An appointment you never accepted suddenly appears in your calendar. Subject: 'New company policy: acknowledge the document'. The reminder pops up right on time, the link is just one click away, and that is exactly what the attackers are counting on.
We all know phishing, along with quishing via QR codes and smishing via text message. CalPhishing, short for calendar phishing, brings phishing directly into the calendar. Instead of relying on a suspicious email, criminals use meeting invitations. Many calendars add such invitations automatically, without anyone having accepted them. And unlike an email, the appointment does not disappear just because the message was deleted or filtered out.
The October Cyber Snack shows how this trick works, why it is surging right now, and what you should do when an unfamiliar appointment appears.
How an unfamiliar appointment ends up in your calendar
The invitation lands twice: in the inbox and in the calendar. If only the email is removed, the appointment stays.
Technically, a meeting invitation is an email with a calendar file attached, usually in .ics format. In many configurations, Outlook, Microsoft 365, and Google Calendar process such files automatically: the appointment is added before anyone has even opened the message. In Outlook, it then appears with the status 'Tentative', inconspicuous but visible.
That is exactly what makes the scam so effective. Researchers at Sublime Security put it this way: invitations go to the calendar and the inbox at the same time, which means twice the exposure. Even if the spam filter moves the email to quarantine, the appointment may already be in the calendar.
First aid for an unfamiliar appointment
Do not click the link in the appointment. Report the appointment to security or IT. Then decline it without sending a response, rather than just deleting the email. If the email is already deleted, find the appointment in your calendar and remove it immediately.
The case: 'Domain expired' and 'Signature missing'
The term CalPhishing was coined in May 2026 by Fortra's research team. It described a campaign that had been active since early 2026 and specifically targeted Microsoft 365 accounts. The appointments carried subject lines such as '[Urgent]: Domain Renewal Failed' or 'Reminder for Signature – Vendor Information Verification', exactly the kind of admin task people want to get done quickly.
From the calendar link through a fake security check to the stolen access: everything looks legitimate until the very end.
Anyone who clicked the link in the appointment first landed on a fake security check in the style of Cloudflare, then on a replica DocuSign or domain registrar page. At the end came a genuine Microsoft sign-in page asking for a device code. That is exactly the trick: whoever enters the code does not sign themselves in, but the attackers' device. The criminals thus obtain a valid access token, and two-factor authentication did not prevent it because the victim confirmed it themselves.
Other variants are simpler, but no less dangerous. In June 2026, Mimecast documented a campaign using deliberately malformed calendar files containing a QR code, sent via Google infrastructure and therefore passing sender authentication checks. According to Mimecast, the main targets were the UK, Germany, and the US.
The spam filter caught the email. Not the appointment.
A wave in autumn 2026
Since late summer, CalPhishing has picked up considerably. Sublime Security recorded a 1,216 percent increase over the previous month in August 2026 and projected a rise of around 33,000 percent for the period from May to September. Check Point counted more than 302,000 unique phishing emails with fake calendar invitations sent to over 40,000 organizations from September 25, 2026 alone. On October 8, there were almost 200,000 on a single day.
The lures are as varied as in classic phishing: failed payments, suspended accounts, invoices, Teams meetings, new policies. What is new is only the place where they wait.
Our insight on web meetings also shows how fake invitations to online meetings work. And our insight on ransomware explains why a single click can be the start of a much larger attack.
Why deleting alone is not enough
The email was deleted long ago, but the appointment still sends its reminder, sometimes months later.
The natural reflex with a suspicious invitation is to delete the email and move on. With the calendar, that does not work. Microsoft explicitly describes this behavior in Outlook: if you delete the invitation, the tentative meeting remains in your calendar. According to Fortra, moving it to the junk folder does not remove it either.
Particularly devious: an appointment can be scheduled far in the future. Then the reminder only appears weeks or months later, when nobody remembers the strange email anymore. What appears on screen is no longer spam, but a notification from your own calendar.
