Fake calendar invitations are flooding corporate inboxes in a phishing campaign targeting Microsoft 365 credentials. Security researchers have identified more than 302,386 unique malicious emails sent to over 40,000 organizations, with attacks accelerating throughout October.
The messages disguise credential-stealing links as routine meeting invitations, including Microsoft Teams requests. Some arrive with legitimate-format calendar attachments that can place suspicious events directly into a user's schedule, potentially keeping the phishing lure visible even after the original email disappears.
According to Check Point's Oct. 15 findings, activity surged beginning Sept. 25. The researchers observed more than 118,000 calendar-phishing emails in September and over 740,000 during the first two weeks of October alone.
Oct. 8 was the busiest recorded day, with nearly 200,000 messages. Check Point's detection system separately flagged 302,386 unique phishing emails across its customers, originating from more than 33,890 sender domains and 247,270 sender addresses.
Those figures describe observed phishing activity, not confirmed account compromises. They also refer to different measurements: the 302,386 count represents unique emails identified by Check Point's detection layer, while the October total reflects overall message volume.
How fake calendar invites steal Microsoft 365 credentials
The campaign relies on familiar workplace behavior. Employees regularly accept meeting invitations, follow conference links, and open calendar reminders without treating them as suspicious.
Attackers exploit that routine through two methods identified by Check Point:
- Malicious ICS attachments: The email contains a valid calendar file with an invitation directing the recipient toward a phishing destination.
- Disguised meeting links: A message resembling a Microsoft Teams invitation presents a meeting link that leads to a credential-harvesting page instead.
Neither method requires exploiting a Microsoft 365 software vulnerability. The attacker uses ordinary calendar functionality to persuade someone to follow a malicious link.
The large number of sender addresses and domains also makes simple blocklists less reliable. Blocking one address may have little effect when subsequent invitations arrive from different infrastructure.
Calendar abuse can create another problem after delivery. Netcraft researchers found that some email clients automatically add invitations to calendars, sometimes without the recipient opening the original message.
Depending on the client and its configuration, a malicious event can remain visible after the associated email is deleted. A user might encounter the link later through a calendar notification or reminder.
Other campaigns have taken the technique further.
Netcraft documented EvilTokens attacks that use meeting invitations to lure victims into Microsoft device-code authorization. Rather than entering a password on a fake login page, victims can be tricked into authorizing an attacker-controlled device.
This technique has also appeared in separate Microsoft 365 device-code phishing operations that abuse legitimate authentication workflows.
Mimecast documented another variation involving malformed calendar attachments and QR codes. These techniques are separate from Check Point's observed campaign and should not be attributed to the same attackers without supporting evidence.
Why deleting phishing emails may not remove the threat
Traditional phishing response often focuses on identifying malicious emails, removing them from mailboxes, and blocking their senders.
Calendar invitations introduce another place where the lure can remain.
An event that survives email removal may still contain its original meeting description, suspicious URL, or scheduled reminder. An employee could click the link days after the security team believes the incident has been contained.
That creates two distinct remediation tasks: remove the malicious message and determine whether a corresponding calendar entry exists.
Security teams investigating affected Microsoft 365 accounts should inspect relevant calendars, including events generated by suspicious external invitations. They should also review whether users followed embedded links or approved unexpected authentication requests.
The risks differ depending on the attack. A counterfeit sign-in page may expose a user's credentials, while a device-code phishing attempt can grant unauthorized access through an authentication token.
Research into the ARToken phishing kit documents how attackers can use Microsoft authentication workflows to maintain account access. That research concerns a separate threat operation, not a confirmed component of Check Point's calendar campaign.
How security teams can stop calendar invite phishing
Defenders need controls that examine both incoming invitations and the actions users take afterward.
KnowBe4 Threat Lab reported a 49% increase in calendar-invite phishing during the six-month period covered by its research. Its investigation recommends inspecting ICS content, evaluating suspicious links, and reviewing automatic invitation processing.
For Microsoft 365 administrators, practical steps include:
- Inspect ICS attachments: Check calendar files for suspicious URLs, unusual event details, and external destinations.
- Review calendar settings: Determine whether external invitations are automatically added to employee calendars and restrict that behavior where appropriate.
- Strengthen link protection: Evaluate suspicious destinations when users click them, not only when messages first arrive.
- Monitor authentication activity: Investigate unexpected sign-ins, suspicious device-code requests, and unauthorized application permissions.
- Expand incident response: Remove malicious calendar events as well as phishing emails, then check whether affected accounts were accessed.
- Train employees: Encourage users to verify unexpected meeting requests through an established communication channel before following their links.
If credentials were entered on a phishing page, responders should assess account activity, reset compromised credentials, revoke suspicious sessions, and investigate unauthorized changes. Where an attacker obtained application authorization, administrators may also need to revoke the affected permissions.
Microsoft 365 calendar phishing is not limited to one attacker or delivery method. The current Check Point findings establish extensive targeting, but they do not establish that 40,000 organizations were compromised.
For affected organizations, the immediate response should cover both locations where the attack can reach employees: the original message and any calendar event it created.
Also read: Microsoft recently disrupted a separate phishing network linked to more than 1 billion malicious messages, illustrating the scale of the infrastructure available to credential thieves.