In short: Tips for staying vigilant against phishing scams delivered via text messages, phone calls, and emails are probably well known by now, but scammers are always looking for new methods of attack. Calendar invites appear to be the latest tool of choice as they exploit widely used, trusted software that may not be checked to the same extent by antivirus tools. As always, users should be wary of suspicious messages from unknown senders, regardless of medium.
Security researchers at Sublime are warning users about a new phishing tactic targeting work calendars. Reports of these attacks have increased significantly in recent months because the technique is inexpensive and more likely to reach end users.
As the company explained to The Guardian, a typical calendar phishing scam, also known as an ICS phishing attack, begins when a user notices an unknown meeting invitation or a financial issue notification on their calendar. As with other phishing attempts, the invitation may contain a payment invoice or a QR code.
Assuming they have simply forgotten about the event, the target clicks a link in the calendar invitation and is redirected to a fraudulent website that may request login credentials or deliver malware. These scam sites and downloads often imitate popular services from Microsoft, Google, PayPal and other well-known companies.
Attackers send these messages to users’ email inboxes and calendars simultaneously to increase the chance of getting their attention. Even if an email client’s spam filter catches the malicious message, the calendar invitation may still get through because calendar services like Google Calendar and Microsoft 365 treat invitations differently, especially when they are configured to automatically add events from email.
Sublime reports that ICS phishing incidents increased by approximately 33,000% between May and September, indicating that the tactic is gaining traction. From May to June, attacks doubled or tripled each month before increasing by more than 1,000% per month in the following months.
Beyond the perceived trustworthiness of Google and Microsoft’s calendar services, ICS phishing is attractive to attackers because it is inexpensive to perform and can exploit loopholes in how calendar invitations are handled.
Users should be wary of messages that raise financial concerns or use urgent language, especially if they come from unknown senders. Security experts also advise against responding to or even declining suspicious invitations, as this could signal to fraudsters that the account is active. Instead, users should delete the invitations and report them as spam. If an invitation from a known contact appears suspicious, they should verify its authenticity via a separate communication channel.
