The Facebook login box was a picture of a Facebook login box

You applied for a job at Meta. A recruiter sends a Calendly link. You pick a thirty minute slot for a phone call, fill in your details, clear something that looks like a CAPTCHA, and then the page asks you to sign in to Facebook. A moment later it wants your Google account too, for security. Every step of that is fake except the credentials you just handed over.

Malwarebytes documented the campaign on 14 October. The booking page is a careful copy of Calendly's, titled Calendly | Meta Careers, with the month view and the timezone picker in the right places. The trick is the Facebook window: it is drawn inside the recruiting page, complete with painted-on browser buttons and an address bar reading facebook.com. Your real address bar is still showing something like joinhire.cfd or jointheteam.works. Researchers found eleven of those domains.

Two factor authentication does not rescue you here. The page keeps a live connection to the attacker's server, so the code you type is used on the genuine Facebook within seconds, before it expires. It can also trigger the phone prompt, which means tapping approve on your own handset waves them in. Accounts attached to a business page or an ad account are the ones they want.

The defence is unglamorous. Never trust a login box that appeared inside another page. Try dragging it; a real browser window moves independently of the page behind it, and a picture of one does not. Or just open facebook.com yourself in a new tab and see whether you are already signed in. Passkeys help too, since there is no code to be talked out of. Tendvane's privacy and accounts check walks through how you sign in to Windows and which account protections are currently on.