Calendar phishing attacks surge as scammers exploit automatic meeting invites

A new wave of phishing attacks is leveraging calendar applications to deliver malicious invitations, according to threat detection engineer Luke Wescott of Sublime Security. The scheme involves sending calendar requests that automatically appear in tools like Google Calendar, presenting fake meetings, voicemail alerts, or payment confirmations that contain deceptive links or phone numbers. Because the invites are treated as legitimate schedule items, users are more likely to trust them, especially when they appear alongside genuine appointments.

Max Gannon of Cofense adds that scammers sometimes use authentic services such as Zoom to make the invitations harder to block, and even AI-based security tools can miss them without also filtering out real events. The attacks remain harmless until the recipient clicks the link or calls the number, at which point their credentials can be harvested for further fraud. Both experts recommend disabling automatic acceptance of invites and treating unexpected calendar entries with the same caution applied to suspicious emails.