Picture this, you get a direct message on X that looks totally legit, a Google Calendar link sent by someone who claims to be from Andreessen Horowitz, one of those fancy venture capital firms.
You click, and boom, your crypto-influencer account is swallowed whole by scammers.
Welcome to the new phishing scam lurking in the crypto community.
Without triggering any alarms
This isn’t your grandma’s phishing email. According to crypto developer Zak Cole, this advanced attack sidesteps the usual password swiping and wipes out two-factor authentication protections like they never existed.
The attackers cleverly exploit X’s own app authorization system to hijack accounts without triggering any alarms.
Zero detection, active right now, full account takeover, Cole warns on X.
Even MetaMask security expert Ohm Shah spotted this bad boy in the wild, signaling it’s not just a handful of unlucky whales getting hit.
An OnlyFans model also caught a milder version of this trick, proving just how far this con has spread.
Metadata manipulation
At the heart of the scam sits a link disguised as a harmless Google Calendar invite. But that calendar domain is a wolf in sheep’s clothing.
The URL, something like “x(.)ca-lendar(.)com,” was registered just last Saturday, and it’s not Google’s at all.
The trick? X’s link preview generator displays “calendar.google.com” thanks to juicy metadata manipulation.
Your brain sees a familiar Google address, but the actual link is a trap.
Clicking the link takes you to what looks like an X app authorization page. The app’s called “Calendar,” but zoom in close, two sneaky Cyrillic letters are swapped in to trick you.
It’s a fake app begging for the keys to your digital kingdom, permissions to follow/unfollow at will, change profiles and posts, basically turning your account into a puppet on a string.
That’s more power than a calendar app really needs, something fishy to catch even the sharpest eye.
Stay ahead in the crypto world – follow us on X for the latest updates, insights, and trends!🚀
Access to your account
And it gets juicier. After authorization, you’re dumped on calendly.com. That’s like spotting a fox in your henhouse, spoofing Google Calendar, but redirecting to Calendly? Not the smoothest hustle.
If you think you might be compromised, Zak Cole’s GitHub report suggests checking your Connected Apps page on X and revoking any shady “Calendar” apps pronto. It’s your best bet to kick the scammers off.
The takeaway? Even the savviest crypto crowd isn’t immune to these cloak-and-dagger moves. Always eyeball what apps get access to your account.
Because in this game, one wrong click means your prized crypto social media profile could be gone in a flash
Disclosure:This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
Kriptoworld.com accepts no liability for any errors in the articles or for any financial loss resulting from incorrect information.
Cryptocurrency and Web3 expert, founder of Kriptoworld
LinkedIn | X (Twitter) | More articles
With years of experience covering the blockchain space, András delivers insightful reporting on DeFi, tokenization, altcoins, and crypto regulations shaping the digital economy.
📅 Published: September 26, 2025 • 🕓 Last updated: September 26, 2025
✉️ Contact: [email protected]
