Calendar Invite Phishing: The Cybersecurity Threat Hiding in Your Schedule

CYBERRISKED®

Oct 16

6 min read

You know to be suspicious of unexpected emails. But what happens when a scam shows up directly on your calendar?

For years, cybersecurity awareness training has taught employees to recognize suspicious emails, avoid unfamiliar links, and question unexpected attachments. Unfortunately, cybercriminals are finding new ways to exploit the everyday tools we trust.

One increasingly concerning technique is calendar invite phishing, often called calendar phishing, and sometimes called CalPhishing.

Instead of relying solely on a traditional phishing email, scammers send fraudulent calendar invitations that may appear alongside legitimate business meetings in Google Calendar, Microsoft Outlook, and other scheduling applications. These invitations can contain malicious links, fraudulent customer-support telephone numbers, or invitations to virtual meetings where an attacker attempts to manipulate the victim.

Calendar phishing is an important threat to understand particularly for small and midsize organizations with limited cybersecurity resources.

A Growing Cybersecurity Problem

Calendar phishing isn't entirely new, but recent cybersecurity research suggests it is becoming more widespread and sophisticated. On October 15, 2026, Check Point researchers reported identifying more than 302,000 unique phishing emails in campaigns using fraudulent calendar invitations, reaching more than 40,000 organizations within its customer environment.

Other cybersecurity researchers have identified similar campaigns involving QR codes, fraudulent billing notices, and sophisticated techniques designed to steal authenticated user sessions.

These findings illustrate an important shift: cybercriminals are expanding their social engineering efforts beyond the traditional email inbox.

How Does Calendar Invite Phishing Work?

A typical attack begins when a scammer sends an unexpected meeting invitation to a potential victim. The invitation might appear to come from a familiar company, service provider, colleague, or technology platform.

It may carry a subject such as:

"Urgent: Your Microsoft 365 Account Requires Verification"
"Payment Confirmation — $499 Subscription Renewal"
"Security Alert: Unusual Account Activity"
"Mandatory Employee Compliance Meeting"
"Missed Voicemail — Please Review"

These examples illustrate common scam themes rather than a single specific campaign. Depending on the calendar application and its configuration, the invitation may be automatically added to the recipient's calendar even before the recipient has accepted it. Interestingly, an unexpected email might immediately trigger suspicion. But a meeting already appearing on someone's calendar may seem more legitimate, particularly when accompanied by reminders and meeting notifications.

The attacker is exploiting that misplaced trust.

Four Common Calendar Phishing Techniques

Malicious Meeting Links

The invitation contains what appears to be a legitimate Microsoft Teams, Zoom, or Google Meet meeting link. However, the link may lead to a fraudulent website impersonating a familiar sign-in page. The victim may be asked to enter an email address, password, or other authentication information. If successful, the attacker could gain unauthorized access to the victim's account.

Fraudulent Billing and Customer-Support Calls

Not every phishing attack requires clicking a malicious link.

Consider an unexpected calendar appointment titled:

"Your $499 Annual Subscription Renewal Is Confirmed."

The invitation claims that the recipient has been charged for a service and includes a telephone number to dispute the transaction. A concerned employee calls the number. Instead of reaching customer support, the employee connects directly with a scammer posing as a billing or technical-support representative. The caller might be persuaded to disclose financial information, provide account credentials, or install remote-access software.

Cybersecurity researchers refer to this technique as callback phishing, sometimes called Telephone-Oriented Attack Delivery (TOAD). The important difference is that the attacker convinces the victim to initiate the telephone conversation.

QR Codes Embedded in Invitations

Some malicious calendar invitations contain QR codes that supposedly direct users to meeting information, security notices, or required documents. When scanned, the QR code may lead to a fraudulent login page.

In June 2026, Mimecast researchers documented campaigns that embedded malicious QR codes within specially crafted calendar attachments. Some attachments were deliberately malformed to interfere with automated security analysis. Because users often scan QR codes with mobile phones, the resulting interaction may occur outside the organization's usual email and endpoint security protections.

Live Meetings and Account Takeover

A particularly troubling variation involves invitations that lead to actual interactions with attackers.

