Fake Calendar Invites Target Over 40,000 Organizations in Microsoft Credential Phishing Campaign
Check Point Research says hundreds of thousands of phishing emails disguised as calendar invites and meeting requests are being used to steal Microsoft 365 credentials, with more than 40,000 organizations targeted.
According to findings published by Check Point Research and reported by TechRadar, the attackers use two approaches. One relies on .ics attachments that carry malicious links in event descriptions, location fields, or embedded QR codes. Because .ics files are not inherently harmful, they can pass email filters and arrive directly in inboxes. When a recipient opens or accepts the invitation, the calendar entry may be processed automatically depending on user settings, making the fake meeting or payment notification look like an ordinary work appointment or service alert.
The second approach places links directly in emails. These links may redirect victims away from their calendar and to a spoofed Microsoft 365 sign-in page or a fraudulent payment portal. Check Point Research said this method is easier to set up but harder to execute because email security services may flag and filter the links. If the messages pass, victims can have difficulty spotting the ruse.
Check Point Research described the campaign as large and growing. It said hundreds of thousands of emails are sent every month from compromised email addresses. The emails have come from more than 33,890 different sender domains and more than 247,270 unique sender addresses, according to the report.
The researchers said daily volume grew from a few thousand emails a month in April 2026 to more than 118,000 in September and more than 740,000 in the first two weeks of October. The busiest single day was Oct. 8, with almost 200,000 emails. The campaigns average more than 8,300 emails per active day.
In one example shared by Check Point Research, a victim received a fake Microsoft Teams meeting invite. Hovering over the join link revealed its real destination: a credential-harvesting page hosted on a third-party website. The fraudulent content in such messages can direct victims to fake Microsoft 365 sign-in pages or payment portals, where they may enter login credentials or payment information.
Check Point Research said no vulnerability is exploited and no malware is deployed in these attacks. Instead, the campaigns rely on social engineering and the routine nature of calendar invites. The firm said it has added a detection layer specifically designed to identify this attack type.
TechRadar reported that phishing remains one of the oldest and most used attack vectors. Defending against it usually depends on common sense, including making employees aware that unsolicited emails carry real cyberattack risks and that messages urging recipients to urgently download a file or log into a service are likely attempted attacks.
Editor's Summary Check Point Research detected more than 302,386 unique phishing emails using fake calendar invites and meeting requests to steal Microsoft 365 credentials, targeting over 40,000 organizations. The campaigns use .ics attachments or links that lead to spoofed sign-in and payment pages, and volume has accelerated sharply since late September 2026. The findings highlight how routine calendar and meeting notifications can be repurposed for credential theft.