A fake journalist used a real Calendly link to phish a tech founder

A sophisticated phishing campaign impersonated a WIRED journalist to target Segment co-founder Peter Reinhardt, using a genuine Calendly link before tricking him into granting a malicious X app brief access to his account and direct messages.

The attack started with an interview request about carbon removal, sent from an X account impersonating WIRED journalist Simon Hill. The request looked plausible, and the sender used a verified account associated with a real journalist.

Reinhardt, who co-founded Segment before it was acquired by Twilio, followed the booking link and landed on a genuine Calendly booking page.

That is where the attack became harder to spot.

The Calendly page eventually led to a WIRED-branded booking page that asked Reinhardt to connect his X account before he could schedule the interview. Instead of stealing his X password through a fake login form, the attackers used X's own authorization system to ask him to approve an application.

The application, called CalendarBookings, requested permission to read and write posts and access direct messages. Reinhardt's account was taken over for only a few minutes after he approved the request.

Casco security engineer Anthony Gibbs investigated the attack after Reinhardt shared details of the incident. His investigation found that the campaign did not target just one person. Between September 9 and 11, Gibbs traced five publication-branded phishing sites to the same backend, dubbed Asteria.

The investigation also found a particularly deceptive detail. The attacker-controlled booking page displayed a Calendly-like domain containing a subtle lookalike character (an uppercase I, instead of a lowercase l), making the address easy to mistake for the real thing.

After authorization, my research browser reached a real Calendly event. Calendly appeared at both ends of the attack: the genuine routing form in Peter’s original message and the configured event after consent. The attacker placed the authorization request between those familiar scheduling steps.

Casco security engineer Anthony Gibbs explained.

Abusing trust

The campaign has since gone offline, according to Gibbs. He submitted abuse reports to the relevant domain registrars, Calendly, X, and Google on September 17. The investigation did not establish who operated the infrastructure or how many people fell victim.

But the incident shows why modern phishing doesn’t always need to imitate the service that ultimately gets compromised. Attackers can use one trusted service to establish credibility, another trusted service to handle authentication, and social engineering to connect the two.

Calendly has already featured in other phishing campaigns. In December 2025, researchers uncovered a campaign impersonating 75 major brands with fake recruitment messages and Calendly invitations. Victims were sent to fake Calendly pages and then prompted to hand over Google Workspace or Facebook Business credentials.

OAuth has also become an increasingly useful tool for attackers because they can trick victims into granting access without handing over their passwords. A recent FBI warning highlighted consent phishing campaigns in which attackers persuade victims to approve malicious apps through legitimate Google or Microsoft permission screens. Once granted, the apps can retain access until the victim revokes it.

Other campaigns have abused legitimate OAuth redirects to move victims between trusted identity-provider pages and attacker-controlled destinations.

The Reinhardt attack takes the same basic idea into a more convincing social-engineering setting. The attacker did not have to fake every part of the experience. It only had to put the malicious step in the middle of services the victim already trusted.