Calendar phishing scam grows exponentially, researchers warn

In a typical case described by The Guardian, a person preparing for the week opens Google Calendar and sees an entry for a meeting they believe they forgot. Clicking the entry produces a note about reviewing a project and a link for more details. The link takes the user to a website that requests login details, which the user provides. The entry was not a memory lapse but a calendar phishing attack, and the credentials go to fraudsters who may sell them in batches, use them to break into work email, or impersonate a bank or other institution.

Luke Wescott, a threat detection engineer at Sublime Security, said calendar phishing is still relatively new, but the company has seen exponential growth. The scam takes several forms, including a fake meeting or a prompt to renew a service the user pays for. In each case, an entry appears in the user’s electronic calendar after scammers send an email with a calendar request to a work or personal address. Missing the email or having it routed to spam does not prevent the entry from appearing.

Wescott said calendar apps such as Google Calendar can add invitations automatically without users accepting them, so scammers do not need the recipient to open an email. He said a calendar entry can create borrowed credibility by appearing in the same place as a dentist appointment or a weekly one-on-one meeting with a boss. Users who might ignore a message from an unrecognized name may treat a calendar entry differently.

Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, said some scammers use legitimate platforms such as Zoom to send invitations, making them more convincing to recipients and to security software. That makes the invitations difficult to block, he said, and even AI-backed blockers struggle. If an organization sets up filters to block invitations from those platforms, Gannon said, it would also block legitimate meeting invitations.

The invitations can vary in appearance. The Guardian reported examples including fake meetings, notifications of voicemail messages and software renewals. Wescott said common titles include “New voicemail received,” “Payment receipt confirmation – $298.99,” “PayPal unusual activity” warnings, “Your auto-payment will be processed within 24 hours,” and invitations to bid on a contract. Gannon said an invitation could look as if it came from inside the recipient’s company. Scammers can customize the content and may add the company’s logo, he said. The event description typically contains a link or a phone number.

Wescott said scammers either want the recipient to click a link to a fake login page for services such as Microsoft, Google or PayPal and enter a password, or to call a “support” number to cancel a charge that never happened. Until the recipient clicks the link or makes the call, they are not compromised, he said. The scammers do not have access to everything in the calendar; they are trying to lure the user to a place where they will hand over details. Wescott described the technique as familiar phishing delivered through a different method.

Gannon advised people not to panic if they see an unexpected meeting or reminder in their calendar. He said they should treat it like an unexpected email and not click the link. “My number one advice is people just need to be paranoid,” Gannon said. “It doesn’t matter if the invitation has come from someone two desks down, you’ve got to be suspicious of everything.”

Wescott advised turning off automatic accepting. In Google Calendar, users can go into settings and choose to accept invitations only from known senders or only when they have accepted them. He also said users should not click “decline” on suspicious invitations because that can tell the sender the address is “live.” Instead, he said, delete the invitation or report it as spam or junk.