Question 1

What is calendar invite phishing?

Accepted Answer

Calendar invite phishing is a credential harvesting attack in which the attacker sends a meeting invitation - usually via the standard ICS calendar protocol - that places a fake event on the target's calendar. The invite carries a join URL that points to a credential-harvesting page styled to look like a legitimate meeting platform, and is typically timed with a tight last-minute reminder so the target is pushed straight to the join button before they verify the sender. The technique is effective because calendar invites often bypass the email security gateway entirely, and because users are conditioned to treat anything on their calendar as already vetted by IT.

Question 2

Why do calendar invites bypass email security?

Accepted Answer

Many calendar systems accept invites over protocols that are separate from the inbound email path your security gateway inspects. When a corporate auto-accept policy is enabled for external organizers, the invite lands directly on the user's calendar without the join link or attachments ever passing through the gateway's URL scanning, attachment sandboxing, or sender authentication checks. The same payload sent as an email link would be blocked or rewritten by the gateway, but delivered as a calendar invite it arrives unscanned. Tightening the auto-accept policy so external invites land in the inbox first is the structural fix - it forces the invite back through the email security stack before it ever appears on the calendar.

Question 3

What are the red flags on a phishing meeting invite?

Accepted Answer

Four red flags catch most calendar phishing attempts. First, the organizer email address is on a lookalike domain that differs from the real vendor's domain by one letter, a hyphen, or a different top-level domain (the display name is set by the sender and proves nothing). Second, the join URL points to an unfamiliar meeting platform - not zoom.us, not teams.microsoft.com, not your own corporate platform - and is often served over HTTP rather than HTTPS. Third, the join page asks for your corporate password to verify identity, which is the cleanest signal of all because legitimate meeting platforms never require a corporate password to join as a participant. Fourth, the invite arrives last minute with a tight reminder window and no prior email thread, calendar hold, or context, which is the social engineering pressure designed to push you past your normal verification habits.

Question 4

How do I verify a suspicious calendar invite?

Accepted Answer

The strongest single check is out-of-band confirmation on a channel that was authenticated before the suspicious invite arrived. For a vendor or partner you already work with, that means calling your existing contact on a number you already have saved - not the number on the invite, not a number from the organizer's email signature. For an internal request, that means a separate work chat, a directory listing, or walking over to the person's desk. Replying to the meeting organizer's email is not verification - if the invite is hostile, the address answering you is hostile too. Reading the actual organizer address and the join URL is the second check; calling on a trusted number is what confirms whether the meeting is real.

Question 5

Why is a password prompt on a meeting join page a red flag?

Accepted Answer

Legitimate meeting platforms do not require your corporate password to join a meeting as a participant. Zoom, Teams, Google Meet, and the major enterprise platforms all join you via a meeting ID and an optional passcode generated by the host - never via your work email and password. A login form that asks for your corporate credentials on the way to a meeting only exists to capture them. If a join page demands your corporate password, close the tab, do not enter anything, and report the invite to the security team.

Question 6

What should I do if I realise a calendar invite is hostile?

Accepted Answer

Do three things in order. First, delete the event from your calendar so you cannot click the join link by mistake later and so the SOC team has a clean state to work from. Second, file a report with the security team that captures the spoofed organizer address, the fake join URL, and a short narrative of how you detected the attempt - those three artifacts let SOC block the lookalike domain and the fake meeting platform at the email gateway and DNS resolver in minutes. Third, do not forward the invite to colleagues to ask if they got the same one - that just propagates the attack. The fast structured report is what protects everyone else, because SOC will hunt for parallel attempts and warn the team without anyone else having to discover the invite from scratch.

Шахрайство із запрошеннями в календарі

Що таке Шахрайство із запрошеннями в календарі?

Що ви дізнаєтесь у Шахрайство із запрошеннями в календарі

Шахрайство із запрошеннями в календарі — Кроки навчання

Тихий вівторок вдома

Несподіване нагадування

Огляньте зустріч

Пауза перед клацанням

Прочитайте адресу та посилання

Перевірте у постачальника

Підтверджено: спроба фішингу календаря

Відкрийте портал безпеки

Увійдіть на портал

Надішліть звіт про інцидент