Calendar invite phishing is a social engineering attack that uses meeting invitations, calendar event files, or scheduling notifications to direct people toward malicious websites, credential-harvesting pages, fraudulent payment requests, or other unauthorized actions. Organizations can reduce the risk by combining email and calendar security controls, phishing-resistant authentication, trusted sign-in procedures, practical employee guidance, and incident response processes that account for malicious invitations appearing inside calendar applications.
The threat is particularly relevant to organizations using Microsoft 365, Outlook, Teams, Google Workspace, and other integrated collaboration environments. Employees regularly receive meeting invitations from colleagues, customers, suppliers, and external partners, making calendar interactions an ordinary part of business operations. Attackers exploit that familiarity by placing deceptive requests inside objects that resemble legitimate meetings.
In October 2026, Check Point researchers reported a large Microsoft 365 phishing campaign involving more than 302,000 unique phishing emails reaching over 40,000 organizations. The attacks used calendar invitations and meeting-related content to direct recipients toward fraudulent destinations, including fake Microsoft authentication pages. The campaign illustrates how phishing can move beyond conventional email messages into the everyday workflows employees use to organize and perform their work.
What is calendar invite phishing?
Calendar invite phishing is a form of phishing in which attackers use calendar invitations or meeting-related notifications to persuade recipients to visit malicious destinations or disclose sensitive information. The attack may arrive as an email invitation, an attached .ics file, a calendar event, or a meeting notification that appears to come from a legitimate person or organization.
Unlike conventional phishing emails, which may explicitly request account verification or immediate action in the message body, calendar phishing can embed the deceptive request inside a familiar scheduling workflow. The recipient may encounter a meeting title, organizer name, agenda, location field, or join link that appears consistent with an ordinary business meeting.
The attack depends on the recipient treating that information as sufficiently credible to act upon.
For example, an employee may receive what appears to be an invitation to a Microsoft Teams meeting. The event includes a familiar meeting title and a link labeled as a way to join or review the invitation. Following the link leads to a fraudulent Microsoft 365 sign-in page designed to capture the employee's credentials.
The calendar invitation itself may be technically valid. The risk arises from the malicious instructions, links, or destinations associated with it.
How does a calendar invite phishing attack work?
A calendar phishing attack typically begins when a malicious actor creates a meeting invitation or calendar event containing a deceptive link or instruction. The attacker then distributes the invitation to targeted employees, often using ordinary email and scheduling functionality.
The recipient may see the invitation in their inbox, calendar application, or associated notification system. Depending on the platform, configuration, and user settings, an invitation may be displayed or provisionally added to the calendar before the employee explicitly accepts it.
The attacker then relies on the employee interacting with the event.
A typical credential-phishing scenario follows this sequence:
- A fraudulent invitation is created. The attacker uses a convincing meeting title, organizer identity, and familiar scheduling format to make the event appear legitimate.
- The invitation reaches the employee. It may arrive as an email, an
.icsattachment, or a calendar-related notification. - The employee encounters the event. The invitation appears within an ordinary workflow where employees expect to accept meetings, review agendas, and join calls.
- The employee follows a deceptive link. A join, review, authentication, or confirmation link redirects to a malicious destination.
- The attacker attempts to obtain something valuable. This may involve stealing credentials, collecting payment information, or persuading the employee to take another unauthorized action.
The exact mechanics vary by campaign. Some attacks rely on fraudulent websites that imitate Microsoft 365 or other services, while others use meeting-related pretexts to encourage payment or disclosure of sensitive information.
The important distinction is that the attacker uses a legitimate business format to deliver an illegitimate request.
What is an ICS phishing attack?
An ICS phishing attack uses an iCalendar file, commonly identified by the .ics extension, to deliver malicious meeting information or links.
The iCalendar format is widely used to exchange calendar events between scheduling systems. An .ics file can contain information such as the event title, organizer, time, description, location, and related URLs. These are legitimate features that support interoperability between calendar applications.
Attackers can abuse those features by inserting deceptive content into fields that recipients are likely to read or interact with.
For example, a calendar file may contain a meeting description that instructs the recipient to authenticate before joining. The linked destination may imitate a Microsoft sign-in page while sending submitted credentials to an attacker.
