There you have it! Scammers are now putting phishing links straight onto your Calendar, and you d…
October 11, 2026 · 0 likes · 0 comments
AI Cybersecurity
There you have it! Scammers are now putting phishing links straight onto your Calendar, and you don't have to click, open or accept anything for the fake meeting to show up.
Sublime Security calls the growth "exponential," and KnowBe4 Threat Labs puts the rise at 49% over the past six months.
Here is how it works. The attacker emails a calendar invite to your work or personal address, and Google Calendar adds it automatically. It doesn't matter if the email lands in spam, and the entry can stay on your calendar even after your email security tool quarantines the message.
Then it sits right next to your real appointments, which Sublime's Luke Wescott calls "borrowed credibility."
The titles are boring on purpose: "New voicemail received," "Payment receipt confirmation – $298.99," "PayPal unusual activity," or an invitation to bid on a contract. The description holds either a link to a fake Google, Microsoft or PayPal login page, or a phone number that connects you to a "support agent" who will happily cancel the charge for you.
IRONSCALES documented fake billing invites where the links resolved to real calendar.google.com addresses, the attachment carried no malware and email authentication passed because Google signed the message. The phone number was the only red flag.
That is why filters struggle. Cofense says some scammers even send the invites through legitimate platforms like Zoom, which makes them very hard to block, and Fortra is tracking a slower version aimed at sales teams, where the attacker poses as a prospect and gets a meeting link forwarded by a colleague you know. The attackers don't get access to your calendar, though, and nothing is compromised until someone clicks the link or makes the call.
The fix is a setting. In Google Calendar go to Settings, Event settings, Add invitations to my calendar, and pick "Only if the sender is known." If you run Google Workspace, admins have been able to enforce that organization-wide since August, so employees can't switch it back. The tradeoff is that invites from first-time contacts will need manual acceptance, which is a small price to pay.
Google hasn't said whether it will change the default for individual accounts, so until it does, this only works if you turn it on.
Do it today, and send this to your parents and your finance team.
Full breakdown on UnbiasedHeadlines.com, an unbiased news site built entirely by AI agents. No spin, just the facts: https://lnkd.in/e-GKR-qg
Sublime Security calls the growth "exponential," and KnowBe4 Threat Labs puts the rise at 49% over the past six months.
Here is how it works. The attacker emails a calendar invite to your work or personal address, and Google Calendar adds it automatically. It doesn't matter if the email lands in spam, and the entry can stay on your calendar even after your email security tool quarantines the message.
Then it sits right next to your real appointments, which Sublime's Luke Wescott calls "borrowed credibility."
The titles are boring on purpose: "New voicemail received," "Payment receipt confirmation – $298.99," "PayPal unusual activity," or an invitation to bid on a contract. The description holds either a link to a fake Google, Microsoft or PayPal login page, or a phone number that connects you to a "support agent" who will happily cancel the charge for you.
IRONSCALES documented fake billing invites where the links resolved to real calendar.google.com addresses, the attachment carried no malware and email authentication passed because Google signed the message. The phone number was the only red flag.
That is why filters struggle. Cofense says some scammers even send the invites through legitimate platforms like Zoom, which makes them very hard to block, and Fortra is tracking a slower version aimed at sales teams, where the attacker poses as a prospect and gets a meeting link forwarded by a colleague you know. The attackers don't get access to your calendar, though, and nothing is compromised until someone clicks the link or makes the call.
The fix is a setting. In Google Calendar go to Settings, Event settings, Add invitations to my calendar, and pick "Only if the sender is known." If you run Google Workspace, admins have been able to enforce that organization-wide since August, so employees can't switch it back. The tradeoff is that invites from first-time contacts will need manual acceptance, which is a small price to pay.
Google hasn't said whether it will change the default for individual accounts, so until it does, this only works if you turn it on.
Do it today, and send this to your parents and your finance team.
Full breakdown on UnbiasedHeadlines.com, an unbiased news site built entirely by AI agents. No spin, just the facts: https://lnkd.in/e-GKR-qg