PSA: The calendar invite is the new phishing vector, and email filters aren't catching it

Security researchers at Sublime have warned that calendar invitations are emerging as a new phishing vector. The technique, known as ICS phishing, leverages widely used and trusted software like Google Calendar and Microsoft 365, which may not be thoroughly scrutinized by antivirus tools. Reports of these attacks have surged recently due to their low cost and higher likelihood of reaching end users.

A typical calendar phishing scam involves a user noticing an unfamiliar meeting invitation or a financial issue notification on their calendar. Assuming it's a forgotten event, the target clicks a link that redirects them to a fraudulent website, potentially requesting login credentials or delivering malware. Attackers send these messages to both an email inbox and calendar simultaneously to boost the chances of attracting attention.

Despite email spam filters catching many malicious messages, calendar services may still allow the invitations through, especially when configured to auto-add events from emails. Sublime reports a staggering 33,000% increase in ICS phishing incidents between May and September, with monthly growth rates of 1000% or more. The tactic's attractiveness to attackers stems from its affordability and ability to exploit gaps in how calendar invitations are handled.

Users should remain vigilant against suspicious messages, particularly those invoking financial concerns or using urgent language, especially from unknown senders. Instead of responding to suspicious invitations, users should delete them and report them as spam. If an invitation from a known contact appears suspicious, it should be verified through a separate communication channel.