Malwarebytes found fake Calendly-style pages offering Meta interviews, then requesting passwords, sign-in codes, and phone approvals. Verify the recruiter before signing in.
In 60 seconds
- Unexpected Meta interview links should be checked through the company’s official careers site and an independent contact.
- Do not give a booking page a Facebook or Google password, sign-in code, or phone approval.
- Check the browser’s real address bar, not an address bar drawn inside the webpage.
- If you entered details, secure the affected account directly and review sessions and recovery settings.
Who should care and what to do today
This report concerns people who receive unexpected invitations for Meta job interviews. Malwarebytes found pages that copy a Calendly scheduling screen, offer a 30-minute phone call, and then ask visitors for Facebook and Google sign-ins.
If you receive one, open Meta’s official careers site separately and check whether the role exists. Verify the recruiter through an independent contact. Before signing in anywhere, inspect the browser’s real address bar.
Do not enter a Facebook or Google password into a booking page. Do not share a security code or approve a phone sign-in request because the page tells you to. If you already entered information, go directly to the affected service from a trusted device and secure the account.
How the fake interview pages work
The reported pages show a calendar, time-zone choices, and available interview times. They ask for a name, email address, phone number, and other details that supposedly help prepare for the call. A fake CAPTCHA—a test asking you to select certain pictures—comes next.
The page then displays a fake Facebook login window. It includes a made-up address bar and realistic error messages. Visitors are asked for their Facebook password and, when enabled, a two-factor authentication code. Two-factor authentication is an extra sign-in check, such as a code from an app or a text message.
The page next claims that Facebook requires a Google sign-in. It asks for the Google password and may request an authentication-app code, text message code, recovery email address, or approval on a phone. Malwarebytes reported that information entered into these screens is sent to the operators’ collection server.
A final screen says that a calendar invitation was sent and that someone will respond within 90 minutes. Meanwhile, Malwarebytes said the operators may try the stolen details on the real Facebook or Google sites.
Why a code or phone prompt may not stop the theft
Two-factor authentication still makes account theft harder, so keep it turned on. The problem is that this scam asks the visitor to hand over the second sign-in step while the operators attempt a real login.
Malwarebytes described the page as communicating with the operators while the visitor uses it. If Facebook or Google asks for a code, the fake page can request that same code. If Google sends a sign-in prompt, the page can tell the visitor to tap “Yes.” That can approve a login the visitor did not start.
A passkey or compatible hardware security key can resist this type of page because it is tied to the genuine website. That protection can be lost if someone chooses a password-and-code fallback and gives those details to the fake page.
What to check after clicking or signing in
If you entered a password or approved a prompt, go directly to the real Facebook or Google service from a trusted device. Change the affected password, sign out other sessions, and review security methods, recovery email addresses, and phone numbers. Do not use a link from the interview message.
Change the password anywhere else you reused it. If both accounts were involved, secure Google promptly because email access may help someone reset other accounts. Check Gmail for unfamiliar forwarding rules and filters. Also review any Facebook business pages or advertising accounts you manage.
If you only gave the page your name, email address, or phone number, watch for follow-up messages that use those details to make another request sound believable. If you are locked out, use Meta’s account recovery support or Google’s compromised-account guidance.
Malwarebytes listed recruiting-sounding domains such as joinhire, joinquest, and jointheteam, with endings including .cfd, .info, and .works. Direct Calendly booking links use calendly.com, although legitimate booking forms can also be embedded on other websites. The page’s appearance alone is not proof that an invitation is real.
Does this affect me?
- Who may be affected
- Job seekers who receive unexpected invitations for Meta interviews or encounter a Calendly-style page that asks for Facebook or Google sign-in details.
- How to check
- Open Meta’s official careers site separately, confirm the role and recruiter, and inspect the browser’s real address bar before signing in.
- What to do
- If you entered a password, code, or approved a prompt, secure the affected account directly from a trusted device and review active sessions and recovery settings.
- What to avoid
- Do not give a booking page a Facebook or Google password, share a sign-in code, or approve an unexpected phone prompt.
Common questions
Does a real Calendly interview booking require a Facebook or Google password?
No. A scheduling page should not need your Facebook or Google password, security code, or phone approval to reserve an interview time. Verify any unusual request with the company independently.
Can two-factor authentication protect me from this scam?
It helps, but it cannot protect an account if you enter the code into a fake page or approve a sign-in prompt for someone else’s login. Keep it enabled and use it only for a sign-in you started on the genuine service.
What if I already entered my password and code?
Go directly to the real Facebook or Google service from a trusted device. Change the password, sign out other sessions, check recovery settings, and change the password anywhere else you reused it. If both accounts were involved, secure Google promptly and review Gmail forwarding rules and filters.
How can I tell whether an interview invitation is genuine?
Check Meta’s official careers site for the role and contact the company through an independent address. Inspect the browser’s real address bar. A page that asks for social media or email credentials during scheduling is not a normal interview step.
Primary source
This article is based on Malwarebytes, “Fake Calendly ‘Meta Careers’ pages steal Facebook and Google logins,” published October 14, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins. Malwarebytes reports the pages, their behavior, and account-recovery steps. Read the complete original source.
Concerned this may affect your computer or account?
Bring the exact alert, device, product, and timeline. Leon will help separate urgent action from noise.
Article history: Published Oct 14, 2026 at 9:19 am EDT. Updates and corrections are noted here when material facts change.
