Fake calendar invites hit thousands of businesses in Microsoft credential phishing campaign

Phishing campaigns are abusing calendar invites and meeting requests to steal Microsoft 365 credentials Attackers hide malicious links in .ics files, fake meeting details, QR codes, and invite pages Researchers observed hundreds of thousands of phishing emails targeting over 40,000 organizations If you get a calendar invite in your inbox be wary - it might be a carefully created phishing lure, designed to have you hand over Microsoft 365 or other login credentials.

Security firm Check Point Research (CPR) recently sounded the alarm for “several large-scale phishing campaigns,” abusing the fact that businesspeople routinely share calendar invites, and all designed to harvest their victim’s credentials.

Different approach, same result CPR says it identified two separate approaches.

In some cases, the threat actors would share calendar invites as .ics attachments.

These pass email filters (since the file type itself is harmless) and land directly into people’s inboxes.

In other cases, the invites would come as links (which end up redirecting the victim away from their calendar and right into a trap).

The former is arguably more dangerous: the attachment is disguised as a meeting request or a payment notification, and when the recipient opens or accepts the invitation, it ends up in their calendar.

Sometimes, depending on each user’s settings, the calendar entry may be processed automatically, too.

In both cases, the fraudulent content now looks like an ordinary work appointment or service notification.

So far, none of these things are malicious, or dangerous, on their own.

There is no vulnerability exploited, or malware deployed, here.

However, the event description, location field, or embedded QR code, may direct the victim to a fake Microsoft 365 sign-in page, or a fraudulent payment portal.

The victim, not realizing the landing pages were spoofed, may end up sharing their login credentials or payment information with the attackers.

The latter approach is easier to set up, but arguably harder to pull off.