Fake Calendar Invites Are Phishing Microsoft 365 Credentials at Scale — And the Campaigns Are Accelerating

The Invite That Was Not an Invitation

It arrives looking entirely routine — a calendar notification, a meeting request, perhaps a payment reminder neatly formatted in the style of a Microsoft Teams alert. The recipient clicks, the event populates their calendar, and somewhere in the location field or the event description sits a link to a spoofed Microsoft 365 sign-in page. By the time credentials are entered, the damage is done.

This is the operational logic behind a set of phishing campaigns that security firm Check Point Research (CPR) has been tracking with growing concern. The campaigns are not novel in concept — credential harvesting via deceptive emails is among the oldest attack vectors in the threat landscape — but their execution through .ics calendar files and meeting-invite workflows represents a deliberate, disciplined exploitation of how modern business communication actually functions.

Two Vectors, One Objective

CPR identified two structurally distinct approaches operating within these campaigns, both aimed at the same outcome: delivering victims to fraudulent pages where they surrender login credentials or payment information.

The first method deploys .ics file attachments directly within emails. The .ics format — the standard for calendar data exchange — is broadly trusted by email filtering infrastructure because the file type carries no executable payload and exploits no software vulnerability. It passes through security gateways cleanly, lands in the inbox, and presents itself as a meeting request or service notification. Depending on a user’s calendar settings, the event may be processed automatically, embedding the fraudulent content directly into their schedule without any deliberate acceptance on their part.

The second method embeds links within the email body itself, redirecting victims away from their calendar environment and into attacker-controlled pages. This approach is operationally simpler to construct but harder to land successfully — email security services are more likely to flag suspicious URLs than innocuous .ics attachments. When such links do pass through, however, the disguise holds. In one example documented by CPR, a fake Microsoft Teams meeting invite contained a “join” link whose true destination — a credential-harvesting page hosted on a third-party domain — was only visible on hover.

In neither case is malware deployed, nor is any software vulnerability exploited. The attack surface is entirely human. The fraudulent content, once embedded in a calendar, is visually indistinguishable from a legitimate work appointment, and that is precisely the point.

The Scale Is Not Incidental

What elevates these campaigns beyond routine phishing noise is their volume and trajectory. CPR reports that a dedicated detection layer flagged more than 302,386 unique phishing emails across its customer base, reaching more than 40,000 organisations. The messages originated from more than 33,890 distinct sender domains and more than 247,270 unique sender addresses — a distribution pattern consistent with large-scale use of compromised email infrastructure.

The daily average exceeded 8,300 emails per active day. But the trajectory is what commands attention. Monthly volume grew from a few thousand emails in April to more than 118,000 in September, then surged to more than 740,000 in the first two weeks of October alone. The single busiest day on record within the campaign was October 8, when nearly 200,000 emails were sent in a 24-hour window.

“Activity is not fading, it is accelerating,” CPR’s researchers concluded — a characterisation that reflects not merely growth in volume but an apparent operational confidence on the part of the threat actors, who appear to be scaling infrastructure as detection pressure rises.

Why Calendar Infrastructure Is a Credible Attack Surface

The choice of calendar invites as a delivery mechanism is not accidental. Enterprise workflows have normalised the automatic acceptance and processing of calendar events, particularly in organisations running Microsoft 365 or Google Workspace environments. The cognitive load of evaluating each incoming invite is low — most are legitimate — and the visual design of calendar notifications carries an institutional familiarity that suppresses suspicion.

Phishing campaigns have historically exploited precisely this kind of ambient trust: the DocuSign notification, the shared OneDrive file, the Zoom meeting link. Calendar invites are simply the current frontier, and their effectiveness is compounded by the fact that the .ics format sidesteps many of the URL-scanning and attachment-analysis mechanisms that enterprise email security platforms apply to more conventional file types.

The defence, as CPR and the broader security community consistently emphasise, is not primarily technical. Organisations must invest in staff awareness that treats unsolicited calendar invites with the same scrutiny applied to unexpected email attachments — and that recognises urgency, unfamiliar sender domains, and requests to authenticate via a link as reliable indicators of attempted compromise.

A Persistent Structural Problem

Phishing endures as the dominant initial access vector in enterprise breaches not because defenders lack tools, but because the attack surface is fundamentally human and therefore irreducible. Technical controls — email filtering, link scanning, multi-factor authentication — raise the cost of a successful attack but do not eliminate it. The .ics campaign is a case study in how threat actors adapt their delivery mechanisms to route around layered defences while keeping the core deception identical.

For organisations operating in high-stakes digital environments — financial services, professional services, government-adjacent sectors — the lesson is structural rather than tactical. Credential phishing at this scale, targeting more than 40,000 organisations simultaneously, is not a targeted intrusion. It is industrial-grade social engineering, and it demands a proportionate institutional response in training, policy, and detection architecture.