Calendar phishing attacks surge as fraudsters exploit automatic invitation features

A rapidly expanding form of cybercrime is targeting users through their electronic calendars, with threat detection experts reporting exponential growth in incidents. The scam involves fraudulent meeting or renewal reminders appearing in victims’ schedules, designed to lure them into logging in to fake versions of popular platforms such as Google, Microsoft, or PayPal. Unlike traditional phishing emails that may be ignored or filtered into spam folders, these attacks exploit the way calendar applications handle incoming invitations, creating a more convincing and difficult-to-detect threat vector for both individuals and organisations.

The mechanism of the attack relies on the automatic acceptance features built into many calendar services. Scammers send an email containing a calendar request to a target’s work or personal address. Even if the recipient does not open the email or it is routed to a junk folder, calendar applications such as Google Calendar can add the invitation to the schedule automatically. This bypasses the need for user interaction with the initial email, allowing the fraudulent entry to appear alongside legitimate appointments. The presence of the event in the calendar lends it a sense of borrowed credibility, as it sits in the same digital space as routine professional meetings or personal engagements, making users less likely to question its authenticity.

Fraudsters are increasingly using legitimate platforms to send these invitations, further complicating efforts to block them. Security analysts note that invitations sent through recognised services appear more convincing to recipients and can evade detection by security software, including artificial intelligence-backed blockers. Creating filters to block such invitations risks also preventing legitimate meeting requests from being received. The titles of these fraudulent events vary widely, including fake meetings, notifications of voicemail messages, software renewals, and payment confirmations. Some attackers even customise the content to mimic internal company communications, adding corporate logos to make the invitation appear as if it originated from within the organisation.

The primary goal of these scams is to trick users into clicking a link or calling a phone number provided in the event description. These links typically direct victims to fake login pages for major technology or financial services, where they are prompted to enter their credentials. Alternatively, the event may include a support number for cancelling a charge that never occurred. Once users provide their details, fraudsters can sell the information, use it to breach work email accounts, or impersonate the victim to contact their bank or other institutions. It is important to note that merely receiving the calendar invitation does not compromise the user’s security; the risk only materialises if the user interacts with the fraudulent link or phone number.

Security experts advise treating unexpected calendar entries with the same suspicion as unsolicited emails. Users are urged to avoid clicking on any links contained within suspicious invitations. To mitigate the risk, it is recommended to disable the automatic acceptance of calendar invitations. In Google Calendar, for instance, users can adjust their settings to only accept invitations from known senders or those that have been explicitly accepted. Additionally, rather than declining suspicious invitations, which can signal to the sender that the email address is active, users should delete the entry or report it as spam. Maintaining a high level of vigilance is essential, as scammers may use the names of colleagues or internal contacts to increase the likelihood of success.