Phishing Attacks Surge via Malicious Calendar Invites
Security researchers report a massive rise in calendar-based scams targeting Microsoft accounts and remote tools.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that current security tools effectively protect your personal calendar from malicious phishing invites?
Security providers report a massive spike in phishing attacks using malicious calendar invitations to steal account credentials. The campaigns exploit separate protocols for email and calendar systems to bypass traditional security filters.
Why it matters
By leveraging legitimate services and different communication protocols, attackers can easily bypass email defenses. The use of free tools allows these sophisticated campaigns to operate at almost no cost to the criminals.
Attackers are utilizing 10MB ScreenConnect installers to establish command-and-control channels on victim devices. These campaigns frequently weaponize .ics file attachments and links hosted on services like Framer to improve delivery.
The players
Sublime Security
This is a cybersecurity firm that specializes in providing advanced email and collaboration platform protection solutions.
Microsoft
This is a global technology corporation that develops the software and account ecosystems frequently targeted in these phishing campaigns.
The details
Criminals send meeting invitations directly to user inboxes and calendars to maximize exposure to malicious links and installers. These automated campaigns often use legitimate third-party services to add a layer of perceived authenticity to the phishing attempts.
Timeline
April 2026: The attack volume began at approximately a few thousand messages per month.
August 2026: Sublime Security recorded a 1,216% month-over-month increase in malicious attacks.
September 2026: The volume of attacks grew by 1,426% compared to the August figures.
October 2026: Malicious calendar invitation volume exceeded 740,000 in the first two weeks.
The Tech Race
These calendar-based phishing attempts follow the pattern set by the rise of business email compromise (BEC) and social engineering tactics. This shift marks a technical evolution in how threat actors conduct campaigns by diversifying beyond standard email-based delivery.
Users should exercise caution when receiving unexpected meeting invites from unknown sources, even if they appear to originate from legitimate services. Verifying the sender and avoiding downloads of associated installers is essential to preventing credential theft.
The takeaway
Users should configure their calendar settings to restrict invitations from unverified senders to reduce exposure to these automated threats. Treat calendar invites with the same level of skepticism typically reserved for unsolicited emails.
Further reading
For more on the current threat landscape, see the Cybersecurity section.
Live Poll
Do you trust that current security tools effectively protect your personal calendar from malicious phishing invites?
