3 ms·
You’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight. C
by c0pium 3y ago
You’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight.
Calendly is really relevant to the article from the perspective of a cybersecurity professional (the majority of Krebs readers). If you’re in security at a bank or crypto company, you better be checking for some of these IoCs and calendly is one place to start hunting.
- TeMPOraL 3y agoIsn't this a common failure mode? It's something that kept happening to me by accident in a Microsoft Teams + Outlook combo, where the "Teams meeting" link auto-inserted by Outlook would get stripped out by my preference to send plaintext e-mails. Plenty of work meetings over some year or two involved me or other participants asking on chat for meeting links or invites, until I finally figured out the root cause...
- deleted 3y ago[deleted]
- al_borland 3y agoIt was more than that. He was told there was some tech issue and given a random script to run that would “fix it”. This is all social engineering to get someone blinded by money to run a script that installs the malware.
- cush 3y agoAbsolutely. Take any meeting link and add a random character and you’ll get a broken meeting link. You could do this with any meeting app.