Fake calendar invites hit thousands of businesses in Microsoft credential phishing campaign

Date:
Fri, 16 Oct 2026 15:00:00 +0000

Description:
Hundreds of thousands of spam emails are carrying .ics attachments or
calendar invites.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Phishing campaigns are abusing calendar invites and meeting requests to steal Microsoft 365 credentials Attackers hide malicious links in .ics files, fake meeting details, QR codes, and invite pages Researchers observed hundreds of thousands of phishing
emails targeting over 40,000 organizations If you get a calendar invite in your inbox be wary - it might be a carefully created phishing lure, designed to have you hand over Microsoft 365 or other login credentials.

Security firm Check Point Research (CPR) recently sounded the alarm for several large-scale phishing campaigns, abusing the fact that businesspeople routinely share calendar invites, and all designed to harvest their victims credentials. Different approach, same result CPR says it identified two separate approaches. In some cases, the threat actors would share calendar invites as .ics attachments. These pass email filters (since the file type itself is harmless) and land directly into peoples inboxes. In other cases, the invites would come as links (which end up redirecting the victim away
from their calendar and right into a trap). Latest Videos From TechRadar
Watch full video here:

The former is arguably more dangerous: the attachment is disguised as a meeting request or a payment notification, and when the recipient opens or accepts the invitation, it ends up in their calendar. Sometimes, depending on each users settings, the calendar entry may be processed automatically, too. In both cases, the fraudulent content now looks like an ordinary work appointment or service notification.

So far, none of these things are malicious, or dangerous, on their own. There is no vulnerability exploited, or malware deployed, here. However, the event description, location field, or embedded QR code, may direct the victim to a fake Microsoft 365 sign-in page, or a fraudulent payment portal. The victim, not realizing the landing pages were spoofed, may end up sharing their login credentials or payment information with the attackers. You may like Keep seeing strange meetings and events in your calendar? It might be because calendar-based phishing has jumped 33,000% since May and they work even if the email is sent to spam Almost 8000 organizations hit by fake voicemail transcript emails in credential phishing attack 'It is significant, and its something many organisations haven't accounted for': The phishing threats hiding in your calendar invites

The latter approach is easier to set up, but arguably harder to pull off. A link placed directly in the email, even if it looks benign on the surface, might get flagged by email security services and filtered out into spam. If
it passes, though, victims will have a rather difficult time spotting the ruse.

In one of the examples shared by CPR, a victim received a fake Microsoft
Teams meeting invite, and simply hovering over the join link revealed its
real destination - a credential-harvesting page at a third-party website. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro
newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. Large campaigns The campaigns are quite
large, CPR stressed, and growing. Hundreds of thousands of these emails get sent every month, from countless compromised email addresses:

Check Point Email researchers are tracking these campaigns and have seen a significant surge starting September 25, 2026, the report reads.

A new detection layer specifically designed to identify this type of attack has flagged more than 302,386 unique phishing emails among our customers emails, sent to more than 40,000 organizations. What to read next Microsoft 365 users hit by two major threat campaigns - fake IT calls and phishing emails target users across the world Microsoft login pages are being abused
as hackers try and lure in unlucky victims Microsoft 365 users hit by
phishing scheme posing as RingCentral emails

The campaigns average more than 8,300 emails per active day, CPR said, adding that the messages came from more than 33,890 different sender domains and
more than 247,270 unique sender addresses.

Activity is not fading, it is accelerating. Daily volume grew from a few thousand emails a month in April to more than 118,000 in September, and to more than 740,000 in just the first two weeks of October. The busiest single day so far was October 8, with almost 200,000 emails, the researchers concluded.

Phishing is one of the oldest and most used attack vectors out there, and for good reason. Besides being omnipresent, it is the cheapest and most effective way to compromise a target network.

That being said, defending against it usually revolves around common sense. Employees should be made aware that unsolicited emails carry real risk of cyberattacks, and that any email or instant message asking the recipient to urgently download a file, or log into a service, is most likely an attempted attack. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/fake-calendar-invites-hit-thousands-of- businesses-in-microsoft-credential-phishing-campaign


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)