Fake Calendar Invites Hit 40,000 Firms in Microsoft Phishing Surge

How fake calendar invites slip past email filters

The attack works because calendar invites are a normal part of business life — and .ics files are not inherently dangerous.

Security researchers at Check Point Research have exposed a large-scale Microsoft credential phishing campaign that abuses the trust people place in calendar invites. Attackers send .ics attachments disguised as meeting requests or payment notifications. Because the file type itself is harmless, it often passes through email filters and lands directly in the inbox.

Once a recipient opens or accepts the invitation, it can be added to their calendar automatically, depending on their settings. The event description, location field, or an embedded QR code then redirects the victim to a spoofed Microsoft 365 sign-in page or a fraudulent payment portal. No malware is installed and no software vulnerability is exploited — the entire attack relies on the victim handing over credentials or payment details.

A second variant uses links instead of attachments. These are easier to set up but harder to deliver, since email security services are more likely to flag suspicious URLs. When they do get through, victims see a fake Microsoft Teams meeting invite where hovering over the join link reveals a credential-harvesting page on a third-party site.

The numbers behind the campaign

Check Point Research describes the volume as accelerating, not fading.

The scale is striking. Check Point's email researchers flagged more than 302,386 unique phishing emails sent to over 40,000 organizations. The messages came from more than 33,890 different sender domains and over 247,270 unique sender addresses, making blocklisting a nightmare for defenders.

Activity surged starting September 25, 2026. Daily volume grew from a few thousand emails in April to more than 118,000 in September, then to over 740,000 in just the first two weeks of October. The busiest single day was October 8, with almost 200,000 emails. The campaign averages more than 8,300 emails per active day.

This is not a targeted attack against a handful of companies. It is a broad, automated spray-and-pray operation that treats calendar invites as a delivery mechanism. For IT teams, the takeaway is that traditional email filtering is not enough when the payload is a file type people are conditioned to accept.

What defenders and employees should do

The best defense remains awareness, but technical controls can help.

Phishing remains one of the cheapest and most effective ways to compromise a network. Defending against it usually comes down to common sense: employees should treat unsolicited emails with suspicion, especially any message urging them to urgently download a file or log into a service.

On the technical side, organizations can disable automatic calendar processing for external invites, enforce phishing-resistant multi-factor authentication, and train staff to verify meeting requests through a separate channel. Check Point's new detection layer specifically targets this attack type, but the volume suggests many businesses are still exposed.

For individuals, the advice is simple: if you receive a calendar invite you were not expecting, do not click anything. Hover over links to see where they really go, and never enter credentials on a page you reached from an email. For a broader look at how AI is making scams more convincing, see our guide to AI scams fooling Reddit.

• Disable automatic processing of external calendar invites where possible.
• Enable phishing-resistant MFA such as security keys or passkeys.
• Train employees to verify unexpected meeting requests via a separate channel.
• Hover over links to check the real destination before clicking.

What it means for you

The campaign is global and affects any organization using Microsoft 365, which includes businesses across the US, UK, and EU. There is no specific regional targeting — the attackers are casting a wide net. If your company uses Microsoft 365, your employees are potential targets.

Microsoft has not issued a specific public advisory for this campaign as of publication, but the company regularly updates its phishing protection. Check Point's findings are based on its own customer telemetry, so the true scale across all businesses is likely larger.

The calendar invite is one of the last things most people suspect as a phishing vector, which is exactly why this campaign works. With daily volume hitting hundreds of thousands of emails, businesses need to treat unexpected meeting requests as suspicious by default — and make sure their employees know to do the same.