That Meeting on Your Calendar Might Be a Phishing Scam

A phishing email can be deleted in seconds. A phishing calendar invitation, however, might still be waiting for you on Thursday morning.

Security researchers are tracking a surge in scams that use ordinary meeting invitations to deliver malicious links. Instead of relying entirely on suspicious emails, attackers are taking advantage of the way Microsoft Outlook, Google Calendar, and other scheduling applications automatically process invitations.

The trick is surprisingly simple. Send someone a meeting request, give it a convincing title, and include a link to a fraudulent website. Depending on their calendar settings, the invitation may appear on their schedule without them accepting anything.

The calendar application is doing exactly what it was designed to do. Unfortunately, that convenience has become useful to criminals.

More Than 300,000 Phishing Emails, Disguised as Meetings

On October 15, cybersecurity company Check Point published findings from several large-scale phishing campaigns targeting Microsoft account credentials.

Its email security researchers identified more than 302,000 unique phishing emails targeting over 40,000 organizations. The messages originated from more than 33,000 sender domains and 247,000 individual sender addresses.

That variety makes traditional sender-based blocking considerably more difficult. Blocking one suspicious domain does little when thousands of others are involved.

Many of the messages impersonated Microsoft Teams invitations, while others contained calendar attachments with malicious links. The objective was familiar: convince recipients to enter their Microsoft credentials into an attacker-controlled website.

Check Point wasn't the only company noticing the trend.

In September, email security firm Sublime Security reported that its detections of calendar-based attacks had increased by 1,216% in August compared with July. Those figures describe activity observed by Sublime, not every phishing attempt worldwide, but the acceleration was difficult to ignore.

Netcraft published a separate investigation on October 16 examining why these attacks are effective. Its researchers found that malicious events can remain in a victim's calendar even after the original email is deleted.

That last detail is particularly important. An email might get identified as spam, but the calendar event it introduced can become a separate problem.

The Problem Starts With a Perfectly Normal File

Most calendar invitations rely on a standardized format called iCalendar, commonly distributed as an .ics file.

Despite the name, this format isn't exclusive to Apple's calendar software. Microsoft Outlook, Google Calendar, and other applications support it.

An ICS file contains structured information about an event, including its title, date, organizer, description, and associated links. It's essentially a text document that calendar software understands.

Unlike an executable program, a normal ICS file doesn't need to run code to perform its intended function. That's part of what makes it useful for phishing.

An attacker can create an entirely valid calendar invitation containing a fraudulent link. The calendar software reads the file, recognizes the event information, and may display it on the recipient's schedule.

No sophisticated software exploit is necessarily required.

Many email and calendar systems automatically process meeting invitations to help users identify scheduling conflicts. Outlook, for example, can display incoming invitations as tentative appointments before they're accepted.

Attackers are exploiting that expected behavior rather than necessarily breaking into the calendar itself.

There's also a complication for email security products. Calendar invitations and their corresponding email messages don't always follow identical processing paths. Sublime documented situations where an email security system could intercept a suspicious message while the associated invitation still reached the calendar.

This doesn't mean every calendar application is vulnerable in the same way. Invitation-handling settings, account providers, and security configurations all matter.

It does mean an empty spam folder isn't proof that your calendar contains nothing suspicious.

Fake Meetings, Subscription Renewals, and Even Remote Access Software

The actual contents of these invitations aren't especially imaginative.

Researchers have documented fake meeting requests, voicemail notifications, payment disputes, subscription renewals, and supposed account alerts. Many imitate Microsoft, Google, PayPal, or other recognizable companies.

A message claiming that your Microsoft account needs immediate verification is suspicious enough in an email. Place the same message inside an appointment titled "Account Verification Meeting," and it gains a different kind of credibility.

One campaign examined by Sublime used a fraudulent financial notification delivered through Google Calendar. The invitation led to a website offering a supposed credit note.

Rather than providing financial documents, the website attempted to download a ScreenConnect installer.

ScreenConnect is legitimate remote access software commonly used by IT technicians. In this case, attackers had configured it for unauthorized remote access. Installing it could give them control over the victim's computer.

