Calendar Invite Phishing: How a Meeting Invite Becomes an Identity Attack

What Is ICS Calendar Invite Phishing?

ICS calendar invite phishing is an attack that delivers malicious links, QR codes, or attachments inside a calendar invite, usually an .ics file, so the lure lands on the victim's calendar as well as in their inbox. Mail clients can add the event automatically, which gives attackers a second chance to reach the target.

ICS files and auto-add, explained simply

An .ics file is a standard calendar file built on the iCalendar format, which lets Outlook, Google Calendar, and Apple Calendar exchange events. It can carry a title, description, organizer, location, attachments, and URLs. That flexibility is the problem: each field can hold attacker-written text or links.

The second ingredient is auto-add. Outlook and Google Calendar may create tentative events from an .ics attachment even if the user never opens the email. This automatic processing is turned on by default in many Microsoft 365 tenants.

Why a calendar invite makes a better lure than an email

There are several reasons this format is a stronger vector than simple email:

1. Employees handle meeting requests all day, so an unexpected invite looks routine.
2. Security tools have historically inspected email bodies and attachments, not calendar content.
3. The calendar entry can persist after the email is deleted, quarantined, or sent to junk.
4. Calendar notifications often reach phones, outside desktop-focused controls.

Simply stated: the victim is exposed twice, once in the inbox and again on the calendar.

Why Calendar Invite Phishing Is Surging in 2026

Calendar-based attacks grew every month from May to September 2026, according to Sublime Security's September 17, 2026 report, with researchers quoted by TechRadar.

The growth curve

Sublime reported these increases in calendar-based attacks it observed:

How the research has built up

The technique was documented well before the spike:

• November 2025: Sublime and Rapid7 describe ICS phishing and the calendar persistence problem.
• June 2026: Fortra's research team describes "CalPhishing," which abuses Microsoft 365 Groups and calendar invites, as summarized by Expert Insights.
• August 2026: Barracuda details how .ics files evade email-centric defenses.
• September 2026: Sublime publishes the surge figures above, and Digital Trends and TechRadar bring them to a general audience.

How the Attack Works, Step by Step

Most calendar invite phishing follows four stages: delivery, auto-add, hidden content, and a hand-off to a credential or malware trap.

Delivery: A sparse email with an .ics file, or an invite from a free Gmail account

In the email version, the message body is short and routine. Typical themes cover HR policy updates, benefits enrollment, compliance notices, and payroll actions. In the invite version, the attacker sends a calendar invite from a free account such as Gmail.

The "invisible click": Events that appear before anyone opens the email

Once the message syncs, the mail client may add the event on its own. Outlook often adds the invite as a tentative event without the user accepting it, and this can happen even if the email is never opened. The event then sits among real meetings, and reminders can resurface it later.

Where the malicious content hides

Because .ics is a text-based format, attackers can place content in several fields. Content can be base64-encoded and include fields such as SUMMARY, LOCATION, DESCRIPTION, and ATTACH. HTML-formatted descriptions, embedded images or QR codes, and unusual custom "X-" fields also serve as indicators.

Urgency is built in: be aware of invites scheduled to begin within minutes, with titles such as "Security Update Briefing" or "Your Account Verification Meeting."

The hand-off: Fake sign-in page, QR code, or remote-access tool

The event points the victim somewhere, and three destinations recur in the research:

• A fake sign-in page: Many of these pages are adversary-in-the-middle (AiTM) proxies that relay the real login in real time, capturing both the credentials and the authenticated session token. AiTM platforms are often behind calendar lures that lead to a fake Microsoft sign-in page pre-filled with the target's email address.
• A QR code: The code hides the destination from link scanners and moves the click to a phone.
• A remote-access tool: Links can point to a legitimate remote-management tool configured as a command-and-control channel.

The Main Calendar Invite Phishing Variants Security Teams Should Recognize

"ICS phishing" is not one attack. The research describes at least three distinct patterns, and each calls for a different control.

ICS attachment plus QR code leading to an AiTM login page

ProArch documented a campaign built on spear-phishing emails with .ics attachments themed around a fake regulatory policy review. Previewing the file in Outlook added the calendar entry without downloading anything to the device, and the invite contained a QR code. Scanning it opened a fake Microsoft sign-in page that was an AiTM proxy, capturing credentials and the authenticated session token in real time. Because the stolen session is already authenticated, the attacker does not need the MFA code again.

Invite leading to remote management software

Properly configured Microsoft environments can block the download, but less secured environments, or users who overrode the block, received it. Remote-management tools like this can be used to deploy infostealers or ransomware.

One example includes telling victims to call a phone number instead of using the real conference line. That pushes the attack toward the help desk and account recovery, a point we return to below.

