Hackers Using Calendly-Themed Phishing Attack to Steal Google Workspace Account

A sophisticated, multi-stage phishing campaign impersonating recruiters uses personalized Calendly-style links to bypass email filters and deliver AiTM credential theft pages targeting Google Workspace and Facebook Business accounts; the infrastructure enforces domain-only access, anti-analysis checks (IP/VPN blocking, devtools detection), and has been refined over two years to evade detection and capture login credentials.