Fake Calendar Invites Lead to Microsoft 365 Phishing Pages
Check Point researchers report phishing campaigns that place deceptive links inside calendar invitations. The trap leads to fake sign-in pages rather than exploiting calendar software.
The Short Version
Calendar invitations are being used to steer people toward fake Microsoft 365 sign-in pages, according to TechRadar’s account of Check Point Research findings. The reported campaigns deliver invitations through .ics attachments or links, making fraudulent content resemble an ordinary appointment or service notice.
Why It Matters
The trap is in the next step. An event description, location field or QR code can send someone to a counterfeit sign-in or payment page. The report describes credential harvesting without a software vulnerability being exploited or malware being installed. Depending on user settings, a calendar entry may even be processed automatically; that does not mean credentials have already been stolen.
The Bigger Picture
Check Point says its detection layer flagged more than 302,386 unique phishing emails sent to over 40,000 organizations among its customers’ messages. Those figures describe detected messages and organizations targeted, rather than a count of compromised accounts. The distinction keeps a large campaign from being mistaken for proof that every recipient fell for it.
What to Watch
In one example cited by the researchers, hovering over a supposed Microsoft Teams join link exposed a third-party credential-harvesting destination. That illustrates why the destination matters as much as the familiar meeting format. The saved report does not establish how many recipients actually surrendered credentials.
What would make you double-check an unexpected meeting invitation?
Connie Brew