Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
11 IOCs
Fake Calendly “Meta Careers” pages steal Facebook and Google logins
Malware Families
Excerpt
We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them to log in to Facebook. The interview is fake. The pages are designed to steal the visitor’s Facebook login details, including the two-factor authentication (2FA) codes meant to protect the account. Visitors are then asked to sign in to their…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →11 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | joinhire.info | High | Score 58/100 | First seen |
| Domain | jointhetalent.info | High | Score 58/100 | First seen |
| Domain | joinhire.cfd | High | Score 58/100 | First seen |
| Domain | joinquest.info | High | Score 58/100 | First seen |
| Domain | jointhetalent.cfd | High | Score 58/100 | First seen |
| Domain | joinconnect.cfd | High | Score 58/100 | First seen |
| Domain | joinconnect.works | High | Score 58/100 | First seen |
| Domain | joinquest.works | High | Score 58/100 | First seen |
| Domain | joinquest.cfd | High | Score 58/100 | First seen |
| Domain | jointheteam.cfd | High | Score 58/100 | First seen |
| Domain | jointhetalent.works | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…