A Calendly phishing attack tricked Segment co-founder Peter Reinhardt into granting a malicious app access to his X account. Attackers impersonated a WIRED journalist and placed an authorization request between genuine scheduling pages to make the approach convincing.
Fake Interview Request Led to a Genuine Booking Page
The attack began with an interview request about carbon removal from an X account impersonating WIRED journalist Simon Hill.
The sender appeared credible, and the message included a genuine Calendly booking link. Reinhardt followed it and reached a legitimate scheduling page.
However, the booking process then directed him to an attacker-controlled page carrying WIRED branding. That page claimed he needed to connect his X account before scheduling the interview.
Malicious App Requested Access to Direct Messages
Instead of presenting a fake password form, the attackers used X’s legitimate application authorization system.
An app called CalendarBookings requested permission to read and write posts and access direct messages. After Reinhardt approved those permissions, the app briefly gained access to his account.
According to the report, the resulting account takeover lasted only a few minutes.
The attack therefore relied on consent rather than password theft. Reinhardt’s approval gave the malicious application the access it requested through a genuine permission screen.
Researcher Linked Five Phishing Sites to One Backend
Casco security engineer Anthony Gibbs investigated after Reinhardt shared details of the incident.
Between September 9 and 11, Gibbs traced five publication-branded phishing sites to a shared backend called Asteria. His findings indicated that the campaign extended beyond a single target.
Additionally, the attacker-controlled booking page used a Calendly-like domain with a subtle character substitution. An uppercase “I” replaced a lowercase “l,” making the address easy to misread.
During testing, Gibbs also found that completing the authorization step led to a real Calendly event.
As a result, legitimate Calendly pages appeared at both ends of the process. The attackers placed their malicious request between those familiar scheduling steps.
Campaign Went Offline but Operators Remain Unknown
Gibbs submitted abuse reports to domain registrars, Calendly, X and Google on September 17. According to his account, the campaign has since gone offline.
However, the investigation did not identify the operators or establish how many people fell victim.
The Calendly phishing attack illustrates how criminals can combine legitimate services with a deceptive request for account permissions. A genuine booking page or authorization screen does not establish that the application requesting access is trustworthy.
0 responses to “Calendly Phishing Attack Uses Fake Journalist to Hijack Founder’s X Account”