Scams & fraud

Fake Job Interviews Are Phishing for the Logins That Run Your Business Page

Two fake-recruiter schemes flagged Oct. 12 and 14 go after Facebook and Google logins and ad-account access. A passkey and one sign-in rule help keep those accounts yours.

By Cybercave Technologies, LLC · Oct 19, 2026

The word "phishing" in cut-out letters on a striped background — Illustration photo: the word "phishing" in cut-out letters on a striped background. Not a real phishing email, booking page, recruiter, or job offer. Credit: Photo by Ann H via Pexels (Pexels License).

If you, or whoever posts for your business, gets a surprise invitation to interview with a big-name company, the booking page may be built to take the Facebook and Google accounts behind your Page and your ads.

What to do: This week, add a passkey to the Facebook and Google accounts that control your business Page and ads. For Facebook, set it up in the Facebook app under Accounts Center (the cited Meta source confirms the mobile apps; it does not confirm a desktop setup path). Then set one house rule: nobody signs in to either account from a link in a job message.

Two security teams flagged fresh versions of this trick last week. Malwarebytes described fake "Meta Careers" interview pages on Oct. 14 that collect Facebook and Google passwords plus the security codes meant to protect them [1]. Hoxhunt's threat team reported on Oct. 12 a fake Google recruiter whose sign-up form asked which ad accounts the target runs and what each spends a month [2].

The booking page asks for your password, then your code

The Malwarebytes researchers found pages dressed up as Calendly, the popular scheduling tool, offering a 30-minute call with a Meta recruiter [1]. After you choose a time, enter your name, email and phone, and click through a fake picture test, a Facebook login box appears inside the page, complete with a phony address bar [1].

If the account has two-step protection, the page then requests the security code from your app, text, WhatsApp or email. Next it claims Facebook needs you to sign in to Google as well, and asks for that password and code too [1]. Malwarebytes said the pages have no connection to Meta, Calendly or Google [1].

A code typed into a fake page can be used against you

The page stays in touch with the attackers while you fill it in, Malwarebytes reported. They can try your password on the real Facebook right away, then ask you for the same code Facebook just sent and use it before it expires [1]. On the Google screens, the page can tell you to "tap Yes" on your phone, approving the attackers' own sign-in [1].

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) describes the same move in its guidance: a look-alike login page that collects the password and the six-digit code from an authenticator app [9]. CISA calls one family of logins, the kind used by passkeys and security keys, the only widely available method that resists this kind of phishing [9].

Think of a texted or app code as a one-time guest pass: whoever you hand it to can walk in. A passkey works like a key cut for one door. It will not turn in a fake lock, which is why Malwarebytes, Meta and Google all describe passkeys as stronger against phishing [1][7][8].

The real prize is often the business account

Facebook logins that control a shop's Page or its ads are especially valuable to criminals, Malwarebytes wrote, and a taken-over Google account can expose email and be used to reset other passwords [1]. In the Hoxhunt case, the form asked which ad platforms the target manages — Meta and Google Ads among them, plus TikTok and LinkedIn — and the monthly budget on each [2].

This is not new, and it is not small. In August, the security firm CTM360 reported more than 3,000 recruiting-themed phishing web addresses in two months, mostly aimed at marketing workers and built to pass codes along in real time [3]. Team Cymru in July and Push Security last December documented similar recruiter lures aimed at marketing and ad-account logins, BleepingComputer reported [4][5].

Our calculation: roughly 50 new trap addresses a day

Our calculation: CTM360's count of more than 3,000 phishing web addresses over about two months works out to roughly 50 a day on average, using 60 days [3]. Blocking a few bad addresses does not keep up with that pace, so the habit — never signing in from a job link — matters more than any list.

Checking the link is not always enough

The Hoxhunt example had no bad link to spot. The email came from a real Zoom Events address, the booking calendar ran on Zoom's own scheduling site, and the signature linked to a genuine recruiter's LinkedIn profile [2]. "The only false thing is the story itself," Hoxhunt wrote [2].

