46 ms·
From the article: "Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target’s calendar at Calend
by jhbadger 3y ago
From the article:
"Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target’s calendar at Calendly"
This is only an issue for users of "Calendly" which apparently is some third-party application for calendars. I'm all for recognizing security flaws in MacOS, but it's not like this is a flaw of default apps like the built in Calendar feature of MacOS. It could have easily be framed as "Using Calendly is a security risk".
- chatmasta 3y agoCalendly isn't really relevant here. The attack vector isn't even delivered through the calendar invite. The "investor" just sends a calendar invite with an intentionally broken link, and then when the meeting time comes and the victim can't connect to it, the attacker exploits their sense of urgency by sending the malicious link over the same Telegram channel where they initially established contact. I'm not even sure why the post mentions Calendly so prominently. It's orthogonal to the attack, which is a malicious link sent to the user via Telegram.
- c0pium 3y agoYou’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight. Calendly is really relevant to the article from the perspective of a cybersecurity professional (the majority of Krebs readers). If you’re in security at a bank or crypto company, you better be checking for some of these IoCs and calendly is one place to start hunting.
- TeMPOraL 3y agoIsn't this a common failure mode? It's something that kept happening to me by accident in a Microsoft Teams + Outlook combo, where the "Teams meeting" link auto-inserted by Outlook would get stripped out by my preference to send plaintext e-mails. Plenty of work meetings over some year or two involved me or other participants asking on chat for meeting links or invites, until I finally figured out the root cause...
- deleted 3y ago[deleted]
- al_borland 3y agoIt was more than that. He was told there was some tech issue and given a random script to run that would “fix it”. This is all social engineering to get someone blinded by money to run a script that installs the malware.
- cush 3y agoAbsolutely. Take any meeting link and add a random character and you’ll get a broken meeting link. You could do this with any meeting app.
- fulafel 3y agoThis time yes. There's been flaws in the built-in Calendar app as well and reasonable to assume there are others, unfixed ones still.
- OJFord 3y agoIt's not even really 'using Calendly', it's just 'being tricked into running malicious code', as in there's no exploit as such here, it's just social engineering to get the user to run a supplied script.