Loading story…
Attackers are abusing Outlook calendar invites in an active CalPhishing campaign to hijack Microsoft 365 accounts by delivering malicious .ics files that automatically place tentative meetings on victims’ calendars. Researchers at Fortra Intelligence and Research Experts (FIRE) said the invites impersonate urgent administrative notices such as Microsoft 365 domain renewal warnings and digital-signature invoice requests, with manipulated SUMMARY, LOCATION, and DESCRIPTION fields directing users to fake Microsoft 365, GoDaddy, or DocuSign pages. Because the calendar entry can remain visible even if the original email is deleted or sent to junk, the lure continues to generate trusted reminders and increases the chance of user interaction.
The campaign uses HTML landing pages and redirect chains through Cloudflare to reduce detection, and researchers believe the operators are likely using the EvilTokens phishing kit sold on Telegram to automate the attacks. FIRE warned that the activity appears to incorporate ConsentFix-style device code phishing to steal session tokens rather than just passwords, allowing attackers to bypass MFA and maintain access to compromised accounts. The combination of trusted calendar workflows, persistent invites, and likely AI-assisted automation makes the technique a significant threat to enterprise account security and data privacy.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of the research, FIRE disclosed technical details of the CalPhishing technique, warning that calendar entries can persist even if the original email is deleted or sent to junk. The researchers also assessed that the attackers were likely using the EvilTokens phishing kit sold on Telegram to automate the campaign.
In the campaign, attackers modified iCalendar fields to impersonate urgent notices such as Microsoft 365 domain renewal alerts and invoice or signature requests, directing victims to fake GoDaddy, Microsoft 365, or DocuSign pages. Researchers said the operation used HTML lures, Cloudflare redirect chains, and ConsentFix-style device code phishing to steal session tokens and bypass MFA.
Fortra Intelligence and Research Experts (FIRE) reported that an active phishing campaign abusing Outlook calendar invites has been underway since early 2026. The operation targets Microsoft 365 users by sending emails with malicious .ics files that create tentative meetings directly on victims’ calendars.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcesublime.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing legitimate Microsoft 365 collaboration features to deliver phishing lures that look like routine internal activity, according to Fortra researchers. The campaign uses attacker-controlled or compromised Microsoft 365 Groups to add victims into spaces named like **IT Support**, **HR Updates**, or **All Company**, then pushes follow-on lures through group mailboxes, shared files, welcome messages, and calendar invitations. Messages are framed around urgent business themes such as payroll, contracts, supplier requests, and mandatory training to blend into normal workplace workflows and lower suspicion. A key tactic is **CalPhishing**, in which malicious `.ics` calendar events are used to place phishing items directly on a victim’s calendar and generate repeated reminders over time. Researchers said the repeated exposure across email, groups, files, and calendar surfaces can make the lure appear to be a legitimate unfinished task, while the end goals include credential theft, token capture, malware delivery, data exposure, and further social engineering. Because the activity is distributed across trusted Microsoft infrastructure, investigations are more complex; defenders were advised to review the full chain of group creation, membership changes, shared content, and lingering calendar entries, and to consider blocking the sender domain `groups.outlook.com` where appropriate.
Jun 29, 2026
The FBI has warned that **Kali365**, a phishing-as-a-service platform sold primarily through Telegram, is targeting Microsoft 365 users by abusing Microsoft's legitimate **device code authentication** flow to steal OAuth access and refresh tokens. First observed in April 2026, the service gives low-skill criminals AI-generated phishing lures, automated campaign templates, token-capture features, and victim tracking dashboards. Victims are lured with emails impersonating SharePoint, OneDrive, Microsoft 365 voicemail, DocuSign, Adobe Acrobat Sign, and other trusted cloud or document-sharing services, then sent to a real Microsoft verification page where they enter an attacker-supplied device code. Once the code is entered, the attacker can hijack the session and gain persistent access to **Outlook, Teams, and OneDrive** without needing the victim's password or additional MFA prompts, enabling data theft and business email compromise. The FBI alert, tracked as `I-052126-PSA`, urges organizations to restrict or block device code flows where possible, audit legitimate dependencies on that authentication method, enforce conditional access policies, monitor unusual sign-ins and token use, preserve emergency access accounts, block authentication transfer policies, and report incidents to **IC3** while retaining phishing emails, login records, and evidence of unauthorized devices or sessions.
Jul 12, 2026
Threat actors are abusing the familiarity of **digital invitation and meeting platforms** to increase phishing success rates. Cofense reported malicious *Punchbowl/Paperless Post*-themed invitations that prompt recipients to “log in to view event details,” then redirect to phishing infrastructure offering branded sign-in options (e.g., **Microsoft, Yahoo, AOL, Google, Dropbox**) to harvest credentials. The phishing flow may solicit multiple credential sets by returning fake login errors and urging users to try alternate accounts; submitted credentials are exfiltrated to attacker-controlled domains, often leveraging newly registered domains to evade reputation-based defenses. Separately, Netskope research (reported by KnowBe4) described **fake video meeting invites** for *Zoom, Microsoft Teams, Google Meet,* and similar services that lead to spoofed “join meeting” pages showing purported coworkers already on the call. Victims are instructed to install a required “update” to join; the payload is a **digitally signed remote monitoring and management (RMM) tool** such as *Datto RMM, LogMeIn,* or *ScreenConnect*, enabling remote access and potential follow-on activity including data theft or deployment of additional malware. The use of legitimate, signed RMM software can blend into normal enterprise traffic and may bypass controls where such tools are pre-approved.
Jun 29, 2026