Hoxhunt's warning signs: an unrequested offer, a role far more senior than a cold message would offer, and early questions about the accounts or ad budgets you control [2]. Michigan's attorney general likewise treats a surprise request to interview right away as a warning sign [11].

Your business's name can be the bait, too

These lures borrow real employers' names, and Ohio's attorney general warned this month that fake recruiter outreach can hurt the reputation of the real company being impersonated [10]. Meta's own careers site warns that scammers build fake Meta Careers pages that ask visitors to log in with Facebook [6].

The money side is growing as well. The Federal Trade Commission (FTC) said reported losses to job and employment-agency scams rose from $90 million in 2020 to $501 million in 2024, as of its March 2025 release [12]. Those figures count money lost, not hijacked accounts.

The other side

Meta's careers page tells job seekers it never charges fees during hiring and describes the fake-login tactic directly [6]. The schemes abuse legitimate services rather than breaking them: Hoxhunt's example ran on Zoom's real tools [2], and BleepingComputer noted that misuse of legitimate platforms in the July campaign did not mean those services were hacked [4].

Passkeys have a limit. Meta says you can still sign in with your password after adding one [7], and Malwarebytes cautions that a passkey will not help if you switch to a password and code and hand those over [1]. Cybercave did not contact Meta, Calendly, Google, Zoom or the researchers for this draft; it relies on their published statements and reports.

What's still unconfirmed

Developing: How many people entered details on the fake Meta Careers pages, whether any business Pages or ad accounts were taken over, and who is behind it. Malwarebytes said neither the hosting location nor a code comment in Vietnamese establishes who runs the pages [1]. Hoxhunt did not say what the second, later link delivers [2].

For your IT provider

Bring: Malwarebytes Threat Intel, Oct. 14, 2026 — fake "Calendly | Meta Careers" pages; browser-in-the-browser (BitB) Facebook and Google logins with real-time 2FA relay (TOTP / SMS / WhatsApp / email codes; Google "tap Yes" prompts); kit version 0.8.0 with a per-campaign key. Domains (defanged): joinconnect[.]cfd · joinconnect[.]works · joinhire[.]cfd · joinhire[.]info · joinquest[.]cfd · joinquest[.]info · joinquest[.]works · jointhetalent[.]cfd · jointhetalent[.]info · jointhetalent[.]works · jointheteam[.]cfd. Collection host (defanged): rkrt01c0mc[.]execute-api[.]ap-southeast-1[.]amazonaws[.]com. Hoxhunt Phish of the Week, Oct. 12, 2026 — fake Google AI "CMO" recruiter sent via Zoom Events, booking on Zoom Scheduler, form harvests ad platforms and monthly spend; follow-up "application" link by email. CTM360 RecruitTrap, Aug. 13, 2026 — 3,000+ URLs in two months, 50+ impersonated organizations, ~96% Calendly-themed, Svelte/SvelteKit front end with Socket.IO control channel, filters out personal email domains; TLD share across 813 registered domains (.cfd 40%; .com 25.1%; .info 15.1%; .works 10.5%; .work 6.3%). CISA "Implementing Phishing-Resistant MFA" (Oct. 2022): FIDO/WebAuthn is the only widely available phishing-resistant method; number matching as an interim step. Google: a passkey skips the 2-Step Verification second step; Workspace admins control "skip password when possible." Ask: require phishing-resistant MFA (passkey or FIDO2 security key) for every person with admin access to the Facebook Page, Meta business portfolio, Google Ads and the Google/Workspace account behind them; review who holds admin roles; if anyone entered details, change the password from a trusted device, sign out other sessions, check recovery email/phone, and check Gmail forwarding rules and filters [1][3].

