Cybersecurity researchers are reporting a significant increase in calendar-based phishing attacks, which leverage the automatic event-adding features of popular calendar applications. Luke Wescott, a threat detection engineer at Sublime Security, noted "exponential growth" in this scam type. These attacks bypass traditional email filters by appearing directly in a user's digital calendar, often without the user needing to open an email or accept an invitation.
The scam typically involves an event appearing in the victim's calendar with a misleading title, such as a forgotten meeting, a voicemail notification, or a service renewal reminder. The event description then includes a link to a fraudulent login page or a phone number to a scammer. If a user clicks the link and enters their credentials, they hand over their login information to fraudsters. Alternatively, calling the provided phone number can lead to scammers attempting to acquire credit card details, bank information, or remote access to the victim's computer.
Google Calendar's default setting, which automatically adds event invitations to a user's schedule even from unknown senders, is a key vulnerability exploited by these attacks. This allows malicious invites to appear on a calendar without any user interaction, such as opening an email or clicking "accept." Microsoft Outlook users are also affected, as Outlook's processing of .ics calendar files can similarly auto-add events, even if the initial email is filtered as spam. Some attacks have been observed to use .ics files that bypass email security tools, with the calendar entry persisting even if the email is deleted.
Scammers frequently impersonate well-known services like Google, Microsoft, and PayPal. Examples of fake calendar event titles include "New voicemail received," "Payment receipt confirmation," "PayPal unusual activity" warnings, or invitations to bid on contracts. In some instances, fake renewal notices for software like Malwarebytes, with large, invented charges, are used to prompt urgent action from victims. These tactics aim to create a sense of urgency, compelling users to react quickly without critical evaluation.
To mitigate the risk, security experts advise users to exercise caution with unexpected calendar entries. It is recommended to treat unexpected calendar invites with the same suspicion as unsolicited emails. Users should avoid clicking links or calling phone numbers embedded in suspicious calendar events. Instead of simply deleting a suspicious event, users should report it as spam, which helps improve the systems that flag such senders.
Both Google and Microsoft offer settings to adjust how calendar invitations are handled. For Google Calendar, users can change the "Add invitations to my calendar" setting from "From everyone" to "Only if the sender is known" or "Only when I respond to the invitation in email." For Microsoft Outlook on Windows, users can uncheck "Automatically process meeting requests and responses to meeting requests and polls" under Mail options. These adjustments can limit the automatic addition of unsolicited events to a user's calendar.