Why the trick works so well
Four properties make CalPhishing particularly devious. First, the entry appears without being accepted: it is marked 'Tentative' and shown faded, but the reminder still pops up and displays the text and link. Second, time pressure: when Outlook says 'Due in 15 minutes', it sounds urgent, and people under pressure act faster and with less thought. Third, trust in the system: a calendar notification suggests that we created the entry ourselves, or someone we know did. Fourth, the appointment remains even when the suspicious email has long been deleted.
In the end, it still comes down to the classic phishing link. The calendar is just the packaging that makes it more convincing. The good news: you can protect yourself very effectively against CalPhishing. In the Cyber Snack, Eric and Tomislav rate protection a 9 out of 10, provided you follow a few basic rules.
Four assumptions, fact-checked
Assumption: Whatever lands in the spam folder can no longer do any harm. False. The email may have been filtered out, but the appointment can still be in the calendar and send a reminder later.
Assumption: If I delete the email, the appointment is gone too. False. In Outlook, an automatically added tentative meeting remains after the invitation is deleted. It has to be removed in the calendar itself.
Assumption: Links in the calendar are checked automatically and are therefore safe. False. A link in an appointment is no more checked than a link in an email. It only seems more trustworthy because it comes from your own calendar.
Truth: Even a genuine Microsoft page can be part of the attack. Correct. In device code phishing, victims land on the real sign-in page and enter a code there that gives the attackers access.
Three rules for suspicious invitations
1. Report instead of quietly deleting
Report suspicious invitations to security or IT immediately. That way, they can check whether the same invitation is also sitting in other calendars.
2. Decline the appointment, don't just delete the email
Remove the appointment in the calendar itself. In Outlook, ideally via 'Decline' with the option not to send a response, so you do not confirm to the criminals that your address is active. Outlook then removes the appointment from the calendar, and the email is usually deleted automatically too. If the email is already gone, find the appointment in your calendar and delete it there.
3. Check links calmly
Never open links from appointments under time pressure. Do not enter credentials, personal data, or device codes if you are not sure who created the appointment. If in doubt: don't click.
What security and awareness teams should take from this
For CISOs and awareness managers, CalPhishing shows that a spam filter alone is no longer the last line of defense. If an email ends up in quarantine but the appointment stays in the calendar, two things are needed: processes that also remove the associated calendar entries during remediation, and employees who recognize an unfamiliar appointment as a warning sign.
A clear reporting culture is just as important. Anyone who reports a suspicious appointment to security or IT instead of quietly deleting it helps find the entire campaign within the company, because the same invitation is usually sitting in many calendars at once.
Three adjustments for IT
Check whether external invitations are added to calendars automatically, and restrict this if necessary. When remediating reported phishing emails, also remove the associated calendar entries. And use conditional access policies to limit device code sign-in to the cases where it is really needed.
Conclusion
CalPhishing is not a new attack, but classic phishing in a new place. The calendar gives the lure credibility, urgency, and staying power: it remains even when the email is long gone.
That is why three maxims apply: report unfamiliar appointments, decline invitations instead of just deleting the email, and never open links under time pressure. If in doubt, do not click and do not enter any data.
Sources
Fortra Intelligence and Research Experts (FIRE), May 14, 2026: "New Calendar Invite Phishing Campaign: ICS Abuse and Post-Delivery Persistence"; Mimecast Threat Research, June 17, 2026: "The Rise of Calendar Invite Abuse".
Sublime Security, September 17, 2026: "Sublime observes massive uptick in ICS phishing and calendar-based malware attacks"; Check Point, October 15, 2026: "Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign"; Help Net Security, October 20, 2026: "Quarantined, but still on your calendar".
Microsoft Learn: "Remove a tentative meeting that's automatically added to your calendar" (Outlook for Microsoft 365, 2021, 2019, and 2016).
