In a nutshell: Tips for staying vigilant against phishing scams delivered via text messages, phone calls, and emails are likely common knowledge by now, but fraudsters are always looking for new attack vectors. Calendar invitations appear to be the latest tool of choice, exploiting widely used, trusted software that may not receive the same level of scrutiny from antivirus tools. As always, users should be wary of suspicious messages from unknown senders, regardless of the medium.
Security researchers at Sublime are warning users about a new phishing tactic targeting work calendars. Reports of these attacks have surged in recent months because the technique is inexpensive and more likely to reach end users.
As the company explained to The Guardian, a typical calendar phishing scam, also known as an ICS phishing attack, begins when a user notices an unfamiliar meeting invitation or a notification about a financial issue on their calendar. Like other phishing attempts, the invitation might contain a payment invoice or a QR code.
Assuming they have simply forgotten about the event, the target clicks a link in the calendar invitation and is redirected to a fraudulent website that may request login credentials or deliver malware. These scam pages and downloads frequently imitate popular services from Microsoft, Google, PayPal, and other well-known companies.
Attackers send these messages to users' email inboxes and calendars simultaneously to increase the chances of attracting their attention. Even if an email client's spam filter catches the malicious message, the calendar invitation may still get through because calendar services such as Google Calendar and Microsoft 365 handle invitations differently, particularly when configured to automatically add events from emails.
Sublime reports that ICS phishing incidents increased by approximately 33,000% between May and September, suggesting that the tactic is gaining traction. Attacks doubled or tripled each month from May to June, before increasing by more than 1,000% per month in the following months.
Beyond the perceived trustworthiness of Google's and Microsoft's calendar services, ICS phishing is attractive to attackers because it is inexpensive to carry out and can exploit gaps in how calendar invitations are handled.
Users should be wary of messages that invoke financial concerns or use urgent language, especially when they come from unknown senders. Security experts also advise against responding to suspicious invitations, even to decline them, because doing so may signal to scammers that the account is active. Instead, users should delete the invitations and report them as spam. If an invitation from a known contact looks suspicious, they should verify its authenticity through a separate communication channel.