Severity: High
Summary
This campaign uncovered a phishing campaign using fake Calendly booking pages impersonating Meta Careers to lure job seekers into fraudulent interviews and steal their personal information. The pages imitate Facebook and Google login screens to harvest credentials, two-factor authentication (2FA) codes, and sign-in approvals, enabling attackers to bypass MFA protections and take over accounts. The campaign uses attacker-controlled infrastructure and a reusable phishing kit to relay authentication attempts in real time and exfiltrate submitted data.
Indicators of Compromise (IOC) List
Domains/Urls | joinconnect.cfd joinconnect.works joinhire.cfd joinhire.info joinquest.cfd joinquest.info joinquest.works jointhetalent.cfd jointhetalent.info jointhetalent.works jointheteam.cfd rkrt01c0mc.execute-api.ap-southeast-1.amazonaws.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "jointheteam.cfd" or url like "jointheteam.cfd" or siteurl like "jointheteam.cfd" or domainname like "jointhetalent.works" or url like "jointhetalent.works" or siteurl like "jointhetalent.works" or domainname like "rkrt01c0mc.execute-api.ap-southeast-1.amazonaws.com" or url like "rkrt01c0mc.execute-api.ap-southeast-1.amazonaws.com" or siteurl like "rkrt01c0mc.execute-api.ap-southeast-1.amazonaws.com" or domainname like "jointhetalent.cfd" or url like "jointhetalent.cfd" or siteurl like "jointhetalent.cfd" or domainname like "joinquest.info" or url like "joinquest.info" or siteurl like "joinquest.info" or domainname like "joinquest.works" or url like "joinquest.works" or siteurl like "joinquest.works" or domainname like "joinconnect.works" or url like "joinconnect.works" or siteurl like "joinconnect.works" or domainname like "joinquest.cfd" or url like "joinquest.cfd" or siteurl like "joinquest.cfd" or domainname like "jointhetalent.info" or url like "jointhetalent.info" or siteurl like "jointhetalent.info" or domainname like "joinconnect.cfd" or url like "joinconnect.cfd" or siteurl like "joinconnect.cfd" or domainname like "joinhire.cfd" or url like "joinhire.cfd" or siteurl like "joinhire.cfd" or domainname like "joinhire.info" or url like "joinhire.info" or siteurl like "joinhire.info" |
Reference:
Meta Careers Phishing