Loading story…
Calendar-invitation phishing, or ICS phishing, is surging by abusing .ics invitations and the automatic calendar-processing behavior of Gmail, Outlook, and Apple Mail. Sublime Security reported month-over-month growth of 282% in June, 338% in July, and 1,216% in August, projecting a 2,852% increase for September. Malicious events can appear on a recipient’s calendar before they accept or decline the invitation, lending fraudulent messages credibility through trusted Google and Microsoft infrastructure.
In one observed campaign, attackers sent a Google Calendar invitation posing as a credit for a recent invoice. The lure directed targets to a Framer-hosted site that delivered a malicious MSI installer configured to misuse the legitimate ScreenConnect remote-access tool for command-and-control. Organizations should disable automatic addition of invitations from unknown senders and instruct users not to open links, scan QR codes, RSVP, or decline unsolicited calendar events; suspicious invitations should be reported and deleted.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A campaign sent a Gmail-originated Google Calendar invitation using a purported invoice-credit lure. Its link led to a Framer-hosted page that delivered a malicious MSI configured to abuse the legitimate ScreenConnect remote-access tool for command-and-control.
Sublime Security reported that calendar-based malware attacks increased 1,216% in August compared with July.
Sublime Security reported a 338% month-over-month increase in calendar-based malware attacks in July.
Sublime Security reported that calendar-based malware attacks using ICS phishing increased 282% in June compared with the preceding month.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing Outlook calendar invites in an active **CalPhishing** campaign to hijack Microsoft 365 accounts by delivering malicious `.ics` files that automatically place tentative meetings on victims’ calendars. Researchers at Fortra Intelligence and Research Experts (FIRE) said the invites impersonate urgent administrative notices such as Microsoft 365 domain renewal warnings and digital-signature invoice requests, with manipulated `SUMMARY`, `LOCATION`, and `DESCRIPTION` fields directing users to fake Microsoft 365, GoDaddy, or DocuSign pages. Because the calendar entry can remain visible even if the original email is deleted or sent to junk, the lure continues to generate trusted reminders and increases the chance of user interaction. The campaign uses HTML landing pages and redirect chains through **Cloudflare** to reduce detection, and researchers believe the operators are likely using the **EvilTokens** phishing kit sold on Telegram to automate the attacks. FIRE warned that the activity appears to incorporate **ConsentFix**-style device code phishing to steal session tokens rather than just passwords, allowing attackers to bypass **MFA** and maintain access to compromised accounts. The combination of trusted calendar workflows, persistent invites, and likely AI-assisted automation makes the technique a significant threat to enterprise account security and data privacy.
Jun 29, 2026
Attackers are abusing legitimate Microsoft 365 collaboration features to deliver phishing lures that look like routine internal activity, according to Fortra researchers. The campaign uses attacker-controlled or compromised Microsoft 365 Groups to add victims into spaces named like **IT Support**, **HR Updates**, or **All Company**, then pushes follow-on lures through group mailboxes, shared files, welcome messages, and calendar invitations. Messages are framed around urgent business themes such as payroll, contracts, supplier requests, and mandatory training to blend into normal workplace workflows and lower suspicion. A key tactic is **CalPhishing**, in which malicious `.ics` calendar events are used to place phishing items directly on a victim’s calendar and generate repeated reminders over time. Researchers said the repeated exposure across email, groups, files, and calendar surfaces can make the lure appear to be a legitimate unfinished task, while the end goals include credential theft, token capture, malware delivery, data exposure, and further social engineering. Because the activity is distributed across trusted Microsoft infrastructure, investigations are more complex; defenders were advised to review the full chain of group creation, membership changes, shared content, and lingering calendar entries, and to consider blocking the sender domain `groups.outlook.com` where appropriate.
Jun 29, 2026
A widespread phishing campaign is abusing trusted Google services—including Google Meet, Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics—as redirect intermediaries that bypass email gateways, firewalls, URL scanners, and sandboxing tools. Workplace-themed lures such as document-review requests, delivery notices, payment demands, voicemails, and mailbox-expiration alerts target manufacturing, government, finance, and non-profit employees before sending them to attacker-controlled Microsoft- or OneDrive-branded credential-harvesting pages. The phishing kit extracts a victim email address from a URL fragment, validates the organization through Google Public DNS MX-record lookups, and dynamically retrieves company logos and website screenshots to tailor the lure. It screens visitors to impede analysis, sends stolen credentials and technical details to a Telegram bot, and may request passwords twice to improve capture reliability. A parallel identity-verification flow installs **ScreenConnect** for persistent remote access; organizations should reset potentially exposed credentials, investigate unauthorized ScreenConnect deployments, monitor for Telegram Bot API traffic, block malicious infrastructure, and report redirect chains to Google Safe Browsing.
Sep 7, 2026