There’s a new type of scam, and it’s coming from a very unlikely place: your work calendar.
These so-called calendar-based attacks are a new spin on phishing, and according to a report from cybersecurity company Sublime, they’re growing fast.
“This attack type has finally hit the mainstream,” Sublime threat detection engineer Mark Morris wrote in a blog post. “To really drive that point home, the increase [in attacks] from May to September is projected to be ~33,000%.”
It works like this. An event pops up on a victim’s calendar. Perhaps it comes from an unknown contact or, more insidiously, impersonates Zoom or spoofs a victim’s own company. Like other phishing schemes, the goal is to get victims to hand over credentials. The calendar invite itself does not give attackers access to a person’s entire calendar, nor does it automatically steal credentials. It’s a mechanism that exploits trusted infrastructure, meaning victims will likely have their guard down.
“If they want to, they could make it look like an internal invitation,” intelligence analysis manager at the cybersecurity firm Cofense, Max Gannon, tells the Guardian. “They can customise the content, maybe by adding the logo of your company.”
The invite will likely contain a malicious link or attachment, or request that a victim call a phone number to connect directly with scammers, which is known as callback phishing. These scams also typically include elements of urgency or financial loss or gain, according to Sublime.
One example, flagged in November by Sublime, is a calendar invite that informs potential victims that “a transaction of US$599.89 (RM2,449.47) has been successfully processed using your PayPal Wallet for a Bitcoin purchase.” It urges them to “call our customer support line” if they did not authorise the transaction or believe it was made in error. That’s an example of a callback phishing attack, delivered via calendar invite, which is an increasingly popular combination. According to Sublime’s 2026 Email Threat Research Report, calendar invite attacks accounted for almost 20% of callback phishing attempts in the fourth quarter of last year.
Until a victim clicks, downloads, or makes a call, they are safe. But if they do, it’s open season on their credentials, which could lead to theft and financial loss. As these attacks grow more popular, Sublime has also identified other sorts of malware in calendar invites, including software that is capable of stealthily monitoring and controlling a victim’s device.
Sublime first spotlighted the calendar attacks, which it calls “ICS phishing” after the .ics attachment characteristic of calendar invites, in November 2025. Since then, the volume of attacks has grown steadily. Sublime’s Morris pointed to a 282%t month-over-month jump in June 2026 from May, and then a 338% jump in July from June. But starting in August, the volume of attacks exploded. August saw a 1,216% increase in the incidence of calendar attacks over July, and September is projected to grow by as much as 2,852%.
These attacks are becoming increasingly popular for a variety of reasons, Sublime reports. For one thing, calendar invites are sent both to the email inbox and straight to the calendar. So even if email security systems flag the message as spam, it’s still likely that the malicious invite will land on a user’s calendar. Calendar infrastructure from Google and Microsoft is broadly trusted. Lastly, attackers are often abusing free services, so oftentimes it costs them nothing to attempt an attack.
Although there are services like Sublime’s that can help protect potential victims against calendar-style attacks, cybersecurity company Malwarebytes also offers some basic best practices to keep in mind. Guard against fake event invites by disabling the option to automatically add events to a calendar via email. This option is widely available in many calendars, but disabling it will ensure an event remains an email until it is explicitly approved.
If a suspicious event does show up, block the sender and delete the event without interacting with it in order to avoid alerting criminals that your email address is active. Should you fall victim to a calendar phishing attempt, report it to your account administrator and ensure you have multifactor authentication enabled so that criminals cannot exploit your account. – Inc./Tribune News Service