Calendar invite phishing through Microsoft 365 Groups and shared files

In this scenario, the attacker creates a convincing group, such as one named for IT support or HR updates, and adds targets wherever external collaboration is allowed. The welcome emails are often clean because they come from a real Microsoft cloud service rather than a spoofed brand. A calendar invite then moves the interaction out of email, and shared files can host a fake support process, a QR code, or a credential-harvesting page. There is no patch, because the attack abuses legitimate features rather than a software flaw.

Why Email Security Often Misses Calendar Invite Phishing

Email filters were built to inspect email. Calendar invite phishing succeeds by putting the lure in a place those filters were not designed to look, and by outlasting the message that delivered it.

Calendar objects sit outside most inspection

Content in calendar metadata may receive less inspection than the email body because .ics files are plain text. This means many detection engines ignore them or parse them minimally, and few organizations monitor calendar content for embedded URLs. Even user report buttons typically act on email objects, not calendar objects.

Events persist after the email is deleted or quarantined

This is the most operationally important gap. Even if the user deletes the email, the calendar event can still remain visible, and the calendar entry often gets through when the email is blocked. A cleanup that removes only the message leaves the lure behind.

Mobile and QR hide the destination

A QR code embedded as an image hides the URL from link-based detection, and security tools may not decode the image at all. The victim then scans it with a personal phone, which can sit outside corporate monitoring and conditional access policies.

Calendar Invite Phishing Red Flags to Look For

No single sign proves an invite is malicious, but several together should stop a click.

For employees

• An invite from someone you do not know, or an organizer whose name does not match their email address.
• A meeting you never discussed, especially one about HR policy, payroll, benefits, compliance, or a pay raise.
• A QR code inside an invite, or a link in the location or description field.
• Urgency: a meeting starting in minutes, an account about to expire, or money owed.
• A phone number to call instead of the usual meeting link.

It is vital that employees are trained to verify the meeting through a known channel such as Teams or Slack before acting.

For security teams

• Email: minimal body text, external senders, unexpected .ics attachments, HR or IT urgency, or new sending infrastructure.
• Calendar: rich HTML, embedded images or QR codes, hidden links in event fields, organizer mismatches, or unusual custom X- fields.
• Identity: sign-ins from unfamiliar devices, unexpected MFA prompts, risky authentication events, sessions created shortly after invite delivery, or OAuth consent activity and token reuse.
• Persistence: calendar entries that remain after the email is removed.

The identity signals are the ones most likely to catch an attack that slipped past every email control.

The Identity Problem: What Attackers Actually Want

The calendar is the delivery vehicle. In the most damaging variants, the destination is an identity: a password, a session, or the access that comes with them. That is why calendar invite phishing belongs in identity security planning, not only in email security.

From a click to a stolen session: how AiTM phishing works

After a successful sign-in, a service issues a session token so the user is not asked to log in again on every page. An AiTM page sits between the victim and the real login, relays everything in real time, and keeps a copy of the token that comes back. The consequences are clear: because the stolen session is already authenticated, the attacker can access the account without the MFA code or the credentials again.

The invite is simply a trustworthy way to get the victim to that page.

Why standard MFA doesn't stop calendar invite phishing

SMS codes, authenticator-app codes, and push approvals are all things a victim can type or approve into a proxy page, and the proxy forwards them to the real service. The login succeeds, and the attacker keeps the resulting session. Phishing-resistant MFA is highly recommended, utilizing FIDO2/WebAuthn credentials such as passkeys and hardware security keys, because traditional MFA can be defeated at the session level. These credentials are bound to the legitimate site, so a lookalike domain cannot use them.

MFA is still worth having, since it stops many attacks, but it is not a defense by itself.

Blast radius: what one phished identity can reach

A stolen session is only as dangerous as the access behind it. If the account holds standing administrative rights, belongs to old groups it no longer needs, or can reach sensitive data without review, one successful phish becomes a major incident. If access is least-privilege, time-bound, and reviewed regularly, the same phish yields far less. This is the part of the problem that no email filter can fix, and it is the core of identity governance and privileged access management.

Collaboration tools as an ungoverned trust surface

Calendar invite phishing works because organizations allow external groups, guests, and shared files to reach employees through trusted Microsoft features. We recommend investigating the full chain, including who created a group, who was added, and whether calendar entries persist, and blocking external group notifications at the mail-flow level. Treat guest access, external sharing, and group creation as identity governance decisions, with owners and periodic review.

Fake "call this number" lures add one more identity risk: a victim who calls an attacker-supplied line may be walked through handing over access. Help desk verification and account-recovery procedures should assume a caller may already have been socially engineered.

How to Defend Against Calendar Phishing: A Layered Approach

No single setting closes this gap. The strongest posture pairs calendar and email hygiene with identity controls that limit the damage when a lure works.