What this means for Allegan and Surrounding Counties

For a lot of small shops, the Facebook Page is where customers check hours, specials and closings. That Page is only as safe as the personal Facebook account of each person who runs it, and that person may be a part-time helper or family member who is also job hunting.

Our recommendation, not a Meta rule: keep at least two trusted adults with admin access so one can help if the other is locked out, and remove anyone who no longer needs access. Then turn on a passkey for each admin's Facebook account — in the Facebook app under Accounts Center — and for the Google account tied to your ads or email.

If someone at home is applying for jobs, Malwarebytes suggests keeping a simple log of where you applied so an unexpected "reply" stands out [13]. Michigan's attorney general advises confirming the sender uses the company's own email domain and contacting the company through details you have verified yourself [11]. Report job scams to the AG's Consumer Protection Team at 877-765-8388 [11].

Kicker — do this week: Add a passkey to the Facebook and Google accounts behind your Page and ads, then tell everyone who posts for you the rule: A real job offer never needs your Facebook or Google password or code.

Disclosure: Cybercave Technologies, LLC provides IT services to small businesses. No company named in this article paid for, sponsored, or reviewed it.

This article is general information, not advice for your specific situation.

Corrections: If we get something wrong, we fix it here and note the change at the top with the date. Send corrections to support@cybercavetech.com.

