Fake Calendar Invites Hit 40,000 Organizations

Attackers sent large volumes of fake Microsoft 365 calendar invitations designed to steal employee credentials. The messages use familiar meeting requests, including apparent Microsoft Teams invitations and calendar files, to direct users to phishing pages. Some invitations can remain on an employee’s calendar even after the original email is removed.

Key findings

• Check Point identified more than 302,386 unique malicious emails targeting over 40,000 organizations.
• The campaign used malicious ICS calendar attachments and meeting links disguised as Microsoft Teams invitations.
• Calendar events may be added automatically by some email clients and can remain visible after the original phishing email is deleted.
• The campaign exploits normal employee behavior: accepting meetings, opening calendar reminders, and following conference links.
• Security response must remove both the phishing email and any malicious calendar event, then investigate potential account access.

Who’s being targeted

• Commonly targeted roles: All employees, Microsoft 365 users, Executive assistants, Administrative staff, IT helpdesk, Security operations teams.
• Affected industries: Multiple industries, Organizations using Microsoft 365.
• Attack channels: email, website.
• Impersonated: Microsoft Teams, External meeting organizer.

Awareness takeaways

• Verify unexpected meeting invitations through a known communication channel before opening links or accepting the event.
• Treat calendar attachments and meeting links with the same caution as other email links, especially when they request a Microsoft 365 sign-in.
• Do not assume deleting a suspicious email removes the risk; check your calendar for related events and reminders.
• Report unexpected authentication prompts or device authorization requests rather than approving them.

Red flags to watch for

• The meeting is unexpected or from an unfamiliar sender.
• The meeting link leads to an external or suspicious destination.
• The sender may use a new address or domain, making it look unrelated to the apparent meeting organizer.
• An unsolicited external calendar invitation contains a link.
• The event details include an unusual external destination.
• A calendar entry or reminder remains after the related email has been deleted.