Fake Meta Job Interview Pages Are Stealing Your Facebook and Google Logins

You Get a Recruiter Message. It Feels Real. That's the Point.

The message lands in your inbox or LinkedIn DMs. A Meta recruiter, complete with a real name, a real photo pulled from their LinkedIn profile, and a professional headshot, wants to schedule a call about a role that fits your background. A Calendly link makes it feel routine. You pick a 30-minute slot. You show up.

That's where the trap closes.

How the Scam Works

Malwarebytes published an analysis on October 14, 2026, documenting 11 phishing domains built to mimic Meta Careers. The attackers stood up fake Calendly booking pages that look identical to legitimate scheduling tools. The infrastructure runs on AWS in Singapore. Researchers found Vietnamese-language code comments buried in the source, pointing to who built it.

Here is the sequence, step by step.

You confirm a slot. You get a confirmation that looks like any other calendar invite. You click the link at the meeting time. A fake CAPTCHA loads, which adds one more layer of perceived legitimacy. Then the page asks you to sign in with Facebook to access the hiring portal.

That's not a bug in the UX. That's the product.

The moment you type your Facebook password, the page captures it and replays it against the real Facebook login in real time. Your 2FA code appears on your screen. You type it in. The page captures that too and uses it immediately. By the time you finish the login flow, the attacker is already inside your account. You see a loading spinner. You think something went wrong. You try again.

Then a second page loads. This one asks for your Google login.

Both accounts, one session, a few minutes. 2FA does not protect you here because your code is used the moment you type it, not stored for later. The attack doesn't break 2FA. It steals it while it's still valid.

Why Marketing Professionals and Founders Are the Primary Target

This campaign is not random. The attackers chose marketing and communications professionals deliberately. BleepingComputer confirmed the end goal: ad account hijacking.

A stolen personal Facebook account is worth something. A stolen account that controls a Facebook Ads Manager with a payment card attached, manages verified brand pages with tens of thousands of followers, and holds a customer list from years of lead generation is worth a great deal more. Your Google account likely connects to Google Ads, Analytics, Search Console, and a Google Workspace with years of business email.

The attacker doesn't need to steal money from your bank. They run ads on your verified, trusted accounts. They drain your ad budget on fraudulent campaigns. They sell access to other criminals. Your brand's credibility becomes a weapon against someone else's audience.

NordVPN research, reported by CyberNews, found the same fake-Calendly technique deployed against 75 or more major brands, including LVMH, Mastercard, Uber, Disney, and Lego. The operators pull real HR employees' names and photos from LinkedIn to build convincing recruiter personas. The people whose identities get stolen are real employees who have no idea they're being impersonated.

What to Do Right Now

1. Stop signing into third-party services with Facebook or Google. Legitimate hiring platforms do not require your Facebook login. Full stop. If a "hiring portal" asks you to authenticate with a social account, close the tab.

2. Check whether you have a passkey set up. Passkeys are phishing-resistant by design. They are tied to the specific domain you registered them on. A fake domain cannot receive a passkey. Go to your Facebook and Google security settings and add a passkey today. This is the most effective single change you can make.

3. Enable login alerts on both platforms. Facebook and Google will notify you when a new device signs in. Turn this on. A notification won't stop the initial breach, but it gives you seconds to act: change your password and revoke active sessions from a different device before the attacker locks you out.

4. Audit who has access to your Ads Manager. Go to Facebook Business Settings and Google Ads user management right now. Remove anyone you don't recognize. Business accounts often accumulate old agency access or contractor logins that never got cleaned up. That's a second door into your account even if your login is secure.

5. Verify recruiter outreach through official channels. If someone claiming to be from Meta, Google, or any major company contacts you, go to the company's official careers page and apply or reach out directly. Don't use the link they send you. Search the recruiter's name on LinkedIn, but don't treat a real-looking profile as proof. These profiles are cloned.

6. Consider a password manager and unique passwords everywhere. If your Facebook password is the same as your email password, a single breach cascades. A password manager generates and stores unique credentials for every site. You never have to remember them and you stop reusing passwords.

The Harder Truth

The technical sophistication here is not the story. Real-time credential replay has existed for years. What's new is the targeting precision. Attackers now understand the specific value stack sitting behind a marketing professional's Facebook login. They're not guessing. They've done the ROI math.

The job market makes people vulnerable in a different way. When you're looking for work, or when a promising opportunity arrives unsolicited, the cost of skepticism feels high. You don't want to be the person who ignored a real opportunity because it looked slightly off. Attackers exploit that hesitation intentionally.

The people impersonated in these campaigns are real employees who didn't consent to it. The companies whose brands are mimicked built years of trust that these operators now borrow for a few hours of fraud. The damage to victims is real, lasting, and sometimes irreversible if a business page or ad account gets permanently banned for policy violations the victim didn't commit.

Do this now:

• Add a passkey to your Facebook and Google accounts
• Turn on login notifications for new devices
• Audit your Ads Manager user list
• Never log into a "hiring portal" with a social account

Sources

• malwarebytes.com
• cybernews.com
• bleepingcomputer.com