Fake Calendly invites spoof top brands to hijack ad manager accounts

Watch out, SMBs and MSPs: cybercriminals are pulling off a slick phishing scam using fake Calendly invites that masquerade as recruiters from big names like Unilever, Disney, and Uber to snag your Google Workspace or Facebook ad manager credentials. These professionally crafted lures, likely whipped up with AI, lead victims to bogus scheduling pages that deploy Adversary-in-the-Middle attacks to bypass 2FA and steal login sessions, giving attackers a golden ticket to hijack ads for malware drops or targeted “watering-hole” assaults. Once inside, they can geo-target victims or resell access on the dark web, turning your marketing tools into profit machines for their shady operations. While this isn’t the first rodeo for ad account heists, the precision here means small businesses need to get savvy—use hardware security keys, double-check URLs, and drag pop-ups to the browser edge to spot fakes, because letting IAM slip-ups slide could tank your whole operation.

Source: https://www.bleepingcomputer.com/news/security/fake-calendly-invites-spoof-top-brands-to-hijack-ad-manager-accounts/