When the Calendar Becomes the Trap: The Quiet Rise of Invite-Based Phishing

Phishing has always followed the path of least resistance. Right now, that path can run through the calendar. The CalPhishing pattern described here uses meeting invites and related calendar objects to carry malicious links into a space employees often treat as routine. The important shift is not just delivery: it is persistence. If the calendar entry survives after the email is removed, the lure can keep resurfacing in a place users check every day.

Fast Facts

• Calendar invites can be used as a phishing delivery channel, not only email messages.
• One common technical format for these invites is iCalendar, or .ics, defined in RFC 5545.
• Some platforms may create a calendar entry from an invite or attachment, depending on settings.
• Inbox cleanup alone may not remove the calendar artifact.
• Defenders may need separate mail and calendar controls to fully clear the lure.

One reason this tactic matters is that it moves the attacker’s foothold into a different workflow. Email security teams are built to inspect messages, links, and attachments. Calendar security is often a separate concern, with separate permissions, separate reporting paths, and separate user habits. That creates a blind spot: the malicious content may no longer be “in the email” once the invite is rendered inside the scheduling system.

The technical mechanism is straightforward but effective. Calendar invites can be encoded in structured event formats such as .ics files, which are part of the iCalendar standard. Depending on the client and configuration, an invite may be surfaced as a meeting request or become a persistent calendar object. That does not mean every platform behaves the same way, and it does not prove any one client automatically imports every malicious invite. It does mean defenders should assume the message can outlive the inbox item that carried it.

From a defensive perspective, this changes the response playbook. Removing or quarantining the email may be only the first step. Security teams may also need to inspect the user’s calendar, remove the event itself, and check whether any click-through activity followed the invite. Organizations that allow broad automatic addition of events should review those settings carefully, especially for external senders or unknown organizers.

This is also a reminder that trust is not limited to the inbox. Attackers are increasingly looking for workflows that feel operationally normal: meetings, shared calendars, reminders, and scheduling prompts. Those surfaces can appear low-risk precisely because they resemble daily work. That familiarity is part of the weapon.

At the time of writing, the available information supports a risk analysis, not a full technical attribution of the campaign mechanics, affected users, or broader scope. What is clear is the lesson for defenders: if phishing can survive in the calendar layer, email-only hygiene is no longer enough.

Conclusion

The broader warning is simple. Every trusted productivity tool can become a delivery surface when attackers learn how people actually work. The next time a suspicious message looks harmless because it arrived as a meeting invite, the real question is not whether it belongs in the inbox. It is whether it belongs in the calendar at all.

TECHCROOK

Hardware security key: A small USB or NFC device that adds phishing-resistant two-factor authentication to supported accounts. It is a practical way to reduce the impact of stolen passwords or repeated login prompts, especially for email and workplace services.

Scheda Techcrook: Hardware security key

WIKICROOK

• CalPhishing: Phishing delivered through calendar invites or calendar objects.
• iCalendar: A standard format for exchanging calendar events across systems.
• .ics file: A common attachment type used to distribute calendar invitations.
• Persistence: A threat’s ability to remain present after partial cleanup.
• Calendar artifact: A meeting entry or invite stored inside a calendar system.