A Calendly phishing link hides dangerous X permissions below the fold, warns developer
blixt · x · 2026-10-28
Developer blixt warns about a high-quality phishing attempt: a DM containing what looks like a legitimate Calendly meeting link redirects to a plausible-looking page showing only innocuous fields (name, meeting type), while the scary OAuth permissions for X—like "can see who you follow"—are hidden below the fold and easy to miss.
He calls out a chain of failures across attacker, Calendly, and X: Calendly's branding is abused to wrap the fake page, and X's authorization screen buries sensitive permissions at the bottom. He declined the permissions and suspects the sender's account was hacked.
More from Safety
- Elizabeth Warren demands Anthropic answer four pages of questions before IPO, probes $2T valuation — Hesamation · 2026-10-28
- Bait tweet makes AI agent accounts confess: Chinese content-farm bots leak their API keys and prompts — teortaxesTex · 2026-10-28
- toolmoat: open-source proxy pins MCP tool descriptions to block mid-session tool-description poisoning — whitul · 2026-10-28
- Copilot can copy sensitive files by default unless 'Copy and Extract Content' is disabled — YvesMulkers · 2026-10-28
- Emily Bender: Pangram is not an oracle — why 'accuracy' claims of AI detectors mislead — mjdramstead · 2026-10-28
- GPT-2 staged release debate revisited: setting a caution norm vs overhyped PR — gleech · 2026-10-28