OPERATION "FAKE PRESS" — Calendly → X OAuth phishing

Fake Bloomberg / TechCrunch / WIRED journalist personas on X · source: Nico Dekens blog + prior monitor CSV + X API checks

About this monitor

An ongoing phishing campaign on X uses fake journalist and AI-lab staff personas (claiming Bloomberg, TechCrunch, WIRED, Reuters, OpenAI or Anthropic) that publicly offer interviews or meetings, move the conversation to DMs and send a genuine Calendly link that leads to a malicious X OAuth app or a fake X sign-in page built to take over accounts. The publicly approached accounts are mainly startup founders (25%), AI/ML researchers (24%), investors (10%), plus developers (8%), crypto people (3%), media/creators (3%), security/OSINT people (2%) — bio-keyword estimate over 1063 profiles, 269 unclassified.

Updated every 2 hours, this dashboard tracks:

  • operator accounts and their public lure replies on X (with status labels: confirmed by us vs reported by third parties)
  • publicly approached accounts and their profile mix
  • public victim warnings
  • known phishing infrastructure plus newly spotted lookalike domains (live certificate-transparency watcher + DNS snapshots)
  • passive status checks of known Calendly links and a register of the malicious X OAuth apps (Events Portal, CalendarBookings, Booking Pass)
  • pipeline health: per-component heartbeat, error alerts and a stale-data warning
  • infrastructure clusters A (Dominet HK) / B (Tucows, bill+paige Cloudflare NS, Twitta panel) / C (Asteria, Njalla NS) with registration timeline
  • Twitta page-title watch (urlscan + passive title/CSS fingerprint) each run

Listed targets are publicly approached accounts, not confirmed victims. Accounts and domains marked "reported by third party" come from published research and have not all been verified by us. Data is limited to public posts, passive lookups and API snapshots: DM content is not visible, coverage is incomplete and attribution is not established.

Original research by Nico Dekens / dutchosintguy. Additional sources: Nico Dekens / dutchosintguy (original investigation) · Nosian Magazine · Cybernews · Casco · SafeBrowz · @orlof_v (Twitta HTML-title pivot, 16 Oct 2026)

Read the original investigation →

What's new · feeds: RSS · JSON

Kill chain (from blog)

1 · Public reply lureTailored "writing an article… DM me" reply to AI/tech target
▶
2 · X DM pretext"Liv from @Bloomberg…", topic fitted to target (OSINT+AI for Nico)
▶
3 · Genuine Calendlycalendly[.]com/d/d336-3mq-q2z
"Collaboration" / "Press Release"
▶
4 · X OAuth consentApp "Events Portal", claims eventsportal[.]com
▶
5 · Callback / harvestplugins[.]cal-apis[.]com/login
"Twitta" credential form
▶
6 · Account takeoverToken/credential abuse (victims report crypto spam posting)

Daily activity per operator (Europe/Amsterdam)

Gaps = no captured posts (collection coverage, not necessarily inactivity).

Persona / claimed outlet

Hour × weekday heatmap (Amsterdam time, all operators)

Template usage per operator

Operator ↔ target network (red = targeted by ≥2 operators)

Article topics (lure slot)

Operator profiles & score

Score: +3 template replies, +3 named in victim warning, +2 claims outlet, +2 blue check, +2 shared targets, +1 burst ≥10/day. ≥8 likely; confirmed = Calendly/IOC evidence, named by victims while posting, or suspended after reports.

Publicly approached accounts () — not victims

Victim-warning timeline (public X posts)

IOC panel (defanged)

Calendly links
calendly[.]com/d/d3sm-ypg-s4w LIVE (shared by victim @ConstanceWaing via Nico, 17 Oct) — form "F30"/owner "MM"; options Collaboration / Press Release
calendly[.]com/d/d336-3mq-q2z 404 removed (same options historically → Events Portal)
OAuth app
"Events Portal" (X)
Claimed app site
eventsportal[.]com — GoDaddy for-sale page
Callback host
plugins[.]cal-apis[.]com → /login "Twitta"
Root domain
cal-apis[.]com
Registered
2026-09-16
Registrar
Dominet (HK) Limited (Alibaba Cloud channel)
Nameservers
bill.ns.cloudflare[.]com, paige.ns.cloudflare[.]com
TLS
Let's Encrypt wildcard *.cal-apis[.]com
VT (at blog time)
only indexed subdomain: plugins; 0 detections
Other personas
"Tifafny Wu"/"Keyaki Yuu" (Reuters), "Simon Hill" (WIRED) — links to cal-apis unverified

Target profiling (X lookup of approached accounts; sector = bio-keyword heuristic)

Lure topic evolution (weekly, keyword-categorised)

Claimed outlet per week

Operator rhythm — posts by hour (Amsterdam)

Schedule similarity (cosine, hourly profiles)

1.00 = identical hourly pattern. Similarity is suggestive only, not proof of a shared operator.

Infrastructure watch (CT logs + DNS via DoH)

Lookalike candidates are monitored by name; a cert/DNS hit alone does not prove campaign use.

Takedown tracker

First seen = first post in our data (coverage incomplete; earliest posts 2026-08-25). Suspension date = date we detected it (true date unknown).

Operator profile change history

Infrastructure clusters · credit @orlof_v (Twitta title pivot, 16 Oct 2026); verified by our passive GETs

Cluster A Dominet (HK) + Cloudflare NS bill/paige + Twitta panel · Cluster B Tucows (+ Njalla privacy per @orlof_v WHOIS; RDAP redacted) + same NS + same Twitta panel.css · Cluster C Asteria (Casco): Tucows + Njalla NS, no Twitta page — separate. Shared panel.css (sha256…2ce123a1a60f) across A+B = same kit/operator (high). Registrar switch alone is not attribution.

Pipeline health (heartbeat)

Calendly link watch (passive GET only)

We never submit forms or authorize apps. HTTP 404 = link removed.

Malicious X OAuth apps & callback hosts

X does not expose OAuth app status publicly; first/last seen = earliest/latest public report.

Data gaps

No DM content or Calendly URLs in the CSV (1/413 posts contains any link) · Profile fields come from one X API lookup on 2026-10-13, not historic · Suspended accounts (MiaEsswein, SimonHill_) have no posts/profile data · Coverage: posts from 2026-08-25 (@filipe_eh, added by deep search 2026-10-26) + CSV 2026-09-16→10-10 + X searches since 10-13; earliest known public victim report 2026-08-10 (@HackingDave); earliest known reply 2026-08-19 (blog) not in data · Target handles include co-mentions · CT/DNS snapshots start 2026-10-13 (no historic passive DNS) · Profile change history starts 2026-10-13 · Timezone/active-window figures are estimates · Sector labels are keyword heuristics · Third-party-reported accounts/domains (Nosian, Cybernews, Casco, SafeBrowz, X users) are labelled and not all verified · Nosian’s 13 accounts are not individually named publicly · X OAuth app status cannot be checked publicly.