Are you using Calendly to schedule meetings? Be aware of a recent phishing campaign that abused Calendly to steal Microsoft login credentials. This article explains how the scam worked and what you can do to protect yourself.
What is Calendly Phishing?
Phishing actors are taking advantage of Calendly’s features to trick users into entering their Microsoft login credentials on a fake website. Calendly is a popular tool for scheduling meetings and appointments, making it a believable platform for attackers to use.
How Does the Scam Work?
- Phishing Email: You receive an email notification from Calendly about new fax documents.
- Malicious Link: The email contains a link disguised as a “View Documents” button. Clicking it leads to a fake login page.
- Fake Login Page: The page resembles a Microsoft login form with a blurred document in the background.
- Double Credential Entry: You enter your credentials, but a fake error message prompts you to re-enter them due to a supposed typo.
- Dynamic Redirection: After the second attempt, you’re redirected to a website related to your email domain, making the scam seem legitimate.
Red Flags to Watch Out For:
- Microsoft SharePoint Credentials: Calendly doesn’t require SharePoint login to view documents.
- Suspicious URL: The login page URL won’t be on Microsoft or Calendly’s domain.
- Double Credential Entry: Legitimate sites rarely ask you to enter your password twice.
How to Protect Yourself:
- Beware of Unfamiliar Senders: Don’t click links in emails from unknown senders, even if they appear to be from Calendly.
- Verify URLs: Before entering any credentials, hover over the link to see the actual URL in the browser status bar.
- Use Password Managers: Password managers prevent autofill on phishing sites and help you create strong, unique passwords.
- Enable Two-Factor Authentication: This adds an extra layer of security by requiring a code from your phone or email to log in.
Security Measures Taken by Calendly
Calendly prioritizes user safety and has measures in place to detect and terminate phishing attempts. They recommend two-factor authentication for added protection.
By following these tips, you can stay safe from Calendly phishing attacks and ensure your meetings remain secure.