SpiderLabs says fake HireRight emails abuse Calendly forms to deliver a ScreenConnect MSI from treffert.screenconnect.com. HireRight, Calendly and ScreenConnect are not involved.
Source: x.com · published
On 9 November 2026 Trustwave SpiderLabs posted on X that its MailMarshal service detected an active hiring-themed phishing campaign impersonating the background-screening company HireRight. According to the post, the email links to an attacker-created Calendly routing form with a fake document-review button such as View Document or View Proposal. Clicking it returns a link to a ScreenConnect MSI installer from an attacker-controlled ScreenConnect instance at treffert.screenconnect.com. HireRight, Calendly and ConnectWise ScreenConnect are legitimate companies whose brands or services were abused; they are not involved in the scam.
SpiderLabs' graphic shows the flow: a fake HireRight employment-reference email, a Calendly page asking the visitor to download a reference verification file, and then a ScreenConnect ClientSetup.msi download. Running that installer gives the attacker remote access to the computer. Example abused Calendly form paths listed in the post include calendly.com/d/dt89-7hh-5ww, calendly.com/d/dvcz-23t-bf6 and calendly.com/d/d4jf-gpc-ddy.
Hiring and background-check themes work because people expect to open documents for a job or reference check. Using a real Calendly address makes the middle step look routine, and ScreenConnect is genuine remote-support software that IT teams also use, so Windows may not block the installer as unknown malware.
Do not install remote-access software from an unexpected hiring or reference email. Anyone who ran the MSI should disconnect the computer, uninstall ScreenConnect if they did not install it themselves, change passwords from a clean device and have the machine scanned. Report the email to HireRight and to your security team if it reached a work inbox. The details come from the SpiderLabs post and have not been independently checked by scammers.com.
Post by Trustwave SpiderLabs on X, 9 November 2026. Not independently verified by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that promogiftwinter[.]com is a phishing site. Its record shows a page titled "Steam, The Ultimate Online Game Platform" offering a Steam-branded $50 gift card with…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…