4 ms·
Calendly isn't really relevant here. The attack vector isn't even delivered through the calendar invite. The "investor" just sends a calendar invite with an int
by chatmasta 3y ago
Calendly isn't really relevant here. The attack vector isn't even delivered through the calendar invite. The "investor" just sends a calendar invite with an intentionally broken link, and then when the meeting time comes and the victim can't connect to it, the attacker exploits their sense of urgency by sending the malicious link over the same Telegram channel where they initially established contact.
I'm not even sure why the post mentions Calendly so prominently. It's orthogonal to the attack, which is a malicious link sent to the user via Telegram.
- c0pium 3y agoYou’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight. Calendly is really relevant to the article from the perspective of a cybersecurity professional (the majority of Krebs readers). If you’re in security at a bank or crypto company, you better be checking for some of these IoCs and calendly is one place to start hunting.
- TeMPOraL 3y agoIsn't this a common failure mode? It's something that kept happening to me by accident in a Microsoft Teams + Outlook combo, where the "Teams meeting" link auto-inserted by Outlook would get stripped out by my preference to send plaintext e-mails. Plenty of work meetings over some year or two involved me or other participants asking on chat for meeting links or invites, until I finally figured out the root cause...
- deleted 3y ago[deleted]
- al_borland 3y agoIt was more than that. He was told there was some tech issue and given a random script to run that would “fix it”. This is all social engineering to get someone blinded by money to run a script that installs the malware.
- cush 3y agoAbsolutely. Take any meeting link and add a random character and you’ll get a broken meeting link. You could do this with any meeting app.