A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials.
We have identified several large-scale phishing campaigns that abuse fake calendar invites to harvest credentials. Some arrive as an .ics attachment (example 1). The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability. Others use a link that appears to lead to a different destination (example 2). Both are designed to harvest the victim’s credentials.
Check Point Email researchers are tracking these campaigns and have seen a significant surge starting September 25, 2026. A new detection layer specifically designed to identify this type of attack has flagged more than 302,386 unique phishing emails among our
customers’ emails, sent to more than 40,000 organizations. The campaigns average more than 8,319 emails per active day. The emails came from more than 33,890 different sender domains and more than 247,270 unique sender addresses.
EXAMPLE 1 A fake calendar invite carrying a malicious .ics attachment — valid calendar data that abuses the format rather than a software flaw. (Sender and recipient details redacted.)
EXAMPLE 2
A fake Microsoft Teams meeting invite. Hovering over the “Join” link reveals its real destination — a credential-harvesting page at login.microsoft.com, not Teams. (Sender and recipient details redacted.)
Activity is not fading, it is accelerating. Daily volume grew from a few thousand emails a month in April to more than 118,000 in September, and to more than 740,000 in just the first two weeks of October. The busiest single day so far was October 8, with almost 200,000 emails.
Full range, linear scale. The October window dwarfs everything else in the period — that’s the real shape of the data, not a charting artifact. Hover to inspect any day.
Same data, zoomed to its own scale — at the chart above’s scale this entire period reads as a flat line near zero. Hover to inspect any day.
- Malicious link delivered inside a calendar invite, a format users rarely treat with suspicion
- Link disguised as a Microsoft login page, built to capture credentials
- Thousands of different sender domains
- Large and sustained activity, still observed as recently as October 15, 2026
This is not the only disguise attackers use. We have seen similar campaigns that abuse other trusted, automated messages, such as fake voicemail notifications with malicious attachments. You can read more in our Check Point blog.