A valid .ics file does not necessarily indicate a safe invitation. File-format validity establishes that the calendar application can interpret the event data; it does not establish the trustworthiness of the organizer or the legitimacy of embedded links.
This is why organizations should avoid treating calendar files as harmless simply because they are not executable programs.
Can a malicious calendar invite appear in Outlook without being accepted?
Yes. Depending on Microsoft 365, Outlook, and mailbox configuration, meeting invitations can be displayed in calendar-related views before the recipient formally accepts them. Some calendar systems also process invitation information automatically to support scheduling and availability.
The precise behavior depends on the client, platform, and settings. Security teams should test how their own environment handles invitations from external organizers rather than assuming every employee experiences the same workflow.
This matters because employees may encounter suspicious information in their calendar after the original email has been delivered, filtered, or otherwise processed.
Check Point has also documented scenarios in which malicious calendar objects remained accessible after the associated phishing email was blocked. That creates an important operational consideration: removing or quarantining an email may not always remove every representation of the malicious invitation.
Source: Check Point — Enhanced Protection for Calendar-Based Attacks in Microsoft 365 Emails
Organizations should therefore investigate how email security, calendar processing, event synchronization, and remediation operate together.
Why are calendar invitations effective phishing lures?
Calendar invitations can be persuasive because they arrive through familiar interfaces associated with routine business activity.
Employees are accustomed to receiving invitations from people outside their organization. A customer may schedule a project meeting, a supplier may send a product demonstration, or a prospective partner may arrange an introductory call. External invitations are therefore not inherently unusual.
Calendar applications also present information using consistent visual conventions. Meeting titles, organizer names, dates, locations, and join links make an event immediately recognizable as a scheduling object.
That familiarity can influence how the recipient interprets the request.
An employee who would examine an unexpected email asking them to log in may approach a meeting invitation differently. The person may be focused on whether they can attend, what the meeting concerns, or whether the time conflicts with another commitment.
The security-relevant decision can become embedded in a routine action.
This is a useful example of why cybersecurity training needs to address habitual behavior and workflow context. Recognizing a phishing email and recognizing a suspicious authentication request inside a calendar event are related skills, but they occur under different conditions.
We explore this broader human-factors problem in The Calendar Invite Looked Normal. That's the Problem.
How can employees recognize a suspicious calendar invitation?
Employees should look for inconsistencies between the meeting's apparent purpose, the organizer's identity, and the actions the invitation requests.
An unexpected invitation is not automatically malicious. Legitimate customers, suppliers, and colleagues frequently schedule meetings without prior notice. The more useful question is whether the event contains instructions or destinations that are unusual for the business activity involved.
Potential warning signs include:
- An unfamiliar organizer claiming to represent a trusted organization or colleague.
- A meeting invitation that unexpectedly requires the recipient to re-enter Microsoft 365 credentials.
- A join or review link that leads to an unfamiliar domain.
- A request for payment, billing details, or other sensitive information before attending a meeting.
- A meeting description that creates unusual urgency or threatens account suspension.
- A request to bypass normal authentication, verification, or approval procedures.
- An invitation whose subject, organizer, or purpose cannot be reconciled with the recipient's work.
These indicators should prompt appropriate verification rather than automatic assumptions.
A legitimate meeting invitation may come from an unfamiliar address, and a fraudulent invitation may use a convincing organizer name. Employees should understand that visual familiarity alone is insufficient to establish authenticity.
When a meeting appears unusual, the recipient should confirm its legitimacy using an established contact method or trusted business channel before following suspicious instructions.
How can organizations prevent calendar invite phishing in Microsoft 365?
Organizations using Microsoft 365 should implement layered controls that address malicious invitation delivery, credential theft, identity compromise, and employee interaction with suspicious calendar events.
The exact configuration will depend on the organization's Microsoft licensing, security architecture, and operating requirements. Security teams should evaluate the capabilities available in their environment and test how those controls behave with external invitations.
Strengthen email and calendar threat protection
Security teams should evaluate how their email security tools inspect meeting invitations, .ics attachments, event descriptions, and embedded URLs.
Microsoft Defender for Office 365 and compatible third-party security platforms may provide protections against malicious links and phishing content, depending on the organization's configuration and licensing.
