← All terms

Calendar Phishing

Calendar phishing delivers malicious links through meeting invites that land directly on the victim's calendar, bypassing the skepticism people apply to email.

Calendar phishing is a phishing variant that delivers the lure as a meeting invitation rather than a plain email. Because most calendar systems process invites automatically, the event can appear directly on the victim's calendar — complete with a malicious link in the location or description field — without the victim ever accepting it. The attack exploits a gap in trained instincts: employees have learned to inspect emails, but a calendar entry titled "Q3 payroll review" with a conference link looks like work, not like an attack.

How it works

The attacker sends a meeting invite to harvested addresses. Three properties make it effective. Auto-processing: many mail clients add invites to the calendar by default, so even an ignored or deleted email can leave a calendar entry — and reminders will keep resurfacing it at times the attacker chose. Inherited legitimacy: invites arrive through legitimate calendar infrastructure, which both borrows that platform's trusted look and can slip past filters tuned for classic phishing email. Context pressure: a reminder firing fifteen minutes before a "mandatory benefits enrollment call" pushes the victim to click the join link quickly. The link itself typically leads to a credential-harvesting page imitating a login portal, a fake video-conference page, or an OAuth prompt requesting mailbox access (consent phishing). The same move works inside collaboration suites, where chat and meeting invitations carry the inherited trust of the platform — see Microsoft Teams phishing.

How to defend against it

  • Turn off automatic invite processing where the platform allows it, so events from unknown senders don't appear on calendars unaccepted.
  • Train the calendar reflex explicitly: an unexpected invite deserves the same scrutiny as an unexpected email, especially when the join link's domain doesn't match the supposed platform.
  • Include calendar lures in phishing simulations so the unfamiliar channel gets the same practiced skepticism as email.
  • Report, don't just decline. Declining notifies the attacker that the address is live; employees should report the invite to security and remove it without responding.

Related terms

PhishingPhishing is a social engineering attack that uses fraudulent emails, websites, or messages to trick people into revealing sensitive information or installing malware.Spear PhishingSpear phishing is a targeted phishing attack that uses personalized information about the victim to increase its effectiveness.Consent PhishingConsent phishing tricks users into granting a malicious OAuth app access to their cloud account — bypassing passwords and MFA entirely via legitimate consent screens.QuishingQuishing (QR code phishing) is a social engineering attack that uses malicious QR codes to direct victims to credential-harvesting sites or malware downloads.
See your Human Risk Score

NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.

Book a demo