affiliated with Meta, Calendly, or Google, according to Malwarebytes Labs.

Can this scam bypass two-factor authentication?

Yes, the pages are designed to steal two-factor authentication codes along with passwords.

What happens after a user enters their details?

The page sends the information to the attackers' server and displays a fake confirmation message.