Security administrators should also examine whether their tools can detect and remediate malicious calendar objects after delivery.
This is particularly important when the original message has been removed but an associated event remains accessible.
Use phishing-resistant authentication
Phishing-resistant authentication, such as appropriately implemented FIDO2 security keys and passkeys, can substantially reduce the risk that credentials entered into a fraudulent website will be sufficient for account takeover.
Conventional multifactor authentication remains valuable, but some methods can be vulnerable to phishing or adversary-in-the-middle attacks.
Organizations should prioritize stronger authentication for accounts and populations where compromise would have significant consequences.
Authentication controls should be complemented by appropriate session protections, conditional access policies, and monitoring for suspicious sign-in activity.
Establish trusted sign-in practices
Employees should know how to access Microsoft 365 and other important business applications through trusted routes.
An unexpected calendar invitation should not become the reason someone enters credentials into an unfamiliar website.
Organizations can reinforce the use of approved applications, bookmarks, and established authentication flows, particularly when a meeting invitation claims that additional account verification is required.
Review external invitation handling
Security teams should assess how invitations from external organizers are processed, displayed, and added to employee calendars.
Controls should reflect legitimate business needs. Many organizations depend on external meetings, so broadly blocking invitations may be impractical.
The objective is to understand the exposure, apply appropriate filtering and protections, and identify whether suspicious calendar objects can persist after an email security action.
Make suspicious invitations easy to report
Employees should have a clear way to report suspicious calendar invitations, including those that appear in a calendar application rather than as a conventional email.
Reporting procedures should explain whether the employee should preserve the event, report the associated email, contact the service desk, or use another approved mechanism.
Security teams should also be prepared to investigate and remediate related events across affected mailboxes and calendars.
These measures help address the technical and operational weaknesses that a calendar phishing campaign may exploit.
Can phishing-resistant MFA stop calendar invite credential phishing?
Phishing-resistant multifactor authentication can significantly reduce the risk of account compromise from credential-harvesting attacks, but it does not eliminate every risk associated with malicious calendar invitations.
FIDO2-based authentication is designed to bind authentication to the legitimate service, making it substantially harder for a fraudulent website on a different domain to obtain reusable authentication credentials.
This is particularly valuable when an attacker directs an employee to a fake Microsoft 365 login page.
However, a malicious calendar invitation may attempt to induce other actions. The attacker may seek payment information, confidential documents, unauthorized approvals, or access to a separate system.
An employee may also be persuaded to take an action that does not require stealing credentials.
Organizations therefore need both strong authentication and appropriate verification and authorization controls for consequential business activities.
The security objective is to prevent a deceptive invitation from becoming an unauthorized action, regardless of the attacker's preferred method.
How should organizations train employees to prevent calendar phishing?
Calendar phishing training should teach employees how to recognize when an ordinary scheduling interaction has become a security-sensitive request.
A useful program explains the threat, demonstrates realistic examples, and reinforces the actions employees should take when they encounter unexpected authentication prompts, unfamiliar destinations, or suspicious meeting instructions.
The learning should reflect the applications employees actually use.
For Microsoft 365 users, this may include examples of Outlook invitations, Teams meeting links, calendar notifications, and fraudulent sign-in pages. For organizations using Google Workspace or other collaboration platforms, the examples should reflect those environments.
Training should also distinguish between recognizing a warning sign and performing the correct response.
An employee may notice an unfamiliar domain but remain uncertain about what to do. Another may suspect that an invitation is fraudulent but worry about ignoring an important customer meeting.
Realistic scenarios can help employees practice confirming the meeting through an established contact channel, accessing services through trusted routes, and reporting suspicious events.
The objective is to develop behaviors that transfer to everyday work rather than teaching employees to memorize a new collection of phishing examples.
Cybermaniacs' Cyber Learning Experience supports ongoing, contextual cybersecurity learning, while our Cybersecurity Content as a Service helps organizations reinforce emerging threats through targeted campaigns and communications.
Should organizations run calendar phishing simulations?
Calendar phishing simulations can be useful when they are designed to evaluate realistic behavior and support clearly defined learning objectives.
A simulation might present an unexpected meeting invitation containing an unfamiliar authentication destination. The organization could evaluate whether employees recognize the risk, avoid entering credentials, use an appropriate verification method, and report the suspicious event.
