Calendar phishing is a social engineering attack that uses a fake meeting invitation to deliver a malicious link, attachment or phone number. Because the invite can land directly on the calendar, the lure stays visible even when the email is deleted or quarantined.
The technique is growing fast. In October 2026, Check Point reported a campaign of more than 302,000 unique phishing emails sent to over 40,000 organizations, using fake invites to steal Microsoft account credentials.
Key takeaways
- A calendar phishing invite does not need a reply to work: auto-add features can place it on the calendar.
- Quarantining the email does not always remove the calendar event, which gives the lure a second chance.
- Common lures are fake Microsoft Teams meetings, payment or renewal alerts, and phone numbers to call.
- Calendar settings, remediation that covers calendar items and trained employees close most of the gap.
How does a calendar phishing attack work?
A calendar phishing attack abuses the normal way meeting requests travel. The attacker sends an invitation by email, the calendar service adds it as an event, and the event text pushes the recipient toward a link, a file or a phone call. No software flaw is involved: the attack relies on calendar features and on the trust people give to meetings.
Calendar invites are also one of the delivery paths for ClickFix attacks, where a fake meeting page asks the victim to run a "fix" on their own computer.
What do calendar phishing lures look like?
Most calendar phishing lures imitate routine work: a Teams meeting, an invoice review, an expiring account. The table below lists the variants documented by security researchers in 2025 and 2026.
| Lure | What the recipient sees | What the attacker wants | Reported by |
|---|---|---|---|
| Fake Microsoft Teams meeting | A routine invite with a "Join" link | Microsoft account credentials | Check Point, October 2026 |
| Dial-in instructions | An invite that says to skip the conference link and call a number instead | A phone conversation to extract information or payment | Sublime Security, November 2025 |
| QR code in a PDF | A financial invite with no body text and a PDF copied into the event | Credentials, captured on the recipient's phone | Sublime Security, November 2025 |
| Urgent domain expiry | A week-long event with invitees such as "IT Support Desk" and an HTML attachment | A login on a fake Microsoft and GoDaddy page | Sublime Security, November 2025 |
| Financial lure from a Gmail account | A Google Calendar invite linking to a page built on Framer | Installation of ScreenConnect, a legitimate remote management tool, as a backdoor | Help Net Security, October 2026 |
| Renewal or payment alert | An event claiming a large payment is about to leave the account | A call to fake customer service to obtain a password or a transfer | thinkmoney, October 2026 |
The dial-in variant turns calendar phishing into callback vishing, where the written lure only exists to start a phone call. The QR code variant moves the attack to a personal phone, the same shift that makes QR code phishing hard to monitor.
Why do email filters miss calendar phishing?
Email filters miss calendar phishing because a meeting invite reaches two places: the inbox and the calendar. An email security product can quarantine the message while the event stays on the calendar. "Meeting invitations are sent to both calendars and inboxes. This means twice the exposure for targets," says Mark Morris, Threat Detection Engineer at Sublime, quoted by Help Net Security in October 2026.
Three other factors make detection harder:
- Borrowed legitimacy. Google rewrites links in invites so they route through google.com, which makes them look safer, as Help Net Security reported. Earlier campaigns went further and spoofed Google Calendar notifications on behalf of trusted contacts, a form of email spoofing that reached around 300 brands in four weeks, according to Cybersecurity News in December 2024.
- Disposable infrastructure. In a single campaign, Check Point counted more than 33,890 sender domains and 247,270 sender addresses, which limits the value of blocklists.
- Partial remediation. Microsoft Defender for Office 365 now removes the associated calendar entry when analysts hard delete a meeting invite email, Help Net Security reported in November 2025. Events added through .ics files are not covered, and entries can come back if the sender resends the invite.
How fast is calendar phishing growing?
Vendor telemetry shows calendar phishing growing by orders of magnitude in 2026. Both figures below come from each vendor's own customer base, and neither vendor published its full methodology.
| Source | What was observed |
|---|---|
| Check Point (October 2026) | A few thousand malicious invite emails a month in April, more than 118,000 in September and more than 740,000 in the first two weeks of October, according to Check Point. The busiest day, October 8, saw almost 200,000. |
| Sublime Security (via Help Net Security, October 2026) | A 1,216% month-over-month increase in August 2026, as reported by Help Net Security. The first half of September alone exceeded all of August by 1,426%. |
How can organizations protect against calendar phishing?
Protection against calendar phishing combines three layers: limiting which invites reach the calendar, making sure remediation removes calendar events and not only emails, and training employees to treat an unexpected invite like any other suspicious message.
For security teams
- Restrict auto-add in Google Workspace. In the Admin console (Apps, Google Workspace, Calendar, Advanced settings), set "Add invitations to my calendar" to invitations from known senders, or to invitations users have responded to by email, as Sublime Security recommends.
- Extend remediation to the calendar. In Microsoft Defender for Office 365, use hard delete on malicious invite emails so the linked calendar entry goes too, then check separately for events added from .ics files.
- Block whole domains. Defender's Tenant Allow/Block List can block an entire phishing domain instead of individual URLs, Help Net Security notes.
- Hunt for the red flags. Look for unexpected invites from first-time senders using free email accounts, financially urgent business invites and links to free website builders, the signals listed by Help Net Security.
- Train employees on the format. Include meeting invites and callback numbers in awareness training, so people recognize the lure wherever it appears.
For employees
- Do not click links, scan QR codes or call phone numbers in an invite you were not expecting.
- Check the organizer, then confirm the meeting with that person through a separate channel.
- Treat any invite that asks for a sign-in, a download or a payment as suspicious.
- Report the invite to your security team instead of only deleting it, the same way you would report a fraudulent email.
- On a personal Google account, open Settings, then General, then Event settings, and set "Add invitations to my calendar" to "Only if the sender is known", as thinkmoney advises.
Calendar phishing works because a meeting feels like routine work. Arsen's phishing simulations train employees to spot and report lures that borrow trusted formats, and its vishing simulations prepare them for the moment an invite asks them to call a number.