That's a more serious outcome than simply being redirected to an advertisement or spam website.

Netcraft also documented campaigns involving a technique called device-code phishing. Instead of asking users to type their passwords into a counterfeit login page, attackers direct them to a real Microsoft authentication page and persuade them to authorize a device they don't control.

Successfully completing that process can grant an attacker access through an authentication token.

It's an important distinction because even a legitimate Microsoft login page doesn't automatically mean the request that sent you there is legitimate. Multifactor authentication remains valuable, but approving an unauthorized sign-in can undermine its protection.

How to Stop Unwanted Calendar Invitations

Google Calendar offers a relatively straightforward way to limit which invitations appear automatically.

On a computer, open Google Calendar, click the gear icon, and go to Settings → Event settings → Add invitations to my calendar.

You'll find three options:

• From everyone: Invitations can automatically appear regardless of who sent them.

• Only if the sender is known: Invitations appear automatically from contacts, people in your organization, or people you've previously interacted with.

• When I respond to the invitation in email: Events are added only after you respond to their invitations.

The second option offers a reasonable balance between convenience and security for many users. The third provides stricter control, although it means legitimate invitations require more manual attention.

These settings apply to new invitations, so changing them won't necessarily remove suspicious events already on your calendar.

Known senders aren't automatically trustworthy, either. A compromised contact account can still distribute malicious invitations.

Google expanded administrative controls for Workspace organizations in August 2026, allowing administrators to restrict which invitation-handling options employees can select.

For Outlook users, the situation is less uniform. Invitation processing varies between Outlook versions, account types, and Exchange configurations. Organizations using Microsoft 365 should review how external meeting requests are processed and whether potentially malicious invitations are being added automatically.

A small business that rarely receives meetings from outside organizations may reasonably prefer tighter restrictions than a sales department that schedules calls with new clients throughout the day.

Disabling every external invitation isn't necessarily practical. Controlling which ones appear without interaction is the more useful goal.

Found Something Suspicious? Don't Decline It Just Yet

If an unfamiliar meeting appears on your calendar, resist the temptation to interact with it immediately.

First, examine the organizer and the invitation details. An unexpected payment notice, password reset request, or subscription warning doesn't become trustworthy simply because it appears in your calendar.

Avoid clicking unfamiliar links, downloading attachments, or approving sign-in requests. Don't reply or decline a clearly malicious invitation just to get rid of it; responding may reveal that your email address is actively monitored.

Google Calendar provides a Report as spam option for eligible invitations sent through Google Calendar. Open the event, select the three-dot menu, and choose the reporting option. Google notes that invitations originating from other providers may not support this feature.

In supported versions of Outlook, you can select the original suspicious email and use Report → Report phishing. If the calendar entry remains afterward, remove it separately.

If the invitation appears to come from someone you actually know, contact them through an established phone number or an existing conversation instead of using information supplied in the invitation.

Anyone who has entered credentials into a suspicious website should change their password through the legitimate service immediately and review recent account activity. If the incident involves a work or school account, notify the organization's IT administrator, especially if a sign-in or device authorization was approved.

For businesses, incident response should also include checking active sessions, suspicious application permissions, and unexpected mailbox forwarding rules.

Your Calendar Is Another Place Attackers Can Reach You

Calendar phishing isn't entirely new. Netcraft traced early examples of ICS-related attacks to the beginning of the decade, with more widespread campaigns emerging during 2025.

What's changed is the scale and accessibility of the technique.

An attacker doesn't necessarily need to discover a zero-day vulnerability or develop malicious software. Legitimate calendar infrastructure, inexpensive websites, and ordinary invitation files can be enough to get a fraudulent request in front of someone.

Meanwhile, users are increasingly accustomed to calendars filling themselves with meetings, reminders, and notifications.

That familiarity is exactly what attackers are exploiting.

For individuals, reviewing invitation settings and treating unexpected calendar links with the same suspicion as questionable emails is a sensible adjustment. For organizations, phishing training and security monitoring need to account for invitations that survive beyond the original message.

The next suspicious Microsoft login request might not be sitting in your inbox. It might already have an appointment on your calendar.