However, simulation results should be interpreted carefully.
A click does not necessarily establish that an employee would disclose credentials, and a report does not necessarily prove that the employee understood the underlying threat. The exercise may also be affected by familiarity with the simulation platform, previous campaigns, or the artificial conditions of the test.
Organizations should evaluate the decisions that matter rather than treating a single interaction as a comprehensive measure of human risk.
Simulations can be combined with competency assessments, realistic scenario questions, and evidence from business workflows to build a more meaningful picture of preparedness.
Our guide to verification behavior in cybersecurity explains how recognizing a verification requirement, selecting an appropriate method, executing the action, and escalating uncertainty can be evaluated separately.
How should organizations respond to a malicious calendar invitation?
Incident response should account for both the malicious invitation and any actions the recipient may have taken.
If an employee identifies a suspicious event without interacting with the malicious destination, the organization should follow its reporting and investigation procedures. Security teams may need to examine the invitation, embedded links, sender information, related messages, and any associated calendar objects.
If an employee has entered credentials or approved an unexpected authentication request, the response becomes more urgent.
Depending on the circumstances, appropriate actions may include securing the account, revoking active sessions, reviewing authentication methods, investigating suspicious sign-ins, examining mailbox activity, and determining whether information or access was compromised.
Organizations should also investigate whether similar invitations reached other employees.
Removing the originating email may not be sufficient if associated calendar objects remain accessible. Security teams should verify that remediation covers the relevant systems and that users are no longer exposed to the malicious content.
Employees should be encouraged to report suspected interaction promptly, even if they are uncertain whether the invitation was fraudulent.
Early reporting can help contain potential compromise and identify related attacks.
How can security teams investigate calendar invite phishing campaigns?
Security teams should investigate calendar phishing using evidence from email security systems, calendar and mailbox activity, identity logs, URL analysis, and endpoint or browser telemetry where available and appropriately authorized.
The investigation should establish how the invitation was delivered, which employees received it, whether the malicious destination was accessed, and whether any credentials or other sensitive information may have been disclosed.
Analysts should examine relevant indicators such as organizer addresses, domains, URLs, message identifiers, event details, and associated authentication activity.
They should also determine whether the event appeared in calendar applications and whether it persisted after the original email was blocked or removed.
The investigation should distinguish between delivery, exposure, interaction, and compromise.
A delivered invitation does not prove that the recipient opened it. An opened event does not establish that the malicious link was followed. Visiting a fraudulent page does not necessarily prove that credentials were submitted.
These distinctions matter for incident response, reporting, and risk measurement.
Organizations should preserve sufficient evidence to support reliable conclusions while respecting applicable privacy, security, and data retention requirements.
How do calendar phishing attacks differ from ordinary email phishing?
Calendar phishing and conventional email phishing often pursue similar outcomes, including credential theft, unauthorized access, or financial fraud. The main difference is how the malicious request is presented and how the recipient encounters it.
| Dimension | Conventional email phishing | Calendar invite phishing |
|---|---|---|
| Primary presentation | Email message | Meeting invitation or calendar event |
| Familiar user action | Read, reply, open, or click | Accept, review, join, or follow meeting instructions |
| Common deception | Fraudulent sender, request, or link | Fraudulent organizer, meeting details, or join link |
| Potential credential lure | Account verification or document access | Meeting authentication or invitation review |
| Exposure surface | Inbox and email client | Inbox, calendar, reminders, and meeting interfaces |
| Important defensive consideration | Email filtering and suspicious-message recognition | Email/calendar integration, event persistence, and workflow-specific verification |
These categories can overlap. A calendar phishing attack may begin as an ordinary email, and a conventional phishing email may imitate a meeting notification.
The distinction is useful because it highlights how the surrounding interface and expected user behavior can influence risk.
How can organizations measure whether calendar phishing defenses are working?
Organizations should evaluate calendar phishing defenses through technical control evidence, employee competency, behavioral performance, and incident response effectiveness.
Technical measures may include the detection and blocking of malicious invitations, identification of dangerous destinations, removal of malicious calendar objects, and prevention of unauthorized authentication.
