Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and device compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An invite appeared on your calendar? That doesn't mean it's safe. One fake meeting says, 'Sign in to review the meeting details.' Its .ics invite or email link opens a spoofed Microsoft sign-in page built to steal your password. Another Google Calendar invite from Gmail pushes an 'urgent financial meeting.' Its link goes to a Framer page offering ScreenConnect, even after your browser warns about the download. The aha: email quarantine doesn't quarantine your calendar. Unexpected invite? Confirm it with the sender using a contact method you already know.
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
