If a strange meeting invite has shown up on your calendar lately that you don’t remember agreeing to, you’re not alone, and it might not be harmless. Security firm Sublime says a technique called ICS phishing has exploded in recent months, projecting a roughly 33,000% increase in calendar-based phishing attacks between May and September alone (via ZDNET).
Why are fake calendar invites so effective?
Calendar invites use a file format called ICS, part of the iCalendar standard, and programs like Gmail, Microsoft Outlook, and Apple Mail automatically add them to your calendar as soon as they arrive, often before you’ve even opened the email. That gives an attacker two separate chances to reach you through the email sitting in your inbox and the meeting sitting on your calendar.
Even if your email security software catches the message and blocks or quarantines it, the calendar entry frequently survives untouched, since most tools were never designed to reach into your calendar.
In one real example Sublime tracked, an attacker sent a Google Calendar invite referencing a fake credit owed, using a free Gmail account to dodge blocklists. Clicking the link led to a fake payload page that pushed malware that gave attackers direct control over the victim’s device. These attacks usually work because people trust both the platform and the invite format itself.
How to spot and avoid these calendar scams?
These invites can use phishing tricks, including financial lures, urgent requests, suspicious links, QR codes scams, and malicious attachments. So, you should avoid clicking links or even hitting decline, since declining still confirms your email is active. Instead, delete suspicious invites and report them as spam.
Sublime’s Mark Morris adds that you should scrutinize the sender’s email address, treating links with the same suspicion as a sketchy email. You can also tighten Gmail or Outlook settings so invites only get added automatically from senders you actually know. Here’s how to do it:
In Gmail, open Google Calendar, click the gear icon > Settings > General > Event Settings. Change “Add invitations to my calendar” to “Only if the sender is known,” or better yet, to “When I respond to the invitation in email.”
For Microsoft Outlook, go to File > Options > Mail > Tracking > and uncheck “Automatically process meeting requests and responses to meeting requests and polls.” Then head to the Calendar section in Outlook Options, find Auto Accept/Decline, and uncheck “Automatically accept meeting requests and remove canceled meetings.”
Once you Save these changes, new invites will need your approval before landing on your calendar.
