Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or phone scams. Because some calendar apps can add invites automatically, victims may never notice the original email invite.
This attack abuses a feature meant to make scheduling easier: calendar apps that automatically add invitations to a user's calendar. Attackers send a calendar invite disguised as a routine notification, such as a new voicemail, a payment receipt, a PayPal unusual activity alert, or an auto-renewal warning. Because some calendar apps add these events automatically, the invite can appear directly in the victim's calendar without them ever opening or interacting with the original email.
The event description typically contains either a link or a phone number. Clicking the link leads to a fake login page impersonating a service like Microsoft, Google, or PayPal, designed to harvest credentials. Calling the phone number connects the victim to a fake 'support' line, where they may be asked to cancel a charge that never actually happened, handing over personal or account details in the process.
The tactic succeeds because it exploits trust in the calendar itself rather than the inbox. Many people are trained to scrutinize suspicious emails but may not apply the same skepticism to something that simply shows up as an appointment or reminder. Attackers increase the illusion of legitimacy in a few ways:
Red flags that point to this type of attack include:
Organizations and individuals can reduce exposure to this technique with a few practical steps. Treat an unexpected calendar invite the same way you would treat a suspicious email: don't click embedded links or call listed phone numbers. Where possible, disable automatic acceptance of calendar invitations or restrict invites to known senders. If an invite looks suspicious, avoid clicking 'decline', since this can confirm to the attacker that the email address is active; instead, delete the invite or report it as spam or junk. Finally, remain cautious even when an invite appears to come from inside the organization or uses a recognizable platform, since branding and sender names can be spoofed or misused to add false credibility.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers send calendar invitations that mimic voicemails, payment receipts, or auto-renewal alerts. The event description contains a link to a fake login page or a phone number to call, and some calendar apps add these invites automatically without the user accepting them.
Because some calendar apps can add invitations automatically, victims may never see or open the original email invite, so the suspicious event just appears in their calendar as if it were legitimate.
No. Declining can confirm to the sender that your email address is active. Instead, delete the invite or report it as spam or junk.
Common lures impersonate services like Microsoft, Google, and PayPal with fake login pages, or use legitimate platforms such as Zoom to make the invite look more trustworthy.
You open your calendar and see this: “Payment receipt confirmation – $298.99” with a Zoom icon and our company logo. You never accepted an invite, but calendar phishing is growing fast, and apps like Google Calendar can auto-add these. Inside the event: a link to “view details” or a “support” number to cancel a charge that never happened. Click that link and you land on a perfect-looking Microsoft, Google, or PayPal login page. But it’s a credential-harvesting fake, built just to grab your password or keep you talking on the phone. Here’s the move: if a calendar invite pops up that you don’t recognize, especially for payments, voicemails, or auto-renewals, don’t click links or call numbers in it. Delete it and report it as spam.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Cofense reports ongoing mass email campaigns that impersonate trusted brands (and even government agencies) to trick recipients into calling a phone number for “remediation.” The lures typically claim an unauthorized purchase or a password reset and use urgency to pressure victims into acting…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Cofense observed a real phishing email that impersonates OpenAI/ChatGPT billing to trick users into “updating” payment details. The email uses the real ChatGPT logo, urgency (“48 hours”), and a prominent button to drive clicks to a lookalike ChatGPT login page. Any credentials entered are harvested…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
