Malicious Calendar Invites Surge With Malware Links

Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious installer. The risk is that people trust calendar entries more than emails and may click links or QR codes inside the invite.

Key findings

• Calendar-based phishing/malware attacks (ICS invites) are rising sharply, with Sublime reporting large month-over-month increases.
• Many email/calendar tools can auto-add invites to calendars before a user accepts/declines, increasing exposure.
• A real example used a financial lure (“credit against a recent invoice”) to drive the target to a hosted page and download a malicious MSI.
• Even declining/RSVP’ing can help attackers confirm the email address is active.
• Attackers abused trusted infrastructure (Google Calendar/Gmail and Microsoft infrastructure) and free hosting (Framer) to evade detection.
• The downloaded MSI abused a legitimate remote access tool (ScreenConnect) to provide command-and-control capabilities.

Who’s being targeted

• Commonly targeted roles: All employees, Finance/AP/AR teams, Executive assistants and heavy calendar users, IT/Helpdesk (to support reporting and calendar-setting changes).
• Affected industries: Any organization using Microsoft Outlook, Gmail/Google Calendar, or Apple Mail, Finance and Accounts Payable/Receivable teams (invoice/credit lures).
• Attack channels: email.
• Impersonated: A billing or accounts department (invoice/credit issuer).

Awareness takeaways

• Treat calendar invites like emails: don’t click links or QR codes in invites you weren’t expecting; delete/report instead.
• Do not RSVP/Decline suspicious invites, delete the calendar event directly to avoid confirming your address is active.
• Reduce risk by changing calendar settings so invites from unknown senders are not automatically added to calendars.
• Be skeptical of urgency or financial pressure in meeting invites (e.g., invoice credits) and verify through trusted channels.

Red flags to watch for

• Unexpected invoice/credit notice pushing you to click a link
• Invite appears in calendar even before you accepted it
• Hosted on a generic/free site and uses a generic button like “View Here” to download a file