The identity layer

• Phishing-resistant MFA. Move high-risk accounts first, such as executives, finance, IT administrators, and anyone with privileged access, to FIDO2/WebAuthn passkeys or hardware keys.
• Conditional access. Restrict or alert on sign-ins from unexpected user agents, anonymous proxies, and IP addresses with no prior history for the account. Requiring a compliant, managed device also limits what a stolen session can do.
• Session and token protection. Consider implementing session monitoring and the ability to revoke tokens and sessions quickly.
• Least privilege and PAM. Remove standing admin rights and use time-bound privileged access so that a phished account cannot reach everything.
• Access reviews. Regularly remove stale group memberships, guest accounts, and entitlements that widen the blast radius.

Email and calendar settings

These controls reduce exposure but carry trade-offs.

• Google Calendar: Set "Add invitations to my calendar" to "Only if the sender is known" or "When I respond to the invitation in email" (under Settings, General, Event settings).
• Outlook: Uncheck automatic processing of meeting requests under File, Options, Mail, Tracking. For administrators, setting AutomateProcessing to None stops .ics files from creating events, but Exchange Online has no tenant-wide toggle, so it must be applied per mailbox, and users then have to accept legitimate invites manually.
• Mail flow rules: These allow you to quarantine or delete external .ics emails, though they can block legitimate meetings, so consider allowlisting trusted domains and senders.
• Inspect .ics as active content: It is recommended to scan for URLs, base64 data, and ATTACH fields, use content disarm and reconstruction (CDR), and decode QR codes in attachments.

Detection and identity threat response

When the email filter misses the lure, the identity signals can still catch the attack: a sign-in from a new device or proxy shortly after an invite arrives, an unexpected MFA prompt, a session token reused from a different location, or unusual OAuth consent activity. Build alerts around these signals and connect them to automatic session revocation.

Calendar invite phishing incident response playbook

1. Remove both the delivery email and the calendar entry from every affected mailbox.
2. Revoke active sessions and tokens for anyone who clicked, not just those who entered a password.
3. Reset credentials and re-register authentication methods where needed.
4. Review what the account accessed and whether any new mail rules, app consents, or devices were added.
5. Check for the same invite in other mailboxes and block the sender infrastructure.

Awareness training that fits the lure

Considering training users to recognize the emotions attackers exploit, including curiosity, greed, and urgency. This is especially important for Finance, Legal, and executive users who may encounter calendar-based phishing, QR code lures, and policy-themed social engineering.

What to Do This Week: A Calendar Invite Phishing Checklist by Audience

Employees

• Change your calendar setting so invites are added only from known senders (Google) or require approval (Outlook).
• Treat unexpected invites like unexpected email: do not click links or scan QR codes.
• Verify unfamiliar meetings through Teams, Slack, or a known phone number.
• Report the email and delete the calendar event so it does not resurface.
• If you clicked or signed in, tell IT immediately and do not wait to see if anything happens.

IT and security teams

• Inventory who can sign in with phishing-resistant MFA today, and enroll privileged and high-risk users first.
• Turn on conditional access alerts for new devices, anonymous proxies, and unfamiliar IP addresses.
• Add calendar-entry removal and session revocation to your phishing response runbook.
• Enable .ics inspection and QR code decoding in your email security tool.
• Review external group, guest, and calendar-sharing settings in your collaboration platform.

Executives and risk owners

• Ask what percentage of privileged and executive accounts still rely on codes or push approvals.
• Ask how quickly the team can revoke every session for a compromised user.
• Confirm that help desk and account-recovery procedures verify identity independently of the caller.

Where an Identity Partner Fits

Calendar phishing will keep changing shape, because the delivery channel is easy to swap. The identity layer behind it is what you can strengthen once and benefit from against many attack types. An identity and access management partner can help in three ways.

Assess: How exposed are your identities and sessions?

A short assessment can show which accounts still rely on codes or push approvals, where standing privilege exists, which guests and groups have outside reach, and how fast sessions can be revoked.

Strengthen: Phishing-resistant authentication, access governance, and privileged access

This includes rolling out passkeys and hardware security keys to the highest-risk users first, tightening conditional access, enforcing least privilege, and conducting regular access reviews.

Respond: Identity-centered detection and recovery

When an attack lands, the response depends on identity data: who clicked, which sessions to revoke, what was accessed, and how to restore trust quickly.

Next steps

Our team of identity experts would be happy to offer deeper guidance on protecting your organization from calendar invite phishing attacks based on your specific technology infrastructure. Contact us today to talk to an expert.

Conclusion

Calendar invites are one more door to the same asset: the identity. Filters and settings will keep improving, but attackers will continue finding new ways to reach users. The most durable defense is to assume a lure will eventually work and limit what an attacker can access with a stolen password or session. Start with phishing-resistant authentication for your highest-risk users, then tighten the access behind every account.