A large-scale phishing campaign is targeting Google Workspace and Facebook Business account users using highly convincing, fake Calendly-themed pages. More than 75 companies, including Disney, Unilever, Lego, Mastercard, and Uber. Read this article to learn more about how the Calendly phishing scam works and what you can do to protect against Malvertising scams like this.
How the Calendly phishing scam works
The primary goal of this scam is to take over business ad management accounts on platforms like Google and Facebook, which grant high privileges and access to large advertising budgets.
The attack begins with a multi-stage phishing email that appears to come from a legitimate recruiter at a well-known company like LVMH (Louis Vuitton Moët Hennessy). The messages include what seems to be a normal Calendly link for scheduling an interview or call. The end user will then be prompted to log in to their email account, at which point the Malvertiser can intercept with the use of an Attacker-in-the-Middle (AiTM) toolkit. Cybercriminals can then access their account to make fraudulent ad purchases, distribute malware, or run large-scale malvertising operations. Many of these emails are often well-crafted, appear to be AI-generated, and are tailored with personal details scraped from public sources like LinkedIn. This helps create a sense of sincerity, making it more believable and easier for the Malvertiser to phish their personal data successfully.
How do hackers avoid detection?
Attackers used advanced techniques to avoid detection, including CAPTCHA checks, which identify and protect against bot contacts. It also implemented ‘domain-based access restrictions’, which means the malware delivery system had a built-in check: if a check was carried out by typing in the URL, the end user would see nothing, but if they were specifically targeted and clicked through the link they received, the infected code appeared. Therefore, it was able to circumvent security analysts.
How to protect your brand from malicious ads
The campaign reflects a growing trend of targeting paid digital ad accounts, prompting Google to warn advertising agencies about the threat and urge stronger account monitoring. This scam was wide in reach as malvertisers employed rapid domain turnover and reused phishing URLs from older campaigns. By using an ad security software like AdSecure, you can help safeguard your advertising by scanning ads on your network before, during, and after the campaign creation process. It scans for Malvertising, checks ad quality, and ensures compliance, helping you avoid unsafe, inappropriate, and non-compliant ad content. If you are an ad network or a publisher, you should consider using AdSecure’s comprehensive monitoring and ad supply chain protection to ensure your brand remains secure against Malvertising attempts.
Conclusion: The Calendly phishing scam
The operation highlights the increasing sophistication of cybercrime, which employs realistic social engineering tactics, personalized lures, and advanced anti-analysis defenses. As a result, traditional Indicators of Compromise (IOCs) have become less effective for detection. It is essential to invest in a strong compliance team and effective ad security software to safeguard your ad supply chain and protect users from harmful advertisements. If you’re looking for ad security software to secure your online platform, contact our team today to learn how to protect your ad network or website!
