Cybersecurity experts are warning about the growing threat of calendar phishing, a scam that uses scam meeting invitations, payment alerts and renewal reminders to trick people into sharing sensitive information.
Unlike traditional phishing attacks that mainly rely on suspicious emails, calendar phishing places deceptive events directly into a user's calendar. Because these entries appear alongside genuine appointments, victims may be more likely to trust them.
How the scam works
The attack often begins when a user receives an email invitation that automatically appears in their digital calendar. The event may look like a routine business meeting, a voicemail notification, a payment confirmation or a warning about unusual activity on a PayPal account.
Some invitations claim that a payment is about to be processed or that a software subscription needs to be renewed. Others may imitate internal workplace meetings, complete with company names, logos and convincing descriptions.
The event usually contains a link or telephone number intended to persuade the recipient to take action. Clicking the link may open a scam login page that resembles Google, Microsoft or PayPal. If the victim enters their credentials, the attackers can capture the information.
In other cases, victims are encouraged to call a fake customer-support number to cancel a payment or resolve a supposed security problem. Threat actors may then attempt to obtain personal information, account credentials or financial details.
Why calendar phishing is difficult to stop
According to security professionals, calendar phishing has experienced sudden growth. Security teams face difficulties blocking these attacks because legitimate meeting invitations and malicious events can use the same calendar services.
Attackers may also exploit trusted platforms, including Zoom, to make invitations appear genuine. Automatically accepting invitations from unfamiliar senders can increase the chances that scam events will appear in a user's schedule.
Stolen credentials can be sold to other criminals or used to access workplace email accounts, impersonate employees and launch further attacks. However, simply receiving a suspicious calendar entry does not necessarily mean an account has been compromised. The main danger arises when victims follow the instructions and disclose information.
How to stay safe?
Experts recommend treating unexpected calendar invitations with the same caution as suspicious emails. Users should avoid clicking unfamiliar links, downloading unexpected files or calling numbers provided in questionable event descriptions.