For example, a fraudulent meeting may involve someone impersonating an IT support technician, company representative, or trusted vendor. During the conversation, the attacker might ask the employee to approve an authentication request, share sensitive information, or install software.

Other attacks use sophisticated fake authentication workflows to intercept sign-in sessions.

In October 2026, Material Security documented a campaign using Google Calendar invitations and live authentication proxies to steal Google account sessions, demonstrating that conventional multifactor authentication methods can sometimes be defeated.

Importantly, not every suspicious meeting invitation involves such advanced techniques. But the research shows how far calendar-based attacks can extend beyond ordinary spam.

Why Are These Attacks So Effective?

Calendar phishing exploits several aspects of normal workplace behavior.

Calendars are generally treated as trusted organizational tools. Employees regularly accept meeting invitations, attend virtual meetings, and respond to appointment reminders.
Some calendar applications automatically display invitations. Depending on user and administrator settings, an event can appear without the recipient explicitly approving it.
The invitation may originate from a legitimate service or compromised account. Seeing familiar platform branding or recognizing a sender does not guarantee that the underlying request is safe.
Attackers create urgency. A supposed fraudulent charge, expiring account, missed voicemail, or mandatory meeting encourages the recipient to act quickly.
Some malicious events can remain visible on a calendar even after their original notification email is removed.

In other words, attackers are exploiting both technology and human behavior.

Seven Ways to Protect Yourself and Your Business

Fortunately, organizations can take practical steps to reduce their exposure.

Treat unexpected calendar invitations like suspicious emails.

If you don't recognize the organizer or weren't expecting the meeting, verify its legitimacy before taking action.

Never assume a calendar entry is legitimate simply because it appears on your schedule.

A calendar application displaying an event is not proof that the organizer has been authenticated or that the content is trustworthy.

Verify meeting links before opening them.

Inspect the actual destination where possible. If you receive an unexpected invitation supposedly from a colleague or vendor, contact that person using a previously established communication channel. Remember that even a link using a legitimate service's domain may redirect elsewhere.

Never call an unfamiliar telephone number supplied in an unexpected calendar invitation.

If the event claims to involve a bank, software provider, subscription, or financial transaction, obtain the organization's contact information independently.

Review your calendar's invitation settings.

Google Calendar allows users to restrict automatically added invitations to known senders or require an email response before an invitation is added.

Microsoft 365 administrators should review their organization's handling of external invitations, meeting requests, and calendar-related threats.

Use phishing-resistant authentication wherever practical.

Passkeys and FIDO2 security keys can provide stronger protection against certain credential-phishing and authentication-relay attacks than passwords combined with SMS codes or conventional push notifications.

Multifactor authentication remains important, but not all methods provide equal protection.

Include calendar phishing in employee cybersecurity awareness training.

Businesses should expand phishing awareness beyond suspicious emails to include unexpected meeting invitations, QR codes, fraudulent telephone support, and social engineering within collaboration tools.

Employees should also know how to report suspicious calendar events to their IT administrator or security contact.

What Should You Do If You Receive a Suspicious Calendar Invitation?

If an unexpected invitation appears on your calendar:

DO NOT click any links, scan QR codes, or call telephone numbers provided in the invitation.
Verify the invitation independently if it appears to involve someone you know.
Report it as spam or phishing using the available calendar or email controls.
Remove the suspicious event without unnecessarily engaging the organizer.
Notify your IT administrator if the invitation was received through a business account.

If you already entered credentials, approved an unexpected authentication request, installed software, or disclosed financial information, report the incident immediately. Depending on what occurred, corrective actions may include changing compromised passwords, revoking active sessions, reviewing account activity, or removing unauthorized software.

The Bottom Line

Calendar invite phishing demonstrates how cybercriminals continually adapt to the technology we use every day. An invitation can appear professional, arrive through a familiar scheduling platform, and contain legitimate-looking meeting details while still being malicious. For small and midsize orgs, the most important defense begins with cybersecurity awareness. Employees should be trained to question unexpected invitations just as they would question suspicious emails.

Remember: Just because an appointment is on your calendar doesn't mean it belongs there.