By Sead Fadilpašić
Publication Date: 2026-10-16 15:00:00
- Phishing campaigns are abusing calendar invites and meeting requests to steal Microsoft 365 credentials
- Attackers hide malicious links in .ics files, fake meeting details, QR codes, and invite pages
- Researchers observed hundreds of thousands of phishing emails targeting over 40,000 organizations
If you get a calendar invite in your inbox be wary – it might be a carefully created phishing lure, designed to have you hand over Microsoft 365 or other login credentials.
Security firm Check Point Research (CPR) recently sounded the alarm for “several large-scale phishing campaigns,” abusing the fact that businesspeople routinely share calendar invites, and all designed to harvest their victim’s credentials.
Different approach, same result
CPR says it identified two separate approaches. In some cases, the threat actors would share calendar invites as .ics attachments. These pass email filters (since the file type itself is harmless) and land directly into people’s inboxes. In other…
