Quarantined, but still on your calendar: The explosion of invite-based attacks

There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned.

Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%.

Check Point’s numbers tell a similar story: the volume of these emails grew from a few thousand a month in April to more than 118,000 in September, and to more than 740,000 in just the first two weeks of October.

Phishing and malicious payloads

Check Point has identified several large-scale phishing campaigns that use fake meeting invites to steal Microsoft account credentials.

Some of these emails arrive with an .ics file – a universal calendar file format – as an attachment. “The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability,” Check Point explained.

Others carry, in addition to the .ics attachment, links in the email body that lead to a credential-harvesting page.

The goal of both is to trick users into entering their account credentials into a spoofed Microsoft sign-in page.

Sublime Security described a recent attack in which a Google Calendar invite with a financial lure, sent from a Gmail account, pointed to a page hosted on Framer, a no-code website builder.

The malicious email / invite (Source: Sublime Security)

Victims who clicked on the provided link and bypassed browser download warnings received a roughly 10MB ScreenConnect installer configured to turn the legitimate remote monitoring and management (RMM) tool into a command-and-control channel for the attacker.

Why calendar invites slip through

“Meeting invitations are sent to both calendars and inboxes. This means twice the exposure for targets,” Mark Morris, a Threat Detection Engineer at Sublime, explained.

In Sublime’s example, every step of the chain relied on free, legitimate offerings and features, including Google’s automatic rewriting of links in invites to redirect through google.com, which adds a layer of apparent legitimacy.

“Because email and calendar operate over different protocols, there is a non-zero chance that even if the target’s email security solution catches [and quarantines] the phishing email, the meeting would still land on the target’s calendar,” he pointed out.

Targeted users might eventually see the invite, but not be aware of the context. Puzzled, they may click on the link to check what it’s all about and remind themselves of a meeting, request or warning they believe they have forgotten, and end up compromising their computer or their account.

What defenders and users can do

Security vendors have been fighting the onslaught of fake calendar invitations by adding new detection layers and defensive options for IT and security teams, but some will pass through.

And since attackers are leveraging free tools, it costs them almost nothing to keep up with these attacks.

Security teams should make sure their email security covers calendar entries, not just inbox messages, and that remediating a malicious email also removes the associated event. Red flags include unexpected invites from first-time senders using free email accounts, business-themed invites with financial urgency, and links to free website builders.

Recipients – both consumers and employees – should carefully examine unfamiliar calendar entries, and treat any invite that pushes them to sign in, download a file or act on an urgent payment with suspicion. They should verify the invite with the supposed sender through a separate channel before taking any action.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!