Sources

PRIMARY — Malwarebytes Threat Intel (Stefan Dasic), Oct. 14, 2026: "Fake Calendly 'Meta Careers' pages steal Facebook and Google logins" — https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins — original research: booking flow (30-minute "Phone call," details form, fake CAPTCHA, in-page Facebook login with drawn address bar, 2FA code request, Google sign-in "for security"); real-time relay of passwords/codes and "tap Yes" prompts; pages "not affiliated with Meta, Calendly, or Google"; Facebook accounts linked to business pages or ad accounts "valuable to criminals"; 11 domains, none mention Calendly or Meta; hosting region and Vietnamese code comment do not establish who is behind it; passkeys/security keys cannot be relayed "in the same way," but won't help if a user falls back to password and code; recovery steps incl. Gmail forwarding rules. Checked Oct. 19, 2026.
PRIMARY — Hoxhunt Threat Operations, "Phish of the Week," Oct. 12, 2026: "Fake Google AI Recruiter Uses Zoom Scheduler to Collect Ad Account Details" — https://www.secureculture.com/public/resources/phish-of-the-week-12th-of-october-2026-10-12 — original research: email from a Zoom Events address with a real Google employee's name; CMO role; booking on the real Zoom Scheduler; form asks which ad platforms (Meta, Google Ads, TikTok, LinkedIn) and monthly ad spend; "job application" link to arrive later by email; "The only false thing is the story itself."; red flags listed. Independent of [1]. Checked Oct. 19, 2026.
PRIMARY — CTM360, "RecruitTrap: Browser-in-the-Browser (BitB) Recruitment Scams," Aug. 13, 2026 — https://www.ctm360.com/reports/recruittrap-browser-in-the-browser-bitb-recruitment-scams — more than 3,000 phishing URLs over two months; 50+ organizations impersonated; primarily targets marketing professionals; MFA relay. Technical details (96% Calendly-themed; TLD shares; 813 registered domains; Svelte/Socket.IO; filters personal email domains; marketing accounts give access to ad platforms and corporate social profiles) from CTM360's contributed piece on The Hacker News, Aug. 14, 2026 — https://thehackernews.com/2026/08/ctm360-uncovers-over-3000-recruitment.html (labelled by THN as a partner-contributed piece; treated as CTM360's own claims, not independent reporting). Independent of [1][2]. Checked Oct. 19, 2026.
BleepingComputer (Ionut Ilascu), July 6, 2026: "Phishing poses as big-brand job interview to steal Google accounts" — https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/ — Team Cymru's Will Thomas analysis; 30+ brands impersonated to steal Google credentials from marketing professionals; BitB pop-up; "abusing them does not imply a compromise of the services." Independent research (Team Cymru) and reporting. Checked Oct. 19, 2026.
BleepingComputer (Bill Toulas), Dec. 2, 2025: "Fake Calendly invites spoof top brands to hijack ad manager accounts" — https://www.bleepingcomputer.com/news/security/fake-calendly-invites-spoof-top-brands-to-hijack-ad-manager-accounts/ — Push Security research; Calendly-themed recruiter lures for Google Workspace / Google Ads MCC and Facebook Business credentials; hijacked marketing accounts used for malvertising or resold. Independent research (Push Security). Same outlet as [4] but a different research team and campaign. Checked Oct. 19, 2026.
PRIMARY — Meta Careers: "Notice: Recruitment Fraud and Job Scam Alert" — https://www.metacareers.com/phishing-scam — scammers "may create fake websites that mimic a Meta Careers page, prompting you to log in with your Facebook credentials"; Meta "will never ask you to pay any fees at any stage of the recruitment process." Checked Oct. 19, 2026 (box curl returned HTTP 400; page loaded via WebFetch; text saved).
PRIMARY — Meta Newsroom, June 18, 2025: "Introducing Passkeys on Facebook for an Easier Sign-In" — https://about.fb.com/news/2025/06/introducing-passkeys-facebook-easier-sign-in/ — passkeys on Facebook for iOS/Android mobile; "resistant to guessing or theft by malicious websites or scam links"; set up in Accounts Center; "You'll still be able to use other authentication methods, such as your password." Checked Oct. 19, 2026.
PRIMARY — Google Account Help: "Sign in with a passkey instead of a password" — https://support.google.com/accounts/answer/13548313?hl=en — passkeys "more secure against phishing"; passkey bypasses the 2-Step Verification second step; Workspace accounts may need admin permission to skip the password. Checked Oct. 19, 2026.
PRIMARY — CISA: "Implementing Phishing-Resistant MFA," fact sheet, October 2022 — https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf — phishing example: user submits username, password and "the 6-digit code from their mobile phone's authenticator app" on a look-alike portal; "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." Checked Oct. 19, 2026.
PRIMARY — Ohio Attorney General, Consumer Advocate newsletter, October 2026: "Protect yourself from employer impersonation scams" — https://www.ohioattorneygeneral.gov/Media/Newsletters/Consumer-Advocate/October-2026/Protect-yourself-from-employer-impersonation-scams — fake recruiter outreach "could potentially harm a legitimate employer's reputation"; recruiter impersonation "on the rise." Checked Oct. 19, 2026.
PRIMARY — Michigan Department of Attorney General, Feb. 27, 2025: "AG Nessel Warns Job Seekers of Employment Scams" — https://www.michigan.gov/ag/news/press-releases/2025/02/27/ag-nessel-warns-job-seekers-of-employment-scams — red flag: "You receive an unsolicited request for an immediate interview"; confirm the sender uses the company's domain; contact the company with verified details; Consumer Protection Team toll-free 877-765-8388. Checked Oct. 19, 2026.
PRIMARY — Federal Trade Commission, March 10, 2025: "New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024" — https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024 — job and employment agency scams: reports tripled 2020–2024; reported losses rose from $90 million to $501 million. Most recent FTC figure for this subcategory found; the FTC's March 2026 testimony on 2025 data gave totals ($15.9 billion) but no job-scam breakout. Checked Oct. 19, 2026 (box curl blocked; loaded via WebFetch; key lines saved).
Malwarebytes (news), October 2026: "'Spray and pray' job applications could make it harder for you to spot a scam" — https://www.malwarebytes.com/blog/news/2026/10/spray-and-pray-job-applications-could-make-it-harder-for-you-to-spot-a-scam — "Keep a simple application log." Same outlet as [1]; not counted toward the 3-source floor. Checked Oct. 19, 2026.