Malicious Calendar Invites Explode in Popularity, Bypassing Email Filters
Attackers are increasingly leveraging calendar invitations as a vector for phishing and malware delivery, with one security firm reporting a 1,216% surge in August.
Security researchers are sounding the alarm over a dramatic surge in malicious attacks that utilize calendar invitations to reach targets, bypassing traditional email security defenses. Sublime Security reported a staggering 1,216% month-over-month increase in such attacks during August 2026, with the first half of September alone already surpassing the entire previous month's volume.
Check Point's telemetry paints a similarly alarming picture, showing a sharp rise from a few thousand malicious calendar invite emails per month in April to over 118,000 in September and a staggering 740,000 in the first two weeks of October. This escalating trend indicates a significant shift in threat actor tactics, exploiting a communication channel often overlooked by standard security protocols.
These attacks manifest in several ways, primarily focusing on credential harvesting and malware delivery. Some campaigns embed malicious links or content directly within the .ics file, which is a universal format for calendar data. By abusing legitimate calendar features and user trust, attackers can circumvent security measures without exploiting software vulnerabilities. Other attacks combine the .ics attachment with links in the email body that lead to sophisticated credential-harvesting pages designed to mimic legitimate login portals.
The ultimate goal for many of these campaigns is to trick unsuspecting users into divulging their Microsoft account credentials. Once obtained, these credentials can be used for a wide range of malicious activities, including unauthorized access to sensitive data, further network compromise, or identity theft. The use of familiar interfaces, such as spoofed Microsoft sign-in pages, enhances the effectiveness of these phishing attempts.
Beyond credential theft, some malicious calendar invites are being used to distribute malware. In one observed attack, a Google Calendar invite with a financial lure, sent from a compromised Gmail account, directed users to a page hosted on Framer, a popular no-code website builder. Victims who clicked the link and bypassed browser warnings were prompted to download a ScreenConnect installer, which was configured to transform the legitimate remote monitoring and management tool into a command-and-control channel for the attacker.
The effectiveness of these attacks stems from how calendar invitations operate. Meeting invitations are sent to both a user's inbox and their calendar application, effectively doubling the potential exposure. Crucially, even if an email security solution quarantines the malicious email, the calendar event might still appear on the user's calendar due to the different protocols involved. This can lead to users encountering the malicious link out of context, potentially clicking it out of curiosity or a mistaken belief that it's a legitimate, albeit forgotten, appointment.
Defenders are working to combat this evolving threat by developing new detection layers and defensive options for security teams. However, the attackers' reliance on free, legitimate tools and services makes it difficult and inexpensive for them to adapt and maintain their campaigns. Security teams are advised to ensure their email security solutions also scan calendar entries and can remediate associated events. Red flags for users include unexpected invites from unknown senders using free email accounts, urgent business-themed invitations, and links pointing to free website builders.
Recipients of suspicious calendar invites are urged to exercise extreme caution. Carefully examine unfamiliar entries, especially those prompting sign-ins, file downloads, or urgent financial actions. Verifying the legitimacy of the invite with the supposed sender through a separate, trusted communication channel is paramount before taking any action. This vigilance is key to mitigating the growing threat posed by these calendar-based attacks.