Calendar Invite Phishing: The Scam That Looks Like a Real Meeting
Phishing attacks are getting harder to spot.
We are used to looking for the obvious warning signs: strange email addresses, spelling mistakes, suspicious attachments or messages that simply do not look right.
But what happens when the message comes from someone you know, through a legitimate service, and appears directly on your calendar?
That is exactly what makes a newer form of calendar invite phishing so effective. We have seen several examples recently, and businesses should know what to watch for.
How Calendar Invite Phishing Works
The attack starts with something completely ordinary: a calendar invitation.
An event appears on your calendar even though you did not accept it. That alone may not seem unusual. Many calendar platforms automatically display invitations so you can see potential scheduling conflicts before deciding whether to attend.
The invitation may also appear to come from someone you know.
In fact, the calendar invitation itself may be legitimate. It can be sent through Google Calendar or another trusted platform from a real, compromised account. That means many of the warning signs people have been trained to look for simply are not there.
Then Comes the Reason to Click
The event description usually contains a simple message designed to get your attention.
For example:
“You have a new voicemail. Click here to listen.”
It sounds routine, so you click.
The link opens a page asking you to sign in before listening to the message. The login page looks familiar, and signing in again does not seem unusual.
But the page is fake. Once you enter your username and password, the attacker has your credentials.
Your Account Becomes the Next Sender
This is where the attack can spread quickly.
Once attackers gain access to your account, they may be able to read your email, access files and use your calendar.
They can then send the same malicious invitation to your contacts from your actual account, with your name attached to it.
The next recipient now sees an invitation from someone they recognize and trust. If they fall for it, their account can become the next source of invitations. That chain reaction is one reason this type of phishing can spread so effectively.
Why This Type of Phishing Is So Difficult to Spot
Most phishing awareness focuses on identifying things that look unusual.
Calendar phishing works because much of it looks normal.
The invitation may be real.
The sender may be familiar.
The calendar platform may be legitimate.
The message may be professionally written.
And being asked to log in again is something most of us experience regularly.
Individually, none of those things necessarily feels suspicious.
The attack works by removing many of the warning signs people normally rely on when deciding whether something is safe.
How to Protect Yourself from Calendar Invite Phishing
A few habits can make a significant difference:
- Be cautious with unexpected login pages. If a link takes you to a sign-in screen, avoid entering your credentials immediately. Instead, go directly to the service using your normal bookmark or by typing the address yourself.
- Watch for urgency. Messages such as “action required,” “new voicemail” or “you missed something” are designed to encourage quick decisions.
- Use multi-factor authentication (MFA). MFA is not foolproof, but it can make a stolen password much less useful to an attacker. For more ways to strengthen your security posture, see our Top 5 IT Security Tips to Keep Your Business Safe and Insurance-Ready.
- Verify unusual invitations another way. If an invitation from someone you know seems unexpected, send them a separate message or call them before clicking anything inside it.
What Should You Do If You Already Clicked?
Act quickly.
If you entered your password into a suspicious page:
- Change your password immediately.
- Contact your IT team.
- Have the account reviewed for suspicious activity.
- Check for unusual email rules, forwarding settings, MFA changes or messages and invitations sent from your account.
The sooner the account is secured and investigated, the better the chance of limiting the damage.
Reporting the incident quickly is far more useful than waiting to see whether anything happens.
Passwords and MFA Are Only Part of the Picture
These attacks become particularly dangerous after credentials have been stolen.
Traditional email security is often focused on stopping malicious messages before a user logs in. But if an attacker successfully signs into a legitimate account, organizations also need a way to identify unusual activity after the login.
That is where Identity Threat Detection and Response (ITDR) can add another layer of protection.
Digital Fire uses Huntress Managed ITDR to monitor Microsoft 365 and Google Workspace accounts for signs of account takeover, including:
- Logins from unusual locations
- Stolen user sessions
- Unexpected changes to MFA
- New inbox rules
- Email forwarding changes
- Unusual volumes of messages or calendar invitations
Suspicious activity can then be investigated by a 24/7 security team before an account compromise spreads further.
ITDR does not replace MFA, security awareness or good user habits. It provides another opportunity to detect the activity that gets past those controls.
The Bottom Line
Phishing is becoming more sophisticated because attackers increasingly use the tools and behaviours we already trust.
A calendar invitation from a familiar person may feel far safer than a suspicious email, but the same basic rule still applies:
If an unexpected link asks you to log in, stop before entering your credentials.
Go directly to the service instead, verify the request another way and contact your IT team if anything feels unusual.
If you would like to learn more about protecting Microsoft 365 or Google Workspace accounts with managed identity threat detection, contact us.
Recent Posts