Human risk measures can examine whether employees recognize unexpected credential requests, avoid unfamiliar authentication destinations, verify suspicious meeting instructions, and report potential attacks.
Organizations should also assess whether employees know what to do after interacting with a suspicious invitation.
These findings should be interpreted in context.
A high reporting rate may indicate effective awareness, but it can also reflect greater exposure to suspicious invitations. A low click rate in a controlled simulation may suggest improved performance without establishing that employees will respond identically during real work.
A useful assessment connects the observed behavior to the relevant control and business process.
Cybermaniacs' Human Risk Assessments and Baselines help organizations evaluate workforce competency, behavior, culture, and organizational conditions in the context of meaningful security risks.
The goal is to determine whether employees and controls are prepared for the situations they actually encounter.
What does calendar phishing reveal about modern Human Risk Management?
Calendar phishing illustrates why Human Risk Management needs to examine the decisions employees make inside ordinary business workflows.
An employee may understand phishing and still fail to recognize that a familiar scheduling interaction requires additional scrutiny. A technically valid calendar file may contain a fraudulent instruction. A malicious event may remain visible in a trusted application after the originating message has been removed.
These are interactions between technology, process design, and human behavior.
Organizations need technical protections that address malicious content across integrated systems. They also need employees who understand when routine actions become security-sensitive, how to establish legitimacy, and what to do when something cannot be verified.
This requires assessment and learning that reflect the actual working environment.
The broader principle applies to collaboration messages, document-sharing requests, QR codes, account recovery workflows, and AI-enabled business processes. Attackers can change the interface through which they deliver a request, but the organization still needs to determine whether the requested action is legitimate and appropriately authorized.
We examine that broader challenge in How Should Organizations Assess Human Risk in High-Risk Business Processes?.
Calendar phishing prevention starts with understanding the workflow
Calendar invitations are essential to modern work, and organizations cannot eliminate the risk by treating every external meeting request as suspicious.
Effective prevention depends on understanding how invitations move through email and calendar systems, how employees interact with them, and where those interactions can lead to consequential actions.
Technical controls should detect and remove malicious content, protect identities, and reduce the opportunity for account compromise. Employees should understand how to recognize unexpected authentication requests, verify unusual instructions, and report suspicious events.
Security teams should also test whether those protections work together across the actual applications and workflows employees use.
The lesson from calendar phishing is practical: a familiar interface can contain an untrusted request. Organizations become more resilient when their controls and employees can recognize that distinction before a routine interaction becomes a security incident.
Frequently asked questions
What is calendar invite phishing?
Calendar invite phishing is a social engineering attack that uses meeting invitations, calendar event files, or scheduling notifications to direct recipients toward malicious websites, credential-harvesting pages, fraudulent payment requests, or other unauthorized actions. The invitation may appear legitimate because it uses familiar calendar formats and meeting conventions.
Can an ICS calendar invitation contain a phishing link?
Yes. An .ics calendar file can contain event descriptions, locations, and URLs that direct recipients to external websites. Attackers can abuse these legitimate fields to include links to fraudulent authentication pages or other malicious destinations. A technically valid calendar file does not establish that its contents are trustworthy.
How can organizations stop calendar phishing in Microsoft 365?
Organizations can reduce calendar phishing risk through layered email and calendar security, malicious-link protection, phishing-resistant authentication, appropriate external invitation handling, employee training, and incident response procedures that account for malicious events appearing in calendar applications.
Can a phishing calendar event remain after the email is deleted?
In some configurations and attack scenarios, a calendar event may remain accessible after the originating email has been blocked or removed. Security teams should verify how their email and calendar security tools handle event persistence and remediation rather than assuming that deleting the message removes every associated object.
What should an employee do after clicking a suspicious calendar invitation?
Employees should stop interacting with the suspicious destination and report the incident through the organization's approved security channel. If they entered credentials, approved an unexpected authentication request, or disclosed sensitive information, they should report those actions promptly so the security team can assess and contain potential compromise.
Should organizations include calendar phishing in security awareness training?
Yes. Calendar phishing is a useful scenario for teaching employees how to recognize unexpected authentication requests, verify meeting-related instructions, avoid unfamiliar sign-in destinations, and report suspicious events. Training should use realistic examples from the calendar and collaboration applications employees use in their work.
