Fake Calendar Invites: 740,000 Phishing Emails in Two Weeks

A meeting invite is the one email most people accept without reading. Attackers have noticed. On October 15, 2026, Check Point described phishing campaigns that use fake calendar invitations to steal Microsoft passwords, with a volume curve that bends almost straight up.

The lures look routine. One carries a 5.7 KB .ics file for an event that has already happened. Another is a Teams meeting whose title promises "Financial Compensation and Enhanced Benefits," supposedly sent "by Copilot on behalf of HR Dept." Neither needs a software bug.

Key Takeaways

• Check Point counted more than 740,000 fake calendar invite emails from October 1 to 15, 2026, up from more than 118,000 in all of September and a few thousand a month in April.
• October 8, 2026 was the busiest day of the campaign, with 199,950 emails in Check Point's data.
• Check Point separately flagged more than 302,386 unique phishing emails sent to more than 40,000 organizations, without explaining how that total relates to its chart.
• Sublime Security recorded a 1,216% month over month rise in malicious calendar invites in August 2026 and warned that an invite can still land on a calendar after the email is quarantined.
• Google Calendar's Only if the sender is known setting and Microsoft Defender's Hard Delete action both help keep these events off your calendar.

What Did Check Point Find?

Check Point found several high volume campaigns that use meeting invites to deliver Microsoft credential phishing. Per the Check Point research post, some arrive as an .ics attachment and others use a link "that appears to lead to a different destination." "The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability."

The scale figures, all from the same post:

• More than 302,386 unique phishing emails flagged, sent to more than 40,000 organizations
• More than 33,890 sender domains and more than 247,270 unique sender addresses
• An average of more than 8,319 emails per active day
• A surge that began September 25, 2026, and was "still observed as recently as October 15"

The fake Teams example teaches more. Check Point writes that hovering over the Join link "reveals its real destination — a credential-harvesting page at login.microsoft.com, not Teams." The screenshot shows the address starting on Microsoft's own /common/oauth2/v2.0/authorize sign in endpoint. A link that begins on a genuine Microsoft domain defeats the old advice to hover and check.

Are 740,000 and 302,386 the Same Count?

No, and Check Point does not say how they relate. The smaller figure comes from this sentence: "A new detection layer specifically designed to identify this type of attack has flagged more than 302,386 unique phishing emails among our customers' emails, sent to more than 40,000 organizations." The larger one comes from the trend section: "Daily volume grew from a few thousand emails a month in April to more than 118,000 in September, and to more than 740,000 in just the first two weeks of October."

The October figure is more than twice the flagged total, so the chart cannot be a subset of the 302,386. Perhaps the chart counts every delivered copy and the headline counts unique messages; the post never says. The averages don't settle it either: 302,386 divided by 8,319 a day is about 36 active days, longer than the 21 days from September 25 to October 15.

Whatever the counting rule, the curve is steep. By our arithmetic from Check Point's numbers:

• September averaged about 3,900 emails a day (118,000 over 30 days).
• October 1 to 15 averaged about 49,000 a day (740,000 over 15 days), roughly 12 times September's pace.
• October 8 alone, at 199,950, outnumbered all of September by about 1.7 times. Check Point's chart links it to Prime Big Deal Days and the October 7 war anniversary.

How Does a Fake Invite Get Onto Your Calendar?

It gets there because calendar software is built to show invitations before you answer them. An .ics file is an iCalendar object, and the scheduling standard IETF RFC 5546 defines its REQUEST method as "an explicit invitation to one or more Attendees." Both big platforms act on that invitation automatically in common setups:

• Google Calendar: with the From everyone option, Google's help page says "All invitations are automatically added to your calendar."
• Exchange and Microsoft 365: Microsoft's Set-CalendarProcessing reference says new meeting requests are "added to the calendar as tentative," and calls that "the default."

That design opens a second delivery path, and it is busy: Sublime recorded a 1,216% month over month increase in invite attacks in August 2026. Sublime Security threat detection engineer Mark Morris, quoted by Help Net Security on October 20, put it this way: "Because email and calendar operate over different protocols, there is a non-zero chance that even if the target's email security solution catches [and quarantines] the phishing email, the meeting would still land on the target's calendar."

Microsoft has described the same gap in its own product. A November 24, 2025 Defender for Office 365 blog post says that "Even after the email is removed, Outlook automatically creates a calendar entry during delivery, which remains accessible to users."

Sublime's own example was a Google Calendar invite sent from Gmail, with Google's link rewriting routing the click through google.com. It ended in a ScreenConnect remote access installer, the tool behind the fake COLDCARD audit emails we covered in August.

Why Email Users Should Care: The Lure Skips Your Inbox

The spam folder, the external sender banner and the suspicious message warning all live on the email. A calendar entry carries none of them. So when a filter quarantines the email but the event survives, the attack wins twice: the security team marks the threat as handled, and the user's only view of the lure is a clean meeting block with a Join button.

Help Net Security spells out the human side: targeted users "might eventually see the invite, but not be aware of the context," and may click to remind themselves of a meeting they think they forgot. It is the trust problem behind phishing sent through real DocuSign notifications: a genuine wrapper around a hostile destination.

The reach is also new. In August we covered SVG voicemail phishing that hit 5,527 organizations. Check Point's calendar campaigns reached more than 40,000, about seven times as many, through a channel that can survive the email being caught.

How Do You Stop Fake Invites in Google Calendar and Outlook?

Stop unknown senders from adding events, report spam events instead of answering them, and protect the Microsoft login itself.

1. Change Google Calendar's invite setting. Open Google Calendar, click Settings, then under General click Event settings and open Add invitations to my calendar. Pick Only if the sender is known, which adds events only when "the sender is in your contacts, part of your organization, or someone you previously interacted with," per Google's invitation help page. When I respond to the invitation in email is stricter. The change affects only new invitations, and on work accounts your admin controls the options.
2. Report the event, don't RSVP. Open the event, click More actions, then Report as spam. Per Google's spam reporting page, this removes the event (and its series) but works only for events sent from Google Calendar. Delete anything else without clicking links.
3. Block repeat senders. Google's August 18, 2026 Workspace update added Calendar blocking, which removes the event and stops new invites. For other senders, Gmail's block stops "all emails from them, including emails that create Calendar events."
4. Turn off tentative placement in Exchange. Microsoft 365 admins can run Set-CalendarProcessing -Identity user@example.com -AddNewRequestsTentatively $false. Microsoft's reference says that afterwards "Only existing calendar items are updated by the Calendar Attendant." It affects colleagues too.
5. Sign in to Microsoft with a passkey. Microsoft's passkey explainer says that on a lookalike site "your device won't present your passkey to the malicious website." For lures that start on Microsoft's real login domain, admins should follow Microsoft's user consent guidance and allow consent only for apps from a verified publisher.

What Should Security Teams Change?

Treat remediation as unfinished until the calendar is clean. Microsoft's remediation guide for Defender for Office 365 lists Hard delete as the action that will "Purge the deleted message and the corresponding calendar entry for meeting invite messages."

• Use Hard Delete on confirmed invite phishing, and know its limits: Microsoft says it "does not remove calendar entries manually added by users via .ics files," and a resent invite restores the entry.
• Confirm your email security covers calendar entries and that removing an email also removes its event, as Help Net recommends.
• Hunt for the red flags Help Net lists: unexpected invites from first time senders on free email accounts, business themed invites with financial urgency, and links to free website builders.

Because a stolen password is only the first step, also review how attackers bypass MFA on hijacked Outlook accounts too.