Calendar Invite Phishing: Protect Outlook and Google Calendar

By Lukas Becker, Sr. Service Desk Analyst, Outsource IT

That unexpected calendar invite might not be a meeting. It might be a credential-harvesting trap.

Security teams have recently seen a sharp rise in fake meeting invitations designed to put a malicious link directly on someone's schedule. They are effective because people tend to trust calendar entries far more than ordinary email.

The short answer

Calendar invite phishing uses fake meeting requests, often carrying .ics calendar files, fake Microsoft Teams links or urgent business topics, to send people to sign-in pages that steal passwords. The safest response is simple: do not interact with an unexpected invite, confirm it through a known contact method and report it using your organization's approved process.

How big is the calendar phishing spike?

• Check Point reported a campaign surge beginning on September 25, 2026. Its detection system flagged 302,386 unique phishing emails sent to more than 40,000 organizations, from more than 33,890 sender domains and over 247,270 sender addresses.
• Those are Check Point's detections among its own customers, not a count of every attack worldwide.
• Sublime Security observed a 1,216% month-over-month increase in malicious calendar file activity in August 2026. It also reported that the first half of September exceeded all of August by 1,426%.
• Sublime's estimate of roughly 33,000% growth from May to September was a projection, not a measured full-period total.

Some October coverage cited even larger counts. The verified numbers above already show the main point: attackers are using calendars at scale.

Why calendar invite phishing works

A calendar invitation looks routine. It may mention benefits enrolment, an invoice dispute, a subscription charge or a missed meeting. It can include a believable Teams button or attachment. No software vulnerability is required; the attack relies on default settings, busy schedules and normal habits.

Calendar behaviour depends on the product, account type and the settings chosen by your IT administrator. Sometimes an event can appear on the calendar before anyone deliberately accepts it, creating a second place where a malicious link can be clicked.

What should you do with an unexpected invite?

1. Do not click links, open attachments, scan QR codes or enter your password.
2. Check the sender carefully. A familiar name can still come from a lookalike or compromised account.
3. Contact the supposed organizer through a phone number, chat or email address you already know.
4. Report the invite using the Outlook, Gmail or Google Calendar option approved by your organization.
5. If you entered a password, report it immediately so the account can be secured.

Google Calendar: reduce unwanted invitations

Go to Settings → Event settings → Add invitations to my calendar. Choose Only if the sender is known, or the stricter option to add events only after you respond in email. Google notes that these settings apply to new invitations and that workplace administrators may restrict them. Suspicious events can be reported as spam in Google Calendar.

Microsoft Outlook and Microsoft 365: what to check

Outlook's options vary between new Outlook, classic Outlook, web, mobile and administrator-managed Microsoft 365 policies. There is no single universal switch that solves this for every user. Microsoft's Automatically process meeting requests setting mainly concerns responses and polls, so do not rely on it alone.

Your IT team should review Microsoft 365 email filtering, calendar processing and user-reporting tools. Staff training and multi-factor authentication matter because a fake invite can still reach someone.

Frequently asked questions

What is calendar invite phishing?

It is a phishing attack disguised as a meeting invitation. The goal is usually to get the recipient to open a fake link, download a file or enter Microsoft 365 or Google Workspace credentials.

Can a fake calendar invite appear without accepting it?

It can in some products and configurations. Invitation handling depends on the calendar service, account settings and administrator policies.

Should I decline a suspicious meeting invite?

Avoid interacting with it until it has been verified. Use your organization's reporting process rather than replying to the sender.

Does multi-factor authentication stop calendar phishing?

It greatly reduces the impact of a stolen password, but it does not stop every attack. Combine it with careful settings, filtering, phishing-resistant sign-in where possible and quick reporting.

Action for this week

Check your calendar settings today and share this guidance with your team. One small change, plus the habit of verifying unexpected meetings, can close a gap attackers are actively exploiting.

Outsource IT helps Canadian organizations configure Microsoft 365 security, train staff and respond to suspicious activity. Explore our Microsoft 365 services, cybersecurity protection and employee security training, or contact our team.

Sources

• Original post by Lukas Becker on LinkedIn
• Check Point: fake calendar invite campaign
• Sublime Security: calendar-based phishing activity
• Google: manage calendar invitations
• Google: report calendar spam
• Microsoft: meeting response processing