Most phishing advice focuses on your inbox: watch what you click, check the sender, and avoid strange attachments. That advice is fine, but it targets the wrong surface area. A fast-growing attack bypasses inbox rules entirely and goes straight to your calendar.
Security firm Sublime tracked a sharp rise in what it calls ICS phishing. The numbers are striking. These calendar-based attacks rose 282 percent in June over the prior month, 338 percent in July, and 1,216 percent in August. For September, the firm projected a 2,852 percent surge over August. Regardless of the exact final figure, the trend is clear and rising fast.
Here is how it works and why it succeeds. An ICS file is the standard format for meeting invitations. It is a normal, legitimate way for calendars to communicate. The problem is that platforms like Microsoft Outlook, Gmail, and Apple Mail frequently add ICS invites to your schedule automatically before you accept or decline. The event simply appears. Attackers have learned to exploit this convenience feature.
This design exposes you in two places at once. The invite hits both your inbox and your calendar. Standard email security scans the inbox, but very little software inspects calendar events. Even if your filters flag or quarantine the email, the event remains on your schedule, complete with malicious links or QR codes. Users tend to trust calendar entries, and attackers rely on that implicit trust.
To make matters worse, clicking “Decline” offers no protection. Responding in any way confirms to the attacker that your address is active and monitored, making you a higher-priority target for future campaigns.
The threat is far from theoretical. In one recent attack flagged by Sublime, a Google Calendar invite delivered a link tied to a fake financial incentive regarding a credit against a recent invoice. Victims who clicked were directed to a hosted page and prompted to download a file. That file was a malicious installer that hijacked the ScreenConnect remote access tool, giving the attacker a direct command-and-control channel into the system. A complete compromise, delivered through a routine meeting invite.
Fortunately, this attack vector has a simple, zero-cost fix.
First, disable automatic calendar additions from unknown senders. In Gmail, set “Add invitations to my calendar” to “Only if the sender is known” or “When I respond to the invitation in email.” In classic Outlook, uncheck the options that automatically process and accept meeting requests. This single adjustment neutralizes the attacker’s primary delivery mechanism.
Second, train your team on how to handle suspicious invites. They should not click links, scan QR codes, or interact with the RSVP options. Clicking “Decline” still alerts the sender. Employees should delete the event directly and report it as phishing through their email provider if that feature is available.
Third, maintain healthy skepticism toward urgent requests or invites demanding authentication. Legitimate calendar invites do not require you to sign in to your email account from inside the entry. An invitation prompting a login is almost certainly an attack.
This threat demands immediate attention in high-volume environments like hospitality and hotel operations. Sales teams, event coordinators, and group booking managers handle invitations from unfamiliar contacts every day. An invite referencing a group block, site visit, or vendor contract looks completely routine to a coordinator processing dozens of inquiries a week. Those employees are the most likely to click, and they often hold credentials tied to core booking and payment systems.
Defending against this requires no new software. It takes two simple steps: turning off automatic invite processing and teaching your staff how to handle unexpected entries. If you want this locked down across your organization, discover how CMIT Solutions can help. As a managed IT and cybersecurity provider, CMIT Solutions can configure these security defaults across your entire Microsoft 365 or Google Workspace environment, ensuring every employee is protected without having to adjust individual settings themselves.
Source: ZDNet, “Fake calendar invites can infect your system, and they’re surging,” September 